Recommended
More Related Content
Similar to eval(self) or Linked in for infosec pros
Similar to eval(self) or Linked in for infosec pros (20)
Recently uploaded
Recently uploaded (20)
eval(self) or Linked in for infosec pros
- 1. eval(self) or LinkedIn for InfoSec Pros Ben Acord Upstate ISSA February 2019
- 2. LinkedIn Unexpected pursuit of new ventures Ministry of many hats and funny results Pick cert = win Fear, loathing and LinkedIn
- 3. What is LinkedIn A web service that provides business and employment networking Modern resume News feed Groups LinkedIn
- 4. What does LinkedIn Offer LinkedIn
- 5. LinkedIn
- 6. Good ‘n Bad Can give a way the farm False sense of knowing someone Much better than a resume Quick messaging to connections LinkedIn
- 7. Know Thyself Energy recharge v. expend 34 most common talents Talent development tool Max productivity StrengthsFinder 2.0
- 8. Know Thyself I have a small, close group of friends I enjoy meeting new people Strongly Agree Strongly AgreeNeutral
- 9. Know Thyself Executing Make things happen Relationship Building Strong relationships that hold teams together Influencing Take charge, speak up Strategic Thinking Absorb and analyze information
- 10. Summary Top 5 = Primary Talents 6-10 = Your Boundary Why do I really dislike certain tasks? What areas of InfoSec are best suited for me? What training should I take? Know Thyself
- 11. Mentoring Follow Tim Tomes BSides Greenville keynote advice: 2 ahead, 2 downstream Be intentional Mentoring
- 12. Mentoring State of the industry / region Career paths Training Be proactive Mentoring
- 13. Mentoring Downstream Listen Give back Be open Listen Mentoring
- 14. Network Filter your path forward with your strengths and guidance from mentors Engage with others Mentoring
- 15. Mastery Practice makes mastery not perfection Imitate and reproduce “We are what we repeatedly do; excellence, then, is not an act but a habit.” - Aristotle Mastery
- 16. PentesterLab free or Pro Hack The Box free or VIP Upstate ISSA classes DEF CON 864 = free Join a project Start a project Mastery
- 18. The System putting it all together Follow the 1-2-3-4 approach Treat it like a meeting System
- 19. One - Annually (2 hours) New Headshot - get close Replace the default Headline with a pipe separated list of keywords Update your summary System
- 20. Two - Semi-Annually (1 hour) Update your achievements Enable / Disable “let recruiters know you are open” System
- 21. Three Share a presentation or post System
- 22. Four - Quarterly (1 hour) Meet with a mentor or mentee System
- 23. Automating The System putting it all together Loop for Android Reminders on iOS Hootsuite & Buffer System
- 24. What about the 5 year plan? Takes care of itself You know who your are You know what you are focused on You are helping and being helped by others You are active in projects that suit your talents Pick goals and celebrations System
- 26. Thank you!
Editor's Notes
- One of the main reasons I’m here today is because my career has been completely free of stress, depression, anxiety, or disagreements with coworkers. I have had the rare opportunity to only work for companies who upsized their staffing, received glowing reviews from customers and by passers alike, and had all projects completed before initiation and without budget. There are quite of few of you in this room who have worked with me over the years and you know the lies in those statements.
- Some of us have experienced unexpected forced pursuits of new ventures. And most if not all of us have felt the gut sinking feeling of an urgent all-hands meeting where HR representatives flank the speaker. At one point in my career for what seemed like weeks without end the facility security guards and HR reps constantly walked people out of the building seemingly at random all day long. Looking back I realize it probably didn’t help my morale to watch Office Space each morning during breakfast. A natural instinct during these types of events to update the resume and LinkedIn. But that is possibly the worst time. Emotionally unsettled yet facing a screen to communicate how your contributions contributed successfully to an organization that has left you shaken. The impetus for this talk came from about a dozen conversations I had at the beginning of the year, end of last year, with various parents and high school students. Those outside InfoSec wanting to know more. I put this together as somewhat of a guide for those starting out and a reminder for the rest of us. Even for those of use well into our career LinkedIn is an afterthought. It tends to be treated with the same love as the resume received in the old days. Dust it off and update only when needed. But LinkedIn is different. It’s a 24x7 advertising agency for you. Like it or not.
