Great. Let me share some slides and then we will get started.
Can you guys see my slides?
Yes.
Yeah.
Yep.
Perfect. Alright.
So First off, who am I and why am I talking to you this
evening? So when I graduated from high school, I am listed in
the US Army and within the US Army I had the MOS of 74B, which
is called information systems operator and analyst. And what
that really means is you are responsible for the installation
and the maintenance of computer systems within the army.
And if you had this MOS, depending on which unit you are
assigned to, you could either be installing and configuring
routers. You could be just changing ink cartridges and
printers, or you could be doing something in between the two.
Specifically, I was in a unit called the 344th Data Processing
Unit out of Fort Belvoir, Virginia, and basically my job
was to perform tape backups on literal tapes.
You know the kind that essentially looked like the
reals of old movie projectors, like it was not high tech. It
was not cool at all. And honestly, it was not really a
very exciting life, but it was my life.
Umm. And in a case of definitely in the right place at the right
time, my unit ended up getting absorbed into another unit that
was also on Fort Belvoir and that unit.
When the two were combined, it would end up being renamed First
Information Operations Command and that unit was the first
cyber unit in the army at the time.
Umm first IO command did some pretty wild stuff and and
honestly I could do a separate talk in itself just on what that
unit did, but of importance to this story is that that's the
unit that contained the Army Red team and also the Army computer
Emergency Response team or the A CERT for short. So the blue team
essentially. So one day my entire unit was called into
formation. This was all explained to us and then they
told us that each of us.
Would be sent to schools for like 2 years and we could
essentially choose our own path. We could either choose whether
we want it to be a red team dude or a blue team dude.
So as the slide depicts, I chose to go down the red team path
because when you're a young guy and you get presented with the
opportunity to hack into computers.
Literally the only things that are comparable is a ninja or a
stuntman, so that's what I decided to do. So I went to
training for quite a time and then from there on out I did
pretty much nothing but red teaming or pen testing for the
next 15 years or so. And I've done those activities for the
army both as a soldier and as a contractor, Department of
Energy, the FBI, TSA, the judicial branch of the US
government, et cetera.
Currently I work for a multinational financial
institution and I've done also numerous side gigs for various
commercial customers. So Needless to say, if we were to
sit around a campfire and tell stories I would for sure have
some pretty wild stories to tell.
So after all this time, just focusing on pen testing and Red
Team, I was asked by the company that I currently worked for to
step down as the Red Team lead and challenge myself to move
into the role of a sock manager, which is literally the exact
opposite of what I had done my entire career. Why they asked me
to do this and why I selected, I'll get to that later in this
talk.
And just like all of you, I'm also student, and if we're
really being honest, if you are pursuing a career in
cybersecurity, you're gonna be a student for your entire career.
That's just always the way it is. There's always something to
learn, and you're always gonna have to adapt. But specifically,
I'm pursuing my bachelors and cybersecurity. I'm an intern and
PGIP tech, just like all of you guys are. So we're all in this
boat together.
Alright, so why am I giving this talk? So essentially having now
spent time on both the offensive and the defensive side of
cybersecurity. This is pretty much the $1,000,000 question
that I get asked on a recurring basis.
Which one do I like better and normally I just kind of give a
nonchalant answer. I'm like, you know, it depends on the day and
then we kind of shock when we move on from it.
But it really got me thinking, which do I really like better
and which would I recommend to people they're starting off on a
cyber career and.
What I'm figuring out is the answer is not really black and
white because there's things that I like better about red
teaming, and they're saying that I like better about blue
teaming. So I figured I'd put some things down on paper. I'd
give a presentation and here we are.
So.
Let's take a second to get to know the two combatants that are
gonna go head to head in tonight's battle.
First, we have the swashbuckling tyrants that are intent on
ruining everyone's good day, the Red team.
And against them, we're going to have the Valiant defenders of
all Things network, the blue team.
And before we really go much further into this talk, I wanna
explain to you exactly what these mean.
Umm. And why I wanna do that is because when you talk about Red
Team Blue team, these are the most misused, exaggerated and
misrepresented terms. And the entire cybersecurity industry.
So I think it's important that we really understand what these
mean because I promise you they can and they will be used to
describe a lot of different jobs. So let's break it down.
