Ayman Elsawah on Cloud Security and Infosec Careers

All right. Good. Sound check. All right. I'll try not to move around too much. Yeah.

All right. Hi, everybody. My name is Ayman Elsawah. I came in. I was invited here by Sam. Thanks a lot for having me. And Steve, thanks again. So today's talk is going to be covering a few things. I'm going to cover cloud security. From my perspective. And diversity, and then a little about Getting Into Infosec. So a little about me. I like Hawaiian shirts. So on Fridays, I wear Hawaiian shirts. Today's not Friday. Is this not, is this what people see online? 0:42 Yeah, should be, yeah.

Great. So yeah, I like Hawaiian shirts. I'm really into coffee, so this is my actual coffee set at home. So if you want to talk about single origin and different pour methods and recipes, I'm happy to talk about that. I work with AWS every day, so I try to help secure AWS in that environment. I also have a podcast. So you go to gettingintoinfosec.com, and it's stories of people and how they got into infosec. 1:19 And just their transition because everybody has a different way of how they got into information security. And so I could record a thousand different stories and hear a thousand different ways. And the idea is to help encourage and inspire and educate those out there looking to get into the field. And then as a result, I also, before thinking about the podcast, I also wrote a book. It's my guide as to how, you know, you're starting from zero, how you want to get into the security field. Different positions and things like that so yeah there's a bit of a lag online so let's see how that goes wow that is quite a quite a bit of a lag should i switch to a different wi-fi yeah let me switch networks oh that's fine oh it's not 2:14 No, it's mirroring, it's just, it's a lag, I think because I'm on solar connection.

There we go. Still lagged, but all right, let's try this again. So let's talk about cloud security. So let's take a little survey. Who here has used either one of these three platforms, AWS, Azure, or Google Cloud Platform? Okay, great, great, great. That's really good. That's really good. So I'm going to talk about AWS in particular. So for those that don't know, AWS has tons and tons of services. 3:47 This is just page one from their console. So if you log into the console, you can see all these services. And they practically come up with a new service almost every week, if not every day. And if I go to the next page, there's more services here. Oh, there's a really big lab. So a lot of services, right? And the idea is that you wanna start a company, you wanna start a product, they take care of the underlying technology and then you just work on the product itself. And they're all over the world many different regions all over the world coming up and so the idea is that and here's an example of different instances for example so I mean look at this one it has you know 12 terabytes of memory you know you're trying to do some heavy-duty horsepower this is you know obviously you pay a couple dollars an hour for this there's also you know you want a GPU you want to start a cracking machine you can totally do this in the cloud with just a click of a button 4:46 So what does this mean? Well, this is what this means for most people, right? They have an awesome car. They could like really, really do some good stuff. Yes, I'm going to the cloud. Yes, cloud is awesome. But in reality, this is really what happens. Okay, because, you know, you're giving so much power to people just at their fingertips with like little to no background at all. So this is often the case, this is why I'm still employed. 5:20 And so what does this mean? Well, AWS has the shared security model, okay? Where they take care of this stuff here on the bottom, and you have to take care of the stuff at the top, okay? So you don't have to worry about the power, the air conditioning, all that stuff from the data center. They take care of all that, right? They make sure that everything is running. But if you do spin up an instance, you have to make sure that it's secured from the internet, okay? You have to make sure that there's good authentication. You have to make sure That's up to you. 5:52 That's your responsibility. It's a big responsibility. But a lot of people, companies, governments, everybody don't understand this. OK. And so a lot of times, you have companies that are natively built in the cloud, especially here in the Bay Area. You have companies that are natively built, and they kind of can speak cloud language from the beginning. But there's also lift and shift, where companies are coming from the data center model, and they're going to the cloud because it's the next new shiny thing, really. 6:22 Watch in a few years, we'll go back to data centers, right? Private cloud. Private cloud, private cloud, yes, yes, yes, quote unquote. And so these are the ways that companies hop into the cloud. And so what are some issues that happen? Well, I'm going to highlight two of those categories, and it's misconfigurations and poor access control. And you could argue that it's the same thing, but let's, for the sake of argument, let's talk about misconfigurations and poor access control, OK? 6:55 So let's talk about, I had another GIF, but it was in a different document. This is a list of all the S3 bucket leaks. What's S3? S3 is a container of where you're supposed to store your data. By default, it's closed. But oftentimes, you're looking to share your data with either a third party or another developer or whatever it is, and you hit public. And lo and behold, your data is now public to the world without people knowing. 7:25 And so this is somebody actually, there are so many, there have been so many S3 data leaks. That someone started a wiki page or GitHub listing all the different breaches. Okay, so it's quite a list of items. And, you know, here are a couple examples to highlight, you know, some, I mean, there was even a story about a AWS sales employee leaking a bucket as well. So that was quite hilarious. And if you look at all the companies listed here, you have a total of 9 billion records that have been leaked. 7:57 And this is at the time, you know, it's increasing all the time. So what about poor access control? Well, IAM is the new perimeter. What is IAM? Identity and Access Management. So before, everybody was focused on the network and making sure that your servers are secured and the network access is limited and et cetera, et cetera, and even whitelisting.

