← All talks

Ayman Elsawah - Why We Break Things... The Neuroscience of Hackers!

2020-05-01 · Talk · BSides Knoxville · 49m · YouTube ↗

Careers

Ayman explains that hackers often possess three key traits: entrepreneurship, grit, and creativity, and explores the neuroscience behind these qualities. He discusses how the brain's angular cingulate cortex helps regulate emotions during failure, enabling perseverance, and how divergent thinking and latent inhibition contribute to creative problem-solving. Ayman also highlights the importance of fostering creativity through learning new subjects, observing others, and embracing unconventional thinking.

Transcript

Audience0:01

Yes, and it's right at 1pm. So I will let you get started here. We have with us Ayman Elsawah. Did I say that right? Yeah, yeah. And the reason I can do that is Ayman has a podcast called Getting Into Infosec. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 0:36 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.

Ayman0:54

Coming to this, I'm really excited to be here. I'm really grateful to the organizers for inviting me. I am going to talk about why we break things as hackers, right? The neuroscience of hackers. So let's get right into it. So a little about me, I run Cloud Security Labs. And what I do is I help startups and CTOs and founders with their security and kind of getting their security act in order. 1:26 But I'm also really into coffee, sorry. I'm really passionate about coffee as well. You might have seen this. So I'm happy to talk about coffee, single origin coffee, also stuff. This is my actual set at home and I've started putting it up here in my office. So I'm really passionate about coffee. But I also run a podcast called Getting Into Infosec. And what I do there is I ask people how they got into the field so that we and others can learn 1:56 And be inspired of all the different paths that they got into the field so that we could learn and be inspired and take that home with us i also wrote a book so it's kind of like my own guide if we sat down for coffee and what i would recommend a step-by-step approach because there's so much stuff out there so you know this is kind of like a methodical approach to you know going from zero to hero And I'm really into sci-fi. I am a bit of a nerd that I found out recently. 2:26 I enjoy gardening, family, and on Fridays, I like to wear Hawaiian shirts. So as you can see, it is Friday and I am wearing a Hawaiian shirt. So why neuropsychology? Well, you know, for quite some time, I've been, you know, studying psychology ever since high school. And at one point I was gifted these two books. And, you know, these books were kind of really Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 2:57 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. And so, you know, ever since then, and as of lately, my hobbies have been like emotional intelligence, education psychology, which is a, I didn't even know existed, and cognitive neuroscience. So these are just some hobbies. 3:28 And again, as a nerd, you know, you might also relate to this as well. You know, when you find something, you kind of just like keep going and keep going down. And thanks to my bro for gifting me these books a long time ago. Thanks a lot, buddy. So enough about me, this is about you, right? So what do we know about hackers, right? Well, we know that we like to break things, okay? We also like to build things as well. And we are really curious, but we do definitely like to question things as well, right? 4:05 So I think that describes hackers for the most part, wouldn't you say? Well, but You know, is it all we know about hackers, right? But, you know, why are we like this? You know, why are we like this? This is something that was kind of getting to me as I was, you know, going on my journey. And so, you know, are we like this because we are exposed to tech early on? Or maybe we had a privileged upbringing. Or maybe we were exposed to science and math early on, right? 4:37 Yeah, no. That's not why we're like this, right? I am going to present to you after talking with a lot of my guests and editing them. You know, when you're editing an interview, A lot of information but when you're editing it and you hear the little things it's like having that conversation a deeper conversation with that person but so in my travels and talking to folks and hallways and things like that i've come to learn a lot and i'm going to share some of this with you and so what i've come to find are that hackers 5:20 Have these three major qualities and that's the entrepreneurial spirit okay grit and creativity and i've come to find this and i'm pretty satisfied with this and i've talked about this before and a lot of people can agree on this but i was not just satisfied with this i kind of wanted to go deep And, you know, if you're like me, when you find something, you just kind of keep scratching and keep scratching and you just keep wanting to go down. 5:51 So I went deep and I kind of got lost along the way. I found one research paper and that paper led to another paper and then there was another and And it just kept on going. And I'm like, what is going on? And I'm like, what is going on here? Like, I was just totally amazed. So I had to stop. I went and got some coffee, took a break. But then I ended up finding more papers and more papers and more terminology. And I was like, what is going on? So it was quite profound for me. 6:21 I had a really good time. But and so now I'm going to share some of this stuff with you. And so it's neuroscience time. This is your brain, okay? It is about an average about three pounds, and it has about 86 billion neurons. And, you know, it's divided into these different parts, as you can see here, right? So, sure, but then we all know that, oh, sorry, wrong button. 6:51 We all know that the brain is divided into the left and right brain, right? So we have the creativity side that's on the right and the analytical side on the left. I think everybody, that's what everybody thinks, right? Well, I'm here to tell you that's wrong. That is completely wrong. Thank you for watching. 