Alright, so first and foremost a red team like a red team
operator and a pen tester. They're vastly different,
although they can kind of be used to describe each other.
There are some really like key fundamental differences between
the two. The first is that pen testing is is a rudimentary
skill that all red teamers really should possess. But.
On the flip side of it, only a small number of pen testers know
how to actually be a red team operator, I've heard.
PEN testers, web app assessors and even people that just run
Nessus scans for a living doing enterprise vulnerability
scanning. I've heard all of them people describe themselves as
red teamers and that's not necessarily true.
Red teamers conduct what is referred to as full spectrum
attacks. This means that when a red teamers engaged against an
organization, they can use any method to achieve their mission.
This can be network, it can be web app exploitation, it can be
social engineering, physical security breaches where you have
dudes that are actually trying to break into buildings and try
and implant Rd devices. Basically anything that will get
the job done. Nothing is out of scope. On the contrary though.
A pen tester is limited to either a network or an
application, and typically there is a specific target. Pen
testers also have very strict rules of engagement and no
matter what, they cannot deviate from that rules of engagement
whatsoever. And in comparison, a red team operators, rules and
engagement typically say that anything outside of
intentionally causing a denial of service condition or causing
harm to a person or the property of your target isn't scope.
So that's a very like important thing to understand. You know,
as a red teamer, essentially.
The the fire hose is wide open. You can basically do whatever
you need to do to accomplish the mission.
Another thing is that a pen testers job is is to identify
and report on every vulnerability that they can
discover within the allotted time frame. And then obviously
you know write a report with the findings along with the
Remediations preliminary risk ratings. Just everything that
you found in comparison, a red team operator will really only
needs to find one vulnerability and as long as that one
vulnerability leads to the mission being accomplished.
It doesn't matter what the risk rating is, it's not gonna be a
thing where they say, Oh well, this was a low risk or this was
a medium risk. It's gonna boil down to the red team found
something. And then based upon what they found, they were able
to do this thing. Therefore, it's a big deal what you find
typically too is when PIN testers generate reports with
findings, there's usually some sort of risk assessment meeting
where they'll analyze and prioritize what they need to fix
first.
But when a red team does what a red team does and they
infiltrate your network and they've been successful, the
things that they found, what I mean is like the conduits that
allow them to accomplish that no matter what the risk rating is,
it's going to be fixed immediately because it led to
real world compromise.
Another thing is a pen test usually consists of what's
called a time bound assessment, and that means that everything
that can possibly be discovered and exploited within that time
frame will be attempted, and typically those are one to two
to three weeks. They're very small engagements. However, Red
Team operation can last for months. It will be planned some
time in advance, will be communicated to the appropriate
parties, and the executed with very little time constraints.
If if you scope it to say we'll take one month, that's cool. But
also if you scope a red team operation, you say it's gonna
take eight months. That's that's also cool. Because specifically
when you're talking about a red team operation, you're not only
trying to find the vulnerabilities, but you're also
challenging the incident response. People that work there
as well. So if the key to doing that is going low and slow as a
real attacker would would, then that's what you would do.
And the absolute biggest difference in my opinion, is
that for the most part, PEN testers identify and they rate
discovered vulnerabilities individually, while Red Team
operators typically have the ability to chain together
vulnerabilities.
And these vulnerabilities, they could typically be rated like
fairly low, but by chaining multiple low risk
vulnerabilities together a lot of times a red team can turn
those into something disastrous.
As an example.
Let I'll tell you about a red team operation that I did.
Umm against a ecommerce company that will call acme.com. So I'll
tell you this story and that'll kind of piece together the point
that I was trying to make.
Soacne.com they sold products such as rocket skates, anvils,
and paint on holes that coyotes could use to try and destroy
roadrunners. Acme.com had a public website like like most
other organizations, but they also had a set of protected
applications that were only available to existing customers.
These are applications like in ordering application where you
could order these products billing application where you
could pay a customer directly.
Directory application etcetera.
So the acme.com application allowed anybody to create their
own acme.com account.
Meaning, if if you had a Gmail, if your e-mail address was, you
know daryl.kellison@gmail.com, you could still create an
acme.com account, but in order to access the protected
applications that I mentioned, you had to belong to an existing
customer. So our mission essentially was to gain access
to one of these protected applications without an account
linked to a customer. So as a team, we allocated one month for
this operation.