If you don't have your credentials secured, it's a disaster. And we're talking about having a piece of credential that looks like this that's sitting in your code or sitting anywhere in the world. With this piece of information, I can from a CLI with one line of command. I'm not even say code. One command, I could launch 1,000 instances of the ones you saw earlier all over the world if I want. 8:58 And so oftentimes, it still happens today, you have companies that leave this Information in github in code everywhere and it's really it's really a disaster so we really want to limit this and then have this not happen so yeah and so yes That's right. 9:28 So ideally, we would not want to use, these are keys, so access keys. There's another way of doing things where you could have, for example, an instance, you can give a machine a role-based access and say, hey, you're allowed to do this, this, and this. And then keys are generated dynamically from the back end, where keys are short-lived only five minutes, one minutes, but you don't even see that communication. So doing it this way is kind of the manual way, which is fine for certain instances. 10:02 But for an application, you don't want it to use hard-coded keys because they have no expiration at all. And so if an employee leaves and grabs this key, depending on the permissions attached to this, they can do a certain amount of damage. So there's certain permissions that are attached to these credentials. And so that goes to my next slide here, where you want to attach particular permissions to these credentials. And so here's an example of what not to do. Again, let me walk you through this. 10:34 So this means S3. Let's see. I guess I can't play. This means S3 right here. S3, oh, sorry. Let me not try to get technical. S3 is, again, we're talking about buckets. And what this is doing is giving whatever access credential you're allowing everything to do in S3. You can delete buckets, create buckets, put objects, delete objects, all this stuff. You don't want to do that. This is from a real environment before. 11:06 EC2 is where all your compute instances are. What is this? This is all laziness. This is just being lazy, right? Because you really want to employ least privilege. Least privilege is where you're saying, I don't need everything. I just need to describe instances. Just give me a list of all instances out there so that I could take an inventory, say it's an inventory machine or whatever it is. But instead, they're doing EC2 a lot. That means it could create hundreds or thousands of instances. If this machine, so this was a role-based access, which is a good way of doing it, to answer your question before, instead of having a key. 11:40 However, these permissions were attached to it. So if that box got popped, then the attacker could do all this stuff. Route 53 is a DNS service. It could just... Change all your hosted zones it's just amazing so you know don't do this right should be more fine-grained listing exactly the permissions you need okay any questions so far okay so has anyone heard of a company called code spaces let me share my video in case people want to see me 12:15 There we go. So I try to be a little more like, so, code spaces is, there we go. Yeah, I think it should go away.

Or maybe not.

Oh, okay.

All right, so Codespaces looks like this, okay? They're a company that offers rock solid, secure, affordable Git hosting, okay? Of course, they say it's secure, so it has to be secure, right?