7:36 Brain networks and here's a sample of a bunch of networks that are here and so this is what we're learning and the field of neuroscience is going through renaissance actually with all the digital imaging that's available now we're learning a lot more about this piece of engineering than we've ever learned before so there's still a lot to be learned there's still a lot we don't know these are all a lot of these are hypotheses and theories about how this stuff works but it's very exciting 8:07 And what's really interesting is I found a lot of terms that were similar from neuroscience and networking. And I'm going to share this with you right now. So for example, the brain networks we just talked about, I literally found this image and these two images and they look almost exactly the same. So that's quite interesting. But there's also something called the default network. And the default network is the network in your brain that is at a resting state. So That's the part of the network or your resting state where you're not really doing major tasks. 8:41 And of course, we all know about the default route. But then there's also something called the global efficiency factor. So it's the number of nodes or paths that have to be taken in your brain. And I literally did a cut and paste from here and just changed pair of network, pair of brain regions to pair of network nodes. And I found this quite profound. And there's some other terms along the way that I found really similar, but I just wanted to share that with you. 9:11 And so let's talk about the first subject, entrepreneurship. So what do you think when you hear about entrepreneurship? Do you think about these people, for example? Well, entrepreneurs are not only these people, but they're also these people as well. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 9:56 A when you're trying to think about being a hacker or when you are when you think of yourself as a hacker but what really makes yourself what makes an entrepreneur tick so let's get into it so there's a part of the brain called the angular cingulate cortex and what's really interesting here is that in entrepreneurship what you're looking to do is to explore to do different things but then you're going to hit failure And the idea is that you will learn from that failure. 10:29 So some entrepreneurs are the successful ones. We hear about their successes, but we don't hear about their failures. And there's a lot of failures out there. And that's where the true learning is done. And so if you decide to stop, When you hit a failure then you might not activate this part but when you when your emotions are regulated and you decide to persevere and keep going and learning you take that feedback and it kind of activates the angular cingulate cortex there's a lot i could say here again there was so much information but i tried to dice it down into some really good nuggets for you so the idea is to learn from a negative experience 11:07 And this angular singular cortex is regulating emotion so that it doesn't overwhelm you from that failure. That failure doesn't overwhelm you, but you actually learn from it and then kind of creates a feedback loop. And what's interesting is the ACC, the singular cortex, comes up a lot. So you'll see it coming up more. And so another thing about entrepreneurship, the traits, I guess, in the brain that happen, there's the exploratory and the exploitative behaviors. So there's exploratory where you're going out and trying to find new experiences, new stuff, experimenting, trial and error, discovery, search, and novelty. 11:45 And then there's the other portion where it's exploitative. You're taking that information that you've gathered and now exploiting it and producing and optimizing and being efficient. And again, I feel like I was reading a... Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, A hacker handbook when I was reading some of these papers. But the idea is shifting between these two states is what is really creating that entrepreneurial or hacker spirit, or at least one portion of it. So I found this quite interesting. 12:16 And so when these parts of the brain are activated, this is how your brain looks like in a functional MRI study, where you have explorative and exploitative Shift so you're going back and forth so this is these are the brain networks that we talked about earlier that are being activated so the next item is grit what is grit exactly well 12:46 Is grit this might be what you think about grit it could be i did find this tennessee grit so i found that really interesting i did actually google tennessee grit and i found this so homage to besides knoxville for this so but no grit is this grit is a it's about perseverance and passion okay it is generally a positive trait But it is possible to have too much grit and then that can become a negative trait as well. 13:22 And so that's something to consider as well. But in general, it is about perseverance, passion. It's about finding something and moving on. So a really good someone who talks at length about grit in all over. Is Angela Duckworth. And I definitely recommend checking out her talks and her book. And she talks about a couple ways to develop great and what I found interesting were these two items as well, where you develop a fascination 14:01 And then, but you also have a greater purpose. So, you know, a lot of us, we have developed this fascination for security. And we do have a somewhat, you know, greater, but we feel like we're doing something beneficial in some ways or some fashion. Maybe not all the times, but there is something to that. In any case, everybody has their own purpose. And there is also the growth mindset. I don't want to forget about talking about that, but the growth mindset is also something really important. 