It was one month of kinda a low and slow operations just to see
what was out there, see if there was any low hanging fruit that
we could exploit a two week period and and you know well the
whole thing was one month. Sorry there was a two week period
where we kind of just went low and slow and then there was a
two week period where we would just hit it real hard and real
heavy and just go Full Monty.
So nearing the end of the engagement, we really didn't
have much. Then we had kind of one of those Eureka moments of
of a bunch of different small things that we observed earlier
that we could piece together. So what we did is we created our
own acme.com account using a shared Gmail account that we
created for the operation. The first finding that we observed
was that if you browse to the user profile of the account you
created, you have some self-service capabilities.
And what I mean by self-service capability is you can create
like a a question for if you forgot your password to recover
it. But the thing about this was it wasn't like a pre canned set
of questions like what was the first reach you lived on or what
was your dog's name. You could literally create whatever
question and whatever answer you wanted for yourself. And the
thing about this is there was no limit on how many characters the
answer to it could be. So that was finding one.
On the second finding was we observed the concurrent sessions
were allowed and basically what that means is once you create an
account, you could log in with your account and at the same
time with a different IP address. You could also log in
with that account from a different location.
And and what the thing with concurrent sessions is, even
though you're logging in from two different geographic
locations, both of those sessions remain active.
A properly configured web application, if you have the
same user account login from two different IP addresses, it
should invalidate one of them and notify you. But this was not
the case.
So if we take these two findings, if we had just been
doing a standard pen test, these two findings individually likely
would have been rated low or maybe medium at the highest. So
they wouldn't really have raised a whole lot of alarm. But what
we did is we wrote a piece of malware to be delivered to an
administrator of the acme.com application, which, by the way,
if you logged in here and you looked at your user profile, it
was displayed and it gave me the address of your administrator.
So. Umm.
So basically what we did is we wrote this piece of malware, we
sent it via e-mail.
To the administrator of this application, they would execute
the malware and what it did was it dumped the cookies from the
user's browser. It made an outbound HTTP connection to the
acme.com application and it logged in with the hard coded
credentials of our Gmail account that we created. From there it
would go to the user profile page. It would change the
password Security question to the value of the extracted
cookies once this happened.
We could simply log in with our own credentials, visit our user
profile page and we could retrieve the session cookies,
which we already know can be replayed. So at this point we
basically just set our session cookies. We refresh the page and
voila, we were now logged on, logged on as an administrator of
the acme.com application. From here we could give our Gmail
account whatever privileges we wanted. We can order products,
we cancel existing products. We could change the shipping
address, we could access payment information, whatever.
Basically, we had the full privileges of an acme.com
administrator, just these vulnerabilities, and the point
is a pen tester who found these things individually. It would
have resulted in two low to medium findings. But when you
have the red team operator mentality, you think about
piercing these things together and ultimately and it ended up
in a successful mission.
So obviously if there's a yen, there's has to be a yen. So
let's talk about the blue teamer. And just like Red Team
versus pen tester, a blue team can really mean many different
things, but they're all part of a blue teamer. The first thing
is you have your sock or your security operations center.
These are the people that are literally analyzing logs and
they're performing the triage investigation and response to
cyber events. These are the people that literally watching
your network as you sleep.
Next, you have a a security engineering teams and they're
responsible for making sure that the sock has the logs and
necessary to allow them to be able to detect and investigate
events.
And also the security engineering teams.
They they also have a pretty important job function which is
running the detection logic that triggers notables when events
happen. Next, you have an identity and access management
team. They're responsible for provisioning accounts for users,
and importantly, in the context of incident response.
They're the team is responsible for disabling accounts for
leavers and also accounts that are part of a security
investigation.
I'm also a critical piece of a blue team is a threat
intelligence team. These teams, they use a combination of open
source intelligence gathering, commercial intelligence
providers, or even government partners. And what they're
trying to do is they're trying to get the inside scoop of any
threat actors or techniques that the sock really needs to watch
out for.
Umm, this info is then fed to the other teams within the Blue
team and it's it's it results in.
The creation of what are called use cases. Sorry about that.