- By quick introduction to LinkedIn…it is an online tool for …
- This goes beyond job posting or searching.
- The core of LinkedIn is your profile. LinkedIn has a business model focused on career development and placement. It contains a collection of well over 500 million online resumes. Many new to the industry will begin with a profile and not a traditional resume.
- Today we will look at ways to automate a system for keeping LI up to date with a minimum time commitment and even use it as a platform for your personal branding. And I’m taking this approach primarily to assist those new to InfoSec or who have let their LinkedIn profile go stale. So with the introduction out of the way and before we tackle LinkedIn we must first have a clear understanding of ourselves and the industry.
- So what is the best path forward? Every year there are blog posts and Youtube videos highlighting the top paying certifications or roles in InfoSec. This is a misdirection and not really helpful. It starts the discussion of what we should do, a five year plan, at a hypothetical point with a lot of assumptions. No education or certification will bring you success or make you happy. That’s not what they are designed to do. Success is an ambiguous qualitative term that has various meaning to each of us. Before we can discuss career paths, messages from heaven, projects, or a five year plan we need to understand who we are and how we’re wired.
- Gallup’s StrengthsFinder is a product resulting from 40 years of study on human behavior and talents. More than 10 million people have been surveyed to build a common language of talents regardless of title, role, or geographic region. These 34 theme talents are an ordered list of talents specific to you. The key premise is that your top 10 strengths are the way you are wired, your lens to view the world, and where you will experience the greatest satisfaction in life not just work. So if you spend most of your day working in your top five it is a productive, successful day. If, however, you spend all day working in your bottom five the days efforts will drain you, the work won’t be excellent and it may even cause you to begin disliking your job. One interesting thing about this test is the results have been shown to change very little between retakes later in life.
- 34 common talent themes are prioritized for each person based on their answers to a short quiz. The quiz is about $90 and is timed with each question timing out after 20 seconds. Don’t freak out it’s not bad its like playing a game of “would you rather?”. Each quiz item poses two conflicting statements. You simply pick the radio button for which statement best connects with how you thinks. You could strongly agree with one statement or be impartial to either and select neutral. There are 177 questions and you only get one shot to complete. Once the survey starts each screen will display for at most 20 seconds before moving to the next.
- The end result is a comprehensive report focusing on your top 5 talents. The top 5 order is the most important and there is a 1 in 33 million chance that someone else will have your same top five. The primary goal of StrengthsFinder is to put time and effort into just your top five and navigate (delegate) or just live with numbers 11-34. The goal is to build a true, mature strength and that means focusing on your talents (1-10). These ten are where you will spend all your practice, projects, and career focus. We all like a good underdog story but the study reveals that focusing on your weaknesses (11-34) will never produce the type of lasting quality necessary to offset how you are wired. It doesn’t mean you can’t do those things but it does indicate that if you are placed in those areas for extended periods of time or situations where risk & reward really matter the emotional aspects will erode feelings of success. I’ve found these to be helpful indicators of what rubs me the wrong what with certain events or work tasks.
- Starting out we’ve gained a deep understanding of ourselves. We can use that as a filter to sift opportunities; for example the types of roles we’ll investigate in InfoSec or training opportunities, even degree majors. Time is finite and we want to invest our time in areas that allow us to practice using our core talents.
- Story of mentoring We’re intentionally moving outward at this point but in a controlled way. Still personal but you are now connecting with two people who are further down the road than you. And we’re following Tim Tome’s advice from his keynote at last years Bsides Greenville to have 2 ahead, 2 downstream. Two further ahead in their careers and two younger. Mentoring is intentional. It’s bringing questions and critical thinking to an open discussion with someone who can provide credible advise to you.
- Proactive care of a mentor is approaching the meeting with clear intent. We’re not just getting coffee we are learning from this person. So we want to be active listeners and engage with questions to help understand and dig deep. Knowing what you want to understand is key before arriving for coffee or lunch. Talk about career paths, job roles, companies, and a whole host of general topics, particularly soft skills - how the politics work. There are life lessons that are not taught in classrooms but stored in the minds of everyone in this room. They are unique, personal and others can benefit from your knowledge.