14:33 I have found that personally to be very important when I talk to other people and I recommend the book by Carol Dweck on mindset. The idea with growth mindset, if you don't know, is you have the fixed mindset and the growth mindset. And the fixed mindset is not accepting the ability to have different outcomes, different scenarios. Growth mindset is allowing for Those different things to happen there might be one way to solve a problem there might be another way like when you say oh i am this so that you know that'll never happen you're really putting yourself in a fixed mindset and that's something to generally avoid so for example you know staying on the mindset of rotating your passwords every 90 days for example that could be putting you in the fixed mindset 15:25 And so you know one question for everyone in infosec really is you know did you choose infosec after finding a fascination right there's a lot of people that may have listened to darknet diaries for example or be inspired by a show they saw a long time ago when they were a kid or whatever it may be and kind of had this fascination i know there is And then, you know, did you have a greater purpose in infosec as well? So these are, you know, some things to consider and just ask yourself, you know, is it, is this something that, you know, I can relate to as far as grit and then, you know, dig deep into, into grit. 16:06 And so grit in the brain Again, we have the angular singular cortex as well. And so grit and growth mindset both activate these regions of the brain. And so I found this pretty interesting as well. And so I wanted to share that with you. And here is a little bit of some brain porn. I just love looking at brains and you can see different areas of the brain that are being activated. And now to my favorite part of this talk and that's creativity. 16:40 Creativity seems to be a bottomless pit and I found it quite interesting and so let's go into it. So what is creativity or what is it not? Well, creativity is not left brain or right brain and it's not limited to the fine arts and it's not just an introverted or extroverted thing. But what creativity really is, it's everywhere. It's in the science, arts, math, technical, non-technical, anywhere. It's part of the human condition. It's a little complicated and messy. 17:11 Okay. And you know, you can be both introverted and extroverted. There's no one, you know, there's no limitation here. And so one thing I did find was something called 10 habits of highly creative people. And this was a really interesting article. And looking at this, I was blown away. This is almost everything what a hacker is. And so it might as well have been called the 10 habits of highly effective hackers. Where you have imaginative play, or you daydream, or maybe you're in solitude, right? 17:45 A lot of hackers like their solitude, having a balance at least, or having some sort of intuition, like where Syntax was able to figure out that a networking problem, for example, was not a networking problem, but it was actually an attack that was happening. So having that theory of mind, and there's something called... And the components of theory of mind or this intuition, it's called exteroception, proprioception, and interoception. So proprioception, for example, is where it's more physical. 18:20 But like in interoception, it's being able to understand someone else's beliefs, for example. So having that like intuition. And so our openness to experiences. Mindfulness, maybe not. You know, I think a lot of hackers might not be too mindful. I think we're getting there. But I think we're improving on the mindfulness factor. So that's good. Sensitivity, Tanya Janka talks about how she's sensitive and can understand and very empathetic. 18:53 And there's a lot, I've been finding a lot of sensitive folks out there. So, or being able to go through logs and see the different nuances and being sensitive to that. And, you know, turning adversity to advantage. I mean, give me a break. That's like everybody, right? And as well as thinking differently. So I found this quite profound. But what really makes a creative person or a hacker, right? Are we born creative? Are we are and why are kids more creative than adults so what i found is being creative is about unlearning traditional linear thinking okay and again you could say that for a hacker as well where it's more about going multi-path and not really like step by step it's not necessarily a equals b equals c or you know first a then b then c but it could be a c f and then back to b 19:48 So it's different paths. There's not one answer for something. There's multiple solutions for something. And so a lot of times we stand in the way of creativity as a society, right? There's been a lot of discussions about like kids and kids naturally have creativity, for example, and we actually stifle their creativity. So it's something to take into consideration where also I found that a lot of Hackers had this creativity this hacker instinct in them but it was stifled at some point one or the other you know could be due to necessity or whatever but then was reignited at some point later in their life and so I'm finding a lot of similarities between the two 20:40 So the next item is latent inhibition, right? And so what do we think about when we think about inhibition? Well, for most of us, we think about this, inhibition, where we're trying to be super free. But no, this is not inhibition. This is what latent inhibition really is. Latent inhibition is the reduced filtering of noise. Okay. So, you might've heard of hyperactivity or inattention or distractedness or disorganization. 21:15 The latent inhibition or ADHD or disorganized, creative, imaginative, forgetful inhibition. Is the ability to filter noise so latent inhibition is the inability or the reduced ability to filter noise and what's really interesting is that ability has been highly associated with creative achievement And so it's been shown to have irregular levels of dopamine as well. 21:47 So if you have ADHD or you think you have ADHD or people call you scattered or you're disorganized or mind-wandering, take these things as assets to yourself, to your creative, to your hacker profile, right? So these are things that we can make them into strengths instead of... Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 22:21 In fact, there's a whole paper by Dr. Carson written on just this. And if you look at Vincent van Gogh, for example, Vincent van Gogh, highly creative person, cut off his ear. We don't know exactly why he cut off his ear, but that is something to take into consideration. So there have been correlations shown with bipolar disorder and schizophrenia spectrum disorder, or otherwise called SSD. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 22:59 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. But the thing is here is that the shift in mental states that you use for creativity is also associated with mental illness. 23:34 So what's interesting is that it's kind of like... Interdependent together where you rely on some of these vulnerability factors for your creativity and then your you know creativity comes from the vulnerability it's kind of a complex thing i'm still trying to wrap my head around but you know the idea is that they're very strongly related so something worth mentioning and many of you out there may know someone who's highly creative but may have exhibited some of these other factors as well 24:13 So, one thing I do want to talk about is, so another component of creativity is divergent thinking. This, when I read this, I thought, wow, this is exactly what we are. We're non-conformist, we're independent thinkers. We have a lower level of agreeableness and a higher level of conscientiousness. And what does that mean? Well, when I say lower level of agreement, for example, like we're going to tend to disagree or we're going to tend to question things. I don't mean being disagreeable, although that could happen as well as part of this. 24:48 But the idea is to be is that this divergent thinking is very prevalent among hackers. OK, and I this book is a wonderful book talking about creativity. Again, you can use it on in your just Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 25:30 And so she realized that she was divergent from everyone else. And, you know, although she loved the passion of teaching and giving back, she decided to take advantage and do something else with this divergent thinking. And she's now a really successful security engineer. And so, you know, that's something to take into consideration. And here's a really good graphic that I saw about divergent thinking and all the different paths and how it's really related to creativity. 26:01 So it's something to consider. It's something that's a part of us, right? And it's something that's good. It drives other people crazy sometimes, but that's part of us, right? That's our gift. But is that it? So do we just think differently and call it a day? Do I just buy an Apple MacBook and say that I think differently and I'm done? Well, not quite. There's two other components called plasticity and convergence. 26:36 And what happens here is, oh, so let me, so plasticity is the ability for your brain to kind of like change and take advantage of new things. And convergences is, is actually, so I'll, I'll walk you through it. So basically what happens is you have divergence, you have this divergent thinking, and it's kind of like the idea ideation and generation. And then it goes through some plasticity, but then to actually get it to like formation, you need to have convergence. 27:07 So in actual convergence is kind of like the executing and like kind of getting it, getting your idea to actually become something. So it's really interesting that these three components are all part of the creative generation process. And here's like a kind of technical breakdown where you have the generation phase, Of the creative process, right? We have pasticity and divergence. And then we have the selection phase of the creative process where it's convergence, where it's actually coming out something. 27:39 So the same thing as in a hacker, for example. From a neuroscience perspective, these are, this is a picture of neurons here. So actually divergence is a one to many neuron kind of connection. And convergence is a many to one neuron connection. And this on the right, I found a really interesting where You have creativity as the culmination of all these three experiences. And then if you remember the networks we talked about before, you know, creativity is activating some of the three main networks that are activated with creativity are the default mode network, the salience network, and the central executive network. 28:25 And it's like going back and forth between these items. And then you have the angular singular cortex again activating here. So there's a lot going on here. But I did want to circle back with the networks and kind of identify which networks are actually activated here. And here is a little bit of some more brain porn. I just ended up loving looking at these pictures and wanted to share that with you. This is a highly creative network on the left here and a quote unquote low creative network on the right. 28:59 Again, neuroscience is ever changing. This could be wrong in five years. I don't know. But that's something I want to share with you. And this was a really cool high resolution image of all the different areas. So it's really remarkable all the different areas that are mapped in the brain. Cool. So fostering creativity, or in other words, fostering hackers. 29:32 Waiting for it to update. It seems like there's a lag in the update. So, or in other words, fostering hackers. So how do we do this? How do we do this? Well, some of the things we can do are learn unfamiliar subjects. Well, that's what security is about, right? We're always having to learn something new. We're always having to keep up on things. Try new things. Well, yeah, like CTFs and just building and keep going. Divergent thinking, I think that's pretty self-explanatory. 