It's time clock wizard, but yeah, this these pieces of Intel
results in use cases and what a use case is. As I mentioned
before, it's the text and logic that says OK, when this event
happens, we'll trigger something in our SIM and then our stock
observes it and then they go investigate it.
And finally, you need to have a forensics team, and this is a
team that's trained to conduct forensic analysis and evidence
retention in the event of a cyber compromise.
All right, so here is the criteria that we're gonna use
this evening when we try and determine which is the cooler
job to have.
Alright, so uh, a quick disclaimer disclaimer.
My lawyers advised me to throw up customary disclaimer that
these are just my opinions and they don't represent any
organization that I've worked for or that I've ever been
associated with, and there's probably people who are not
going to agree with me, and that's OK.
Ultimately, I'm just kidding though I don't really have a
lawyer and I wasn't advised to do anything. But the point is
these are strictly my opinions.
All right. So I think we all know who this guy is. He's a
pretty popular dude named Michael Buffer, and he has a
pretty famous catch phrase, and I'm sure we're probably all
familiar with. It's written on the slide, but I'm sure most of
you are probably saying it in your head right now in his
voice. So let's go ahead and get down to it.
Right. The first thing we're going to talk about is, uh,
which one has better St cred? Which ones more fun? And as the
slide says, this ones pretty much a no brainer as a red team,
you are essentially a God amongst mortals and when people
pass you on the street they move to the other side of the street
so they don't have to look you in your eyes. You're the
ultimate bad guy. You probably ride a Harley and you live your
life doing whatever you want like you are literally the
coolest of the cool.
So what's kind of a funny story is when I was on the Red team
and my current place of employment, I used to just for
like, fun and entertainment randomly walked down to the
socks area, which ironically is now the team that I run. And and
I would just walk down there and be like, hey, guys, how's it
going? See anything cool today? And when they would be like no,
it's quiet. I would just be like, huh. That's cool man. Hope
it stays that way. And I just turn around and walk away.
And and The funny thing is, while I was walking away, I I
could hear them start to scramble. And by the time I got
back to my desk, my machine would miraculous be at 100% CPU
utilization due to our EDR solution.
And I was under an active scan because they just wanted to see
what I was doing at that time. And and like I said, it's it,
it's just due to that aura that I had as a red teamer. If I
walked in the room and I said something like that, they
automatically thought that I was up to no good and something
crazy was happening. But now I'm on the other side of the fence.
So fun times.
So the winner, like I said, this one not even close as a blue
team or now.
I have a different kind of respect that I had.
You know, people come to me for more answers now that they did
when I was in the Red team, but like I mentioned before, it it
it's just a different kind of respect, absolutely hands down
St Credit and respect Red Team wins it.
All right. So which one is easier for you to land a gig in?
Umm, so the blue team jobs are mentioned annually almost
considered a jumping pad into the cybersecurity world, and
honestly, I see a lot of recent college grads get hired into
these roles across the industry.
The key is that there's so many different processes pertaining
to how to investigate and how to respond to cyber incidents. So
success initially in this field is really tied to being able to
locate and follow a process. As you mature and a blue team
career.
You'll be responsible at some point for actually improving
these processes and discovering new ones on your own, but
initially you don't really need any specialized certifications
or experience to land a job on the Blue team side. You really
just have to be able to demonstrate that you're
motivated and that you want to learn. On the flip side though,
to join a red team, even at an entry level, you're gonna need
something that says you can pin test. Remember earlier I said
all red teamers should know how to pin test.
This is absolutely true.
This is usually gonna be a cert that has some sort of practical
portion of the exam, so like a SANS certification or one of the
offset certs, they're definitely gonna help you here. And the
other thing is too, you also have to fit in a red team is
full of people that are wild, like they're bad boys and they
like to behave as such. And you know, they like to have that
aura of just being the bad boys or the bad girls. So if you go
to an interview for Red Team position.
Can you demonstrate that you're kind of like a straight by the
books person that is not really willing to toe the line and have
fun? You're not gonna fit in.
And and honestly if if you go to an interview and you kind of
have that aura, the senior red teamers, they're gonna be able
to sniff that.
Very, very quickly and figure that out.
So the winner is the blue team. As I mentioned, you can get a
job as a stock analyst or someone on one of those
different blue team disciplines really just by having some sort
of education and being able to display it at you're willing to
learn.