I don't know. I don't know. I guess this was an alternative to GitHub to use in a private, maybe a cheaper option. I have no idea. So this was their website on this particular day. This is the website on one particular day. The next day, this is what the website looked like. All this was because an attacker found their keys that had root credentials and wiped out 7,000 instances or a number of instances, their whole environment, including their backups and snapshots. 13:51 Everything. Out of business overnight. Okay, this is like, when you're in the cloud, this is like the target, right, of, you know, the target story of Amazon, right? You know, I don't believe in FUD, but, you know, we need to learn our lessons, right? So, this is, you know, a really good example of that. And so, this is from archive.org. If anybody knows that, you can just hop on there and see their website. So what are our lessons learned? Least privilege and access control. 14:22 So if you're giving access to something, give the minimal amount of privilege. Take the extra step to give the minimum amount of privilege required. Configuration management, do some training, have some awareness. The cloud is a big responsibility. With the click of a finger, you have the ability to launch infinite amount of resources globally. So that's not cheap either, right? So a lot of times companies end up having, when they're attacked, they have thousands and thousands of dollars of bills. 15:02 Amazon does sometimes wipe it, but still, you don't want to be in that position. Also, some other things going on right now, Kubernetes and containerization. So especially in the Bay Area, that's the big thing right now. So definitely take the step to learn that. It's really a good thing to learn. It's a trend. But also look at serverless, too. Forget servers. You don't even need servers anymore. 15:32 You just have a function. So you create your code and have it run using compute time. And all you're paying is for the compute time and not for an instance to be up for several hours at a time, if that makes sense. Yeah, all of them, Alfred. Yeah, yeah, yeah. Azure, all of them have that service. So you can have an example of a serverless website. There are a lot of examples. So instead of spinning up a server in Nginx and then PHP and whatever else, you just write your code and it will execute. 16:03 Every time someone goes to the website, it will just run it for that time that it got executed. It's really amazing. All right, the next topic that's near and dear to me is diversity. Yes. I can't give an accurate number, but there are whole conferences now on the topic, serverless conf. So for some reason, a lot of folks are attracted to containerization, but really, I think a lot of the visionary folks are going is serverless. 16:40 Because serverless, you're just paying for compute time. It just makes it super easy. So as far as the percentage, I don't know, especially those in production. But it's definitely being utilized for a lot of components of a whole application, where what you used to have in EC2 or a whole instance, virtual instance of doing something, now they just have Lambda scripts and serverless functions doing that. So that is definitely becoming a huge, bigger component. Any questions so far on cloud and cloud security? I'm happy to take any questions.

Coding. Yeah. Yeah. Coding and then knowing that particular environment. But yeah, coding. So Python Go, all the latest coding languages.

OK. OK. Maybe I could. There is a way to have questions. OK. That's fine. Great. So the next topic is diversity. So diversity. There are a lot of programs happening these days to encourage more and more diversity. So we have Day of Security, which I've attended a lot of their talks. 18:13 Really great conference. Women in Security and Privacy. Women's Cybersecurity Jiu-Jitsu. SANS has a Women's Immersion Academy. One of my guests on the show, Christina Hansen, had a really good time. She talked about a lot of these programs and how she was a success story, basically, from a lot of these groups. There are a lot, and more and more groups are growing, so it's really... 18:44 It's definitely a good thing. Now, does that mean the job is done? Well, no, there's still a lot more work to be done. This is something that happened not too long ago that really kind of hit home for me. I was kind of like, I was bothered. I was bothered when I saw this. This whole underground that was happening that was, well, you know, look it up, but basically just bashing, bashing people, women out there. 19:17 You know, there's still issues that are happening. Female speakers and hackers are still facing issues. Georgia weidman you know really well known awesome person she's published books on hacking came out and just talked about some things that you know that she faced another person you know talk you know these are quotes from other people so what i'm saying is there is still work to be done in this area and it's really important that we just have awareness because frankly 19:51 Part of it is just awareness. A lot of people don't know the gravity of what people have had to face before out there. And diversity includes all sorts of people. People of color, non-binaries, women, everyone. Anyone that's in a disenfranchised situation. This was from someone I met recently, actually. She sent me this quote. I mean, this was something she said after meeting me and giving me her story. 20:28 So she said, as a woman Getting Into Infosec, I feel as though I have been alone my entire life, learning and self-teaching with no real guidance or mentorship. So that also really touched me. I just got this last night. So that was really interesting. So that's something I just wanted to share with everyone about diversity, kind of just bringing awareness. Now I'm going to talk about Getting Into Infosec. And this past, I just finished my 20th episode. It's been really an eye-opening experience where 21:01 Meeting all these people and getting to understand their backgrounds, I'm learning a lot from everyone I've met. I'm getting to learn, I'm getting to understand how, you know, how different backgrounds. So I'm meeting journalists, librarians, social scientists, programmers, IT admins, and they've all transitioned to the jobs like security analysts, security engineers, security architects, compliance, CISOs, all over. It's just been amazing. And I think we really take for granted Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.