- Being a mentor is great. Retirement is a gift. It is a great opportunity to provide leadership to those just entering the field as well as those mid-career.
- This is a good spot to draw diagram of activity summary on LinkedIn post with tweet The trouble with blogs is the risk of stale content. Schedule monthly summary of your activity
- You will either master bad practices or great. The outcome depends upon your persistent activity. If you are seeking to master SQL injection practice the steps over and over again for one particular exploit. It is easy to get distracted by checking boxes constantly needing to progress but remember progress is in your competence and capability. I understand the achievement argument that if you complete a course, or in PenTesterLab a badge, then you have proven both competence and capability. Long term retention of a task speaks to your capability more and that comes from extensive practice. We will never achieve perfection. Mastery is knowing the form, process, and flow so well that an known outcome is almost certain.
- Here are a few options to help provide training grounds for mastery.
- Now that GitHub is part of the Microsoft family this may become more fully integrated in the future. Be sure that your projects –hobby or jobby- are summarized on your profile. Otherwise your efforts occur in a silent loop and others have no real understanding of your competencies and capabilities in shaping the digital world around you. Any public speaking you do professionally can be uploaded to SlideShare (LinkedIn) and referenced on your profile. Talk about why you undertook the endeavor or project. Regardless of post or presentation explain the reasoning behind the project and the critical thinking necessary to pull it off. A great path to growth is reading and commenting on LinkedIn Groups that fit your niche. Ramps up your learning by gaining a broader understanding across that niche. As for posting that is completely up to you. A strong case could be made that if you are considering a blog or other form of posting regular content it is best to join it close with your profile. This profile is always active. It is your marketing campaign working 24x7 for you. And those who visit your profile will spend a little bit of time there. They probably won’t wonder far and wide to see who this person is. Even if you do have another platform, maybe you’ve had a blog since ‘98, cross-posting to LinkedIn or referencing the blog from LinkedIn. Just keep in mind this is the professional you. Same for any other sources like Youtube, podcasts, etc. Those platforms are great but be sure that “you” makes a big splash on LinkedIn.
- The activities we have covered are how you grow and build your network. Being involved with like minded people here in ISSA as well as other groups, like DEF CON 864, establishes an awareness of you as a person and your capabilities. You and I may know each other in that context but if I recommend you to my boss he won’t have our background. This is where it ties back to LinkedIn. Honestly I was wondering how this merry go round would end. You see the resume I pass along will quickly become their review of your LinkedIn profile.
- Treat it like a meeting … put it on your calendar. Let it prompt you to action.
- If you are just starting out in your InfoSec career after you take time to really dig through your StrengthsFinder report create or update your LinkedIn profile. The main callout here is the top portion of your profile. As we move forward the other areas will get more attention.
- Push yourself to share what you are working on. Contact the ISSA group and ask for a speaking slot. Come to DEF CON 864 we have an open floor each month and everyone gets to demo or discuss their project.
- Two mentors and two mentees can easily fall into the quarter without being overbearing. More than likely as time goes on your communication will be more ad hoc and frequent. But for those starting out or having difficulty this is an easy way to think about it.
- Treat 1-2-3-4 no different than any other scheduled event and add them to your calendar. I’ve played around with a few alternatives over the years and these stand out. Loop is nice because at the time I looked at it the app was local to your device without any cloud dependencies. So it triggers reminders based on your device clock. Obviously Reminders similar to other calendar software. The key take away here is to don’t just let life drive you to update your resume and LinkedIn but take a scheduled approach. And each of these doesn’t take long. How this plays out is as geeky as you’d like but at it’s core this is a low tech system. All you need is a calendar to remind you to take action.
- A five year plan is nothing more than you with a bit more age and experience. With this knowledge in front of you it should be rather easy to project a couple big goals or celebrations and scatter down the path ahead. This could be releasing a tool, contributing to a project as a lead, speaking at a conference, or passing a certification exam. In many ways the goal is far less important than the action you are taking today.
- Highly recommend watching this video
- Thank you