All right, so this is kind of where things get interesting.
When we talk about which one of these is more challenging.
Excuse me. It's surface level. People think that being able to
pull off these advanced cyber heists without detection would
be harder, but it's really not. And to be honest with you, it's
not even close. The thing is, the red team determines the
parameters of the attack. The attack is gonna happen at a time
and place of their choosing. They literally have the supreme
advantage. If you're targeting an organization, you can choose
to do it on a holiday weekend or just a weekend.
Or just in the middle of the night. That's your prerogative.
In comparison, the Blue team has to be prepared to detect and
respond to any cyber incident 24 hours a day, seven days a week.
Umm, you know, 365 days a year? Doesn't matter if it's 3:00 AM
your birthday. Your anniversary? Christmas. When it's go time,
it's go time. And that's just what it is. On top of this, the
Blue team really has to be aware of what every application does.
What devices are present on the network? What networks exist?
What's critical to the organization? What normal
behavior looks like? I mean like they literally have to be
masters of their domain.
Umm. If you quote uh Sun Sue, who wrote the art of war, that's
one of like the most quoted.
Books in all of cybersecurity, he says it best when he says if
you know both yourself and your enemy, you can win 100 battles
without a single loss. And as I mentioned before, the Blue team
really has to be ready to respond to exploitation attempts
against any vulnerability that has ever existed. I couldn't
even begin to really put a number on what this is like.
We're probably all familiar with log 4 J, which is a huge
vulnerability. You know, that that occurred not long ago. So
you gotta be prepared to defend against that.
You have to be prepared to defend against the vulnerability
that was released two years ago. Three years ago, five years ago,
10 years ago. Like you have to literally be ready to respond to
any attack attempts, no matter when and how it occurs.
So once again, if we talk about a winner, I'm gonna put this one
on the blue team.
All right.
Or essential. Basically what this boiled down to is someone
has to pay the bills.
You know when you start thinking about an organization, you have
budgets and and you have manpower and you gotta figure
out what activities you're gonna perform every year, which
ultimately means you have to cut some. So if you compare the two
between Red Team and Blue Team, which one can you get rid of,
which one can you live without? If you have to make budget cuts
in the short answer is the Blue team absolutely must exist. But
the Red Team is a luxury.
And if you don't believe me, think about think about any
organization.
Go to the sister of that organization and say, OK.
For one month, put all of your red team on leave or put all of
your blue team on leave. Which do you choose? It's a no
brainer.
They're going to choose to keep the Blue Team 100 out of 100
times.
All right, moving on to future growth potential, so this slide
here details exactly why I accepted the proposal to move
over to the Blue team.
Me personally, I have aspirations of being more than a
red teamer, and when you've had a career of only being a red
teamer, it kind of limits you on what your next career move will
be. As I said before, being a red teamer is probably literally
the coolest job you could ever have in the world, but in the
US, we have to work and see our 60s or 70s, and I'm sorry to
remind you guys all of that, but that's a fact, but to me.
Being a 60 year old pen tester or a 60 year old rent team
operator actually sounds kind of lame. So I started thinking
about other things and as a result I had some very candid
conversations with senior management and my organization
about my desire to one day be assistive and you know they
acknowledged it to believe that they believe I would make a good
one. But at this point I've only had experience Red teaming and
leading Red team and pen test teams.
And ultimately, you know in my goal would come assist. So that
hurts me. The proposal for me to take over the stock makes me in
more desirable candidate because it will give me experience
leading a team on both the offensive and the defensive
side. So that literally is why I accepted the challenge.
And if we talk about management potential and and no one really
likes to talk about being a manager like like when you're
young and you're just exotically hacking into systems.
That's kind of your thing and you think it's really cool, but
as you get older, you might not wanna be an operator anymore.
You might wanna move into a management position and if you
talk about the potential of of management on both sides, really
if you're into the red team as you get older, you wanna move
into this?
The highest place you can potentially go is to be either a
red team manager or Red team director for or for an
organization, but On the contrary, if if you go a sock
analyst or the Blue Team route.
You can move to become a stock manager. You can move to become
a sock director from there and then from there you can move to
become a siso. So I my opinion is on the Blue team side you
have a lot more potential to move up in a company and achieve
a higher levels of positions.
So.
We have another win for the Blue team.