That's right. That's right. It's a huge assumption. I just heard it today. Oh, I was interested in computers. It's nice, but I'm not good at math. I'm not good at math either. So you have to find, first of all, it's good to know yourself. I think in anything, not even security, anything, you need to know more about yourself. So again, what are your strengths? A lot of times, we're really focused on strengthening our weaknesses when we really should be strengthening our strengths. 22:38 We're wasting a lot of time strengthening our weaknesses. But we need to know what our strengths are.

That's right, that's right. So the question was, or the comment was that a lot of people feel that if you don't do good on the quiz, then you're not suited for the job. And if you fail this particular thing, well, you know what? The responsibility is also on hiring managers and hiring folks out there, okay? They have to be able to detect and see if this person is a good fit for their team or can, I'm sorry, can do the job, okay? A lot of times we have, a lot of times, we have folks that, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 23:44 On he had brought someone into his organization and there was a lot of naysaying about bringing this person in but she did an amazing job she was very successful in moving forward to the security line a lot of people were criticizing him for hiring or bringing her in internally he's he's on you know he mentioned this on the show and You know she was a success story so he was able to pinpoint another person I saw a day of security identified someone that excuse me that didn't think they could do the job but knew that person could do the job and brought them in and they were just a gem a gem so a lot of things that you know what's everyone facing a lot everyone's facing lack of experience they have this catch-22 issue where 24:35 I can't get a job because I need security experience, but I can't get security experience because I don't have a job. So the fact of the matter is you kind of have to be creative, be curious, and entrepreneurial in the whole thing to try to solve this Catch-22 problem. I added a couple new slides because I really want to focus on creativity. I really think creativity is at the crux of a lot of this. A lot of my guests I found are, you know, 25:05 Coders, app creators, musicians, artists, bakers, writers. If you're a coder, if you're creating an application, that is a creative talent. You're producing something. You have this satisfaction. The dopamine comes in. When you produce something, you make it work. It's really amazing. So there is this creativity bone in a lot of security professionals that is underestimated. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 25:58 So to be more creative, we need to try something new, get off the path of least resistance, and push boundaries.

Set it for yourself. That's right. That's right. And not be afraid to fail. Okay? There's this excellent documentary called The Creative Brain. It's on Netflix. I highly recommend it. It'll inspire you. If you ever feel bummed out, watch it. It's really eye-opening. And definitely, this whole neuroscience is just an amazing area to be explored. There's a lot of exploration to be done there. So the creative brain, yes. So let's talk about trying something new. So a lot of people, how many here are career changers coming from a different background? 26:45 OK, can I get an example of what career? Let's start from the right, my right. Legal. Okay. One of my guests was a paralegal and then now she's an awesome malware researcher. Egyptology. Egyptology. That's awesome. Okay. That's a lot of research. That's a lot. Yeah.

Awesome. Awesome. And you? Wine-smelling okay very similar to coffee so that's that's pretty cool so everyone that just mentioned right now there's a there's a trait that can apply to information security believe it or not right paralegal like being able to sift through information and go through things skateboarder right just being able to like I'm sorry Independent music okay travel yeah so people person that is probably a people person that person right there so you know skateboarding that dopamine that you know that rush egyptology just you know cryptography goes right along there right so almost the same wine same thing so there's always some so everyone here or those that are switching are trying something new this person right here he 28:15 This person has excelled in physics, cooking, all these different things. He has patents. It's insane. I mean, you're just blown away. So this is the anti-specialist. Where he's always trying to get something new. But look at this, he says, part of that learning is that you have to be confused. So I'm often very frustrated and confused and think of myself as being really stupid because I'm not getting it. How many here have felt in that situation? 28:47 Right? Right? And so I see this and I'm like, wow, that's awesome. And I'm like, I'm not the only one. This is great. So just something to keep in mind. So what else, if we want to foster creativity, what else is there? Well, we have to get off the path of least resistance. I don't think I, oh yeah. So the brain only weighs three pounds, but uses 20% of our body's energy. Go figure okay and so it's always going to want to do the thing that's easiest the path of least resistance because it just it wants to save quote-unquote battery as the host david says 29:24 So, you know, it's always going to choose the most obvious answer. And, of course, how many people just after having a long day just want to go home and veg and just do nothing, right? And recharge, right? But is that a misnomer? I don't know. This is not going to be a motivational talk right now.