Now, which one pays more? This is probably what you guys were
waiting for, but here it finally is. And honestly, this one is
really hard to answer. Initially, you're gonna make
more money being a rent teamer or a pen tester. You know we
live in 2022.
Remote work is very common now, especially after COVID, and it's
very common for red teamers or pen testers to double dip, which
means you essentially have two full time, 100% remote jobs. And
yes, this is ethical if you disclose it to both companies
there there's nothing unethical about telling a company company
A that you will work between the hours of nine to five doing 100%
remote pen testing and telling Company B.
That you will work between the hours of 9:00 PM to 4:00 AM if
you desire. Also doing the same type of thing. So initially you
can do this. You can gain two full time salaries, which is
really, really awesome. You know people that do this, they
literally just hack all day and all night and they make a rack
of money. But here's the thing. It's not sustainable. You can do
it for six months. You can do it for a year, but especially for
people that have families, you can only do it for a short
amount of time before you get burnout.
On the contrary, though, as I discussed in the growth
potential slide, Blue team, people can elevate higher.
Specifically, they can, they can move to senior manager roles, VP
roles, syso roles and the cool thing about the senior
management roles is they typically come with bonus
structures and other perks and those can help you get money as
well. And they're definitely more sustainable in the long
run.
So this one I'm going to say it's high. I mean you can you
can make good money doing both. It really just depends on you do
you wanna make a bunch of money and the short run or do you
wanna set yourself up to potentially make money in the
long run? I mean, it really depends on you.
So here's our final tally. We have five wins for the Blue
team, and we have two wins for the Red team. So if you remember
in the beginning when I started talking about this, I mentioned
to you that my normal response to which I like better is just
the generic. Ohh, it depends on the day.
But my real answer is, you know, I had a lot of fun being on the
Red team, and honestly, I work a heck of a lot harder now that
I'm on the blue team.
But I believe this was the right move for me to make in my career
and if I had to make the choice over again, I I would choose the
blue team again so.
I say that to people and they typically agree with me. So
yeah, you can take that for what it's worth.
So any questions from anyone?
Not a single question.
I would ask you a question.
Would you do it all the same what you did?
Absolutely.
Or would would, would you? You wouldn't start with blue to
begin with now.
So so if I have if if I had to do it over again, I would still
start with the red team over the blue team.
The reason being is is since I have an offensive background and
I under, I understand how exploits work and more
specifically I understand the actions that happen after the
initial exploitation occurs. It actually makes me a better blue
teamer, so I believe if you have offensive experience before you
start the blue team path, it will make you stronger.
Yeah.
Yeah. And certainly all of that, there's a time and a place to
become a manager too.
Indeed. And and and the management track is not for
I mean.
everyone.
No.
There are. There are people that will wanna sit in front of a
keyboard and be operators for their entire career, and that's
cool. That's just not me, you know.
Yeah, yeah.
Yeah, it's more than an issue. I think you know when you get to
the manager stage, it's it's a lot more stressful mentally than
it was when you were red teamer and you were stressed anyway.
But stressed in a different way, you know, I mean.
Yeah. And that's true because even as a red teamer, I I can do
a red team operation for one month and I can come back and I
And I.
can say, hey, you know what? I tried my hardest and you guys
are excellent at cybersecurity. I could not find anything good
job and everyone will celebrate and leave the room and being
happy and they'll be like we beat the Red team. But on the
flip side, you know, when you're running a blue team, if, heaven
forbid, if your company is actually hacked.
And you don't detect it or you don't respond, right? That's all
on you.
Yeah.
And it never ends. It's not six point in time.
Yep.
Well.
Umm.
Very cool. I thought that was great.
Yeah, for.
Well, would you tell students who are just starting out and be
able to get the most out of their degree and they were just
starting out in summer cyber? What should they do?
So. So so I, I I I'm gonna sound like a contradiction because I
literally just said that being a red teamer first, you know, made
me a stronger blue teamer, but I would recommend for new people
with their degree to start out on the Blue team side just
because as I said before, it's easier to get that initial
foothold and get started. And really, the thing with
cybersecurity is experience one of the.
One of the key things one of the key ingredients to being
successful in cybersecurity is experience and a desire to
learn. So if you can get your get your foot in the door and
organization even in a blue team slot, but you can display that
mentality that people see that you're continually evolving and
continually learning, and you want more, they'll give you
more.
Umm.
I joked and chat about going Purple team.
Is there any way to combine those so that you you do have
the pen testing knowledge as well as the Blue team knowledge?
Yeah. So so purple teaming, that's that's actually a very
popular term in the industry right now and it is all the
rage. Everyone loves saying purple team and essentially an
example of how we Purple team in my organization is the Red team
will do an operation and the operation might last for three
or four months and then basically at the end they'll sit
down with the blue team and it'll be a very formal thing and
they'll say, OK, we did this operation.
And here are the individual things that we did in this
operation. Walk us through what you detected, what you did, what
you saw, and all these types of things. And then basically as
the blue team goes through and tells that story of what they
saw and hopefully their piercing the entire the entire operation
together, the Red team basically along the way stops them and
says, OK, well, you saw this, but we also did this so.
You can enhance your detection capabilities to detect this by
this and and like I said, that is all the rage right now in the
industry.
I I have a question off a comment that needed for now
representation is it I don't know about anybody else but I've
experienced going to. I went to a conference called.
Data connectors this past week and it was a conference was with
like FDI and and the agents and all all people who work in
cybersecurity and and high and high levels.
And one thing that they discussed was in and it was a
networking event with many different companies that you
know, across Chicago and other areas. But one one thing that
they mentioned is that a typical in an organization is that a
typical question that maybe an employee would ask you, you
know, what's your background? Are you new to cybersecurity?
Can you explain the difference between the Red team and the
blue team and a?
Which team can you? Are you able to explain the difference? Is
that a typical question? And they ask you, we know why would
you wanna be on this team? Is that a typical question that?
Someone would ask you and and to in cybersecurity.
Yeah, so so.
Sorry, Julie is silly.
No, no, so. So I'm not a gambling man, but I would bet
the farm I would bet the farm you will be asked that question.
No, I know.
Right. And then be able and then in that would give the employee
what knowledge do you have and are you able to provide that
knowledge based on what kind of testing you know and so on and
so forth?
So, so so my previous life as the lead of a red team. I would
interview people for Red team positions and I would even ask
them what is the difference between a red team and a pen
Umm.
test team and and a lot. A lot of people are not able to answer
that question.
Right.
So that's that's a very common question.
Ah, that's interesting. That's interesting. That's what I took
from the data connectors conference, so I thought, wow,
that would be really interesting question to ask a new person who
who's entering the Phillip Cybersecurity.
OK. Yeah. Well, it's amazing what you can pick up from going
And.
to events.
Ohh yeah, no, it's.
Absolutely. And by the way, and by the way, I am a gambling man.
Yeah.
I'll just suppose it.
Ah, yeah. Well, if anyone ever gets a chance to the conference
that I attended was called data connectors and I will tell you
it was a my first my first cybersecurity event I've ever
gone to, and IT, and it was absolutely it was null the
event, but it was it was phenomenal.
Can you? Can you like maybe post a link within the chat so we can
Uh, yeah, I can't think like, yeah, it's called. It was once
show you?
your data connectors, but I can post a link but it was like, you
know, they had guest speakers. There was a gentleman named John
Phalcon Falconer who was like, I think it was this assistant
director of, like, Homeland Security again. But they go to
many different States and they have.
Tons of people present as high level people who work in
cybersecurity, so I would definitely post that link. I
just if you live in one of the states, I quickly moved from
Detroit to Chicago and they go and I just think it's if you
love cybersecurity, which I do, it's a wonderful conference to
go to. So I would definitely post that link in teams, yeah.
Thank you. That sounds cool.
Yeah, it is. Was it was. It was a great long day. But for
nomenal day.
And that's amazing what they give away at the conference as
well.
Ohh yeah, I mean a conference. A great place to get some cool
Ohh yeah, it's amazing. OK, just you can come up with.
swag.
Yeah.
Yeah, a lot.
Well, thank you so much. Dale was just Julie. It was
phenomenal presentation. I really appreciate it.
Thank you. I appreciate that.
You're welcome, but I will post that again.
They, Daryl, I've got a question.
What do you think of the most important certificates for entry
level positions?
Talking on the Red team or the Blue team side.
Ohm.