Yes, we do need self-care. I think self-care is important. That's often overlooked, as we talked earlier, in the tech industry and in many industries, right? Again, it's getting that motivation to do something different. And this is the host, David Eagleman.

Yeah, that's weird. I've never seen it before. OK. Okay, so next thing, don't be afraid to fail.

Well, you know, failure, it's easy to say, but you know, I mean, Until you experience it, you know, it's really, it's really hard. I mean, I myself had some really personal failures, you know, a couple years ago, and it took a while to get over. I'm not going to lie, right? 31:01 But there's the other side where perfection is a twin of procrastination, right? And that's me. I just like, you know, and, you know, keep editing the episode and keep adding more slides and it's never done. It's like, no, just stop. Just get it done.

And so if you really think about it, success comes out of failure. Okay, success comes out of failure. So allow yourself to fail. Don't be so hard on yourself. Okay, allow yourself to fail. It's okay. It's really fine. This is another quote. And if you believe it or not, this quote was A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 32:14 What did everybody have to do, right? They were all creative. They were all curious. And they had some grit and entrepreneurial spirit where they just kind of had to move on. If you think about it, all this is related. All this is tied to helping you get into infosec. Because in the information security field, I think that's about it. In the information security field, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 33:06 You say you're a security analyst, you're starting off, and you're looking at logs, and you're trying to figure out what is going on. You need to persist. One of my guests, Jared, not to give a spoiler, but because of persistence, he was able to find A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.

Well you know I think things are changing where you know we're a lot of we're focusing on computer science and security is kind of coming again you know A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 35:43 That's right. That's right. And I think that's, you know, one of my guests had a comment on aptitude where, you know, I was like, what do you think about aptitude? And people think that you have to have this aptitude, but there is this notion out there that aptitude can be cultivated and can be grown, right? So that is something to consider. You know, again, I think there's a two-part responsibility. So it's us to get out there and kind of like learn, you know, or get immerse ourselves and just get out of our seats and have that harness that creativity. 36:14 But also the industry is definitely to blame, you know.

Yeah. So in the book I talk about, you know, understand the culture. I think there's a really strong cultural component to information security. That, you know, I think is often missed. I talk about different positions that are out there because everyone wants to be a hacker. That's great. I think that's really good, but companies are not hiring only hackers. Okay. If you really talk to, in reality, I'm a big company. I outsource the hacking. I hire another company that brings in hackers. 36:53 I hire directly service security analysts, security architects, security engineers, so they can make myself secure. Builders. Okay? And I get it. There is that dopamine, but there is also the dopamine of building something awesome. Okay? I'll share something about me. I wanted to be a hacker break girl so long, and I spent a lot of time trying to do it. Finally got a job to do it. And I realized I'm not really, I'm more of a builder. I've been a builder my whole life. You know, even before it was security, it was Linux admin, Cisco security, network admin, all that stuff. 37:27 I love building things. Love it. I could do it all day. And so I had to come and realize that was a failure, right? But I learned from that. I learned from that. I got exposed to a really good environment. It was a nice, awesome team. And I took that and incorporated it back into the building, right? But I learned, you know, I could have spent a long time trying to, you know, make it work. But like, again, fail fast and fail often, right? So kind of learning from your fail. And then also my story is in the book too. So it's kind of like, you know, and some funny stories. 37:59 I made up a story. You know, I kind of took some fictional creativity there and, put some things in there, you know, and it's always, it's always updated. So, the cool thing is, it's on Kindle. If you, it's always updated. And then when you order it, it's really weird, but like, Amazon prints it dynamically. So it's like every copy is printed like for you. So if I update it tomorrow, you'll get that copy anyway. Yeah, yeah.

That's right, that's right. So the comment was, for everyone online and whatever, the comment was that a lot of people are taking courses, several courses in fact, but not dipping their feet or their hands into security and kind of getting that hands-on experience getting out. So I think that's super important. That's super important to kind of just get off and go ahead and do it. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 40:22 A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. My brother tells it to me sometimes. Just get up and do it. Start small. You don't have to build an awesome lab and spend tons of money.

You know, if you can afford it, buy a router that will let you see all the packets and see, you know, Untangle. I have an example. There's Untangle. It'll let you make an $80 router into a $400 router, right? You know, with minimal cost. You use PFSense. There's a lot of different open source stuff that you can do to... Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, 41:33 That's true. That's true. I do have someone did mention that they live with roommates. And so, you know, they can't be like sniffing. I'm like, okay, well, then just like, break off of the router, create your own router. And then just, you know, sniff that traffic, right? Or just stick with that. I don't know.