Probably Blue team specifically as this entry level.
Yeah, there's. So unfortunately the the SANS courses are pretty
expensive, but.
Sands has some nice entry level Certs. I'm specifically there's
one called the GCIH which is the GX certified incident handler.
Those are nice. Basically anything from sans is gonna look
attractive on a resume, but as I mentioned, they're very
expensive too.
Even so, I know you're. You're in the cybersecurity department,
so I definitely know what tasks you're being assigned. But like
Umm.
the try hack me stuff for cyber defense, that's good the the
Splunk training that you can get within our task, that's also
good as well. I'll tell you specifically if I'm hiring a
sock analyst, especially for an entry level position and I can
see that they've attended training on their own pertaining
to anything Splunk related or anything incident response
related or cyber defense related.
I'm I'm already intrigued.
OK.
Sounds good. Thank you.
Great presentation.
Thank you.
My guys, I know you got some more questions.
All right. Going once.
I'll I'll have one more question, Daryl.
Perfect.
Kind of along the lines of programming languages. What kind
of experience do you have and what do you find is most useful?
Yeah, I mean, Python is king, especially if you're pen testing
or red teaming.
It's kind of an assumption like.
You like when you're interviewing people for pen
tests or red team positions.
You don't even specifically ask them what scripting or
programming languages they know. You pretty much assume they they
are fluent Python because that's pretty much just that's the
industry standard.
And another thing too that was PowerShell. So I would say, uh,
PowerShell is really good for post exploitation stuff. So it,
especially if you're looking for the offensive side, Python is
King and PowerShell is a close second.
Yeah.
What have you found is the best way to kind of learn more
Python?
I like I mean there there's resources that once again, I
mean we can. I think you probably took some stuff and
your degree path and I think we can get you some more, but I'm
pretty fond of code academy.com.
OK. Yeah.
Code academies really good. If if you're specifically into like
pen testing and that's kind of where you're going, there's a
book called Violent Python, which is really good, and
there's also another one called Black Hat Python, which is
really good. And those books are cool because.
They're basically just telling you how to automate pen pen test
tasks using Python like for example.
Umm.
Instead of using Nmap for port scanning this, this tells. This
directs you how to write your own port scanner with Python or
how to write your own reverse shell or your own listener. So
they're books that are pertaining specifically to pen
test tasks that you can write yourself with Python.
That's good. I like that.
Thank you.
And soft Dev, we have resources for developing in Python. I
don't know if that would be helpful at all.
OK.
I can send you those links.
That would be great.
Greatly appreciate it.
Thank you.
Alright. Any more questions from anybody?
Don't be shy. I love to answer questions.
Great job, girl. Thank you.
This is Felicia. I have a question. I'm sorry.
No, I was just saying thank you. Go ahead.
I.
Hit A plus certification, some I'm telling years ago and it
seemed to be something then. I haven't seen a lot of that now
and I know it's a lot of certifications now, but it's a
plus deal.
Either software hardware, still something that is the value to
have, maybe even on entry level.
Unfortunately, I don't think the A Plus is really gonna help you
cybersecurity, but if you follow the the evolution of the CompTIA
certs, you have the A plus the net plus and then set plus.
And obviously if if you wanna be either a network defender or a
network attacker, you have to have prerequisite network
knowledge so the network plus can help you and then the next
evolution from that is the SEC plus exam SEC Plus is a very
nice cert to get your foot in the door.
Umm. As I mentioned before.
If if you applied for a role on my team on an entry level
position and I saw that you had a SEC plus certification, it
would tell me that you went out on your own and got that, which
fits the mold of someone who wants to learn and is
enthusiastic, which would make me look favorably upon you.
OK. Yeah, they're.
How do you how do you spell that?
That plus.
Yes, sorry.
SEC plus.
Ohh. OK. OK. Sorry that. Thank you.
2nd.
And the vendor is called a.
CompTIA, CompTIA.
I'll come to you. OK. Thank you.
Alright. Any final questions from anyone?
Alright, well, I wish you all a pleasant evening.
And I thank you for joining.
Thanks, Dale.
Alright, have a good day everyone.
Thanks Daryl. Have a good night.
You too.
Thanks Daryl. Have a good one.
Like.
Thank you, Darrell. You guys have a good one.
See.