So they're burning even when they do that yes make mistakes like just get in it you know one thing to do is go on youtube and check out some how to like walk through videos i think engineer man has some amazing videos of he just writes python and like he wrote one python script to combat a spammer or something like that It was hilarious. And you just hit pause and just dedicate some time. Build a habit. I think inertia, if we think about our physics, inertia is the hardest part. 42:28 But once we're moving, we're in motion. So it's easier to keep it up. So just getting that first step. You know, listen to the podcast. I think that's why I created the podcast is to help inspire you. I think one person, you know, I think we have to kind of take some accountability ourselves too, where I think one of my guests was talking about how someone came to them for mentorship and was like, Hey, listen, I just have an hour. 43:00 Can you just tell me what, you know, you're coming to this person who is an expert in their field and you want them to, you know, Share this time with you and you're putting them on so again a little bit of respect a little bit of you know humbleness and kind of just but just start yeah I think that I hope that answers your question you know this whole ecosystem that I've created here is to help to help do that so to help inspire folks actually you can have a triple gateway with Comcast you can you're a partner as well and you can set up a childhood castle you can log into Xfinity through the wi-fi 43:45 There you go. Or get a second IP. I think Comcast might let you have a second IP. Any other comments or questions from online or here? These are great.

Who here is graduating like really soon and actively looking for work now? Oh, okay, okay. And how has that experience been?

Mostly referrals, a lot of Twitter postings, people responding, doing a lot of job interviews right now. Okay.

Okay, okay. And yourself?

Yeah, I mean, I think one thing also to do is document your learnings. I think creating a blog or creating a GitHub account and participating, you know, again, a lot of my, some of my guests talked about this. Create a GitHub account and find the project that you might be interested in and contribute to that. Say there's a bug or an issue, they listen, people need help. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 45:45 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. But also the employers will see this, that you've taken some initiative, they know what you know more, like kind of helps build a bigger picture. Yeah, I think Steve had a question.

Yep, yep.

Yep.

Yeah, the comment was that there are a lot of folks that are very well prepared to be employed, but they themselves don't think so. And this is super common. It's called imposter syndrome. Imposter syndrome, it's a huge thing. Everyone faces it. I face it. A lot of people out there face it. Sometimes it's compounded by social media. 47:24 Oftentimes it's compounded by social media because you're seeing all these people, but you're only seeing one side of them. And I think, again, it's about the first step is to admit that we have something. And so if we understand that imposter syndrome is real, I mean, there's even a Twitter account called imposter syndrome, imposter syndrome cat or something like that. So, you know, more and more people are talking about it now. And so it's out there. And so I think that self-care, that social, the psychology component is also very important in the job hiring process. 47:58 Do you know that women, for example, or men, So, when they see job posting, they only feel like they need to meet 60% of the job posting to apply. But women feel like they must meet 100% of it before they actually apply. And so, there's this bias. Again, the industry, some people put everything in the kitchen sink in the job description. They're looking for this, and they want the person to do this, and they put this. 48:30 It's just insane. I used to talk about it in the book. I'm like, here are some examples of bad job descriptions, and here are some good ones.

Again, it's a problem. I think there's two components. The industry can do better about identifying people that can do the job. Okay, but also we even institutions like this, like this one, need to maybe have training for folks about imposter syndrome. And that psychology component, that's really super important. And I mean, it's nerve wracking. I gotta tell you, I mean, you know, you know, trying to switch a career, you know, by itself is a nerve wracking and then trying to go into like one that especially in the Bay Area. 49:13 You know, it's not easy. I don't know, it is not easy, but with more information, with more knowledge, we can do a better job.

Well, a couple of my guests have actually former Marines and Navy veterans. And so they had some interesting experiences. I would check out a bonus episode by infosec John. After you listen to the whole thing, he talks about how he almost got crushed in a two or three story cylinder in a Navy ship because they turned on the engine while he was in the cylinder. So we're thankful that he's with us today.

Red team, blue team, where did it come from, right? You know, the whole terminology.

No, they're actually absolutely one nerds. Yeah. Yeah. They're absolutely in demand.

So any other questions, comments? All right guys, thank you so much. Thank you.