30:04 That's part of us. Watching someone else creating. Literally, this was a recommendation on how to be more creative is watching someone else be creative. Well, the same thing with hackers, right? How many YouTube videos are there of people just hacking and just activating things in our brain whether we know it or not? And even watching sci-fi and fantasy films as well. So, you know, it's a part of our nature. It's going to make us more creative. 30:36 And so where is creativity found? Well, you know, traditionally it was always found, you know, in the fine arts domain, but like I said before, it can be found anywhere. Take, for example, the science and math domain, right? And this is a really good example of John Nash, where he was diagnosed or has schizophrenia disorder and was a remarkable mathematician that won a Nobel Prize. And someone asked him, why did you believe that aliens came from outer space? 31:07 If you haven't seen this movie, I definitely recommend watching it. He goes, because ideas I had about supernatural beings Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria But again, like I said, creativity can be found anywhere. So whether you're a teacher, whether you're a mechanic, if you're a human, creativity is with you. 31:42 It's up to you to nurture it and bring it out. But back to the science and math, what if you're both, right? What if you're both like a super mathematician, like Tanya, for example, is highly concentrated in mathematics, but she also has an album on Spotify. Or Leron Gray, where he's a pentester, but also a Nerdcore rapper as well. Or maybe Robin Stewart, where she's a threat malware researcher, but she's also a novelist as well. 32:15 And many, many, many more. There are so many examples I see out there of people being creative in all different domains, and it's a really remarkable part of the human condition. I think I hear some. So putting it all together, what are we going to do with all this information? Oh, sorry, wrong window. 32:45 So putting it all together, what are we going to do with all this information? You're probably like this right now. And I probably threw a lot of things at you. And so you probably feel like this as well. And what I would say is let's have some coffee and take a second to step back and just listen and let all this soak in. And what I'm going to do is put it all together for you. So what we have is the IOCs. 33:18 Sorry, if someone is unmuted or can go on mute. So what we have here are the IOCs of entrepreneurship, grit, and creativity. We have this information and all this leads to becoming more creative or in other words, a hacker. They're all connected. All this is connected. And we need to unlearn some things, you know, and we need to continually unlearn things. 33:50 Okay. Because that's part of being a hacker. Is things are going to change so what may have been true before may not be true anymore and we know this but we know nobody we like it's it hasn't been put into words right and exercise often so all these different parts of your brain exercise and exercise them often and that will keep you getting becoming a better hacker But with all this information, what can we do with this? Well, if you're new, then look for these traits in yourself, okay? 34:23 And if you've been around for a while, then discover more about yourself. Just keep learning. You know, like I said, I learned recently that I was a nerd. I found some article by Rands Actually, it was an amazing article. And the article was written for someone else to learn about nerds, but I actually learned more about myself. And, you know, if you're affiliated with the hacker community, then use this information to understand this person that's in your life. So you might find it really profound and really interesting in understanding and creating good understandings. 34:58 And here is a YAR rule for an IOC for entrepreneurship. And I have other YAR rules for grit and creativity as well. So I do want to note that the field of neuroscience is vast and deep. These are all the different parts of neuroscience and are different fields that are available in neuroscience. So it's quite amazing. I think some of this touched upon like cognitive neuroscience and neuropsychology as well. 35:32 So I just want to give you that note. And with all this information, you know, I saw so much overlap. I decided to do something interesting. I created the creativity kill chain. And so this is a kill chain that basically shows everything I just presented right now but in a kill chain format and so it's something to keep aware of if you're looking or anything to kill any you know if you're if you're looking at anything to impede your creativity and then I decided to take it a step further and 36:08 I think because there's been some controversy about like having one kill chain. So I created the unified hacker brain kill chain. And so this is where you have creativity, entrepreneurship, and grit all combined together and all the different components that we talked about, divergent thinking, exploratory and exploitative, the angular singular cortex, perseverance, all these items coming together to form you, the hacker. 36:38 And so that is my thing to you. And so what's next? What's next? Well, if you have an FMR machine that you want to lend out to me, please do so. That would be awesome. I'd be happy. I'm going to keep going. Every day I keep finding new papers and reading them and they're just so fascinating. So, you know, the rabbit hole is pretty deep. I created a link if you want where I'm going to list some of the resources that I mentioned on here as well. 37:09 And that's about it. And so I really want to thank the organizers of B-Sides. And, you know, thank you for inviting me. And this has been exciting. Thank you. And I'd like to open it up for questions if there's any questions.

Audience37:38

Yeah, yeah, there's conversation going on.

Ayman37:42

Yeah, can you hear me? I can hear you, yes.

Audience37:49

Should I hop in the Discord? Yeah definitely yeah i mean my first ask is you know maybe one of the attendees will do it but i need a reading list i need a book list yeah from this talk and i'm probably going to watch this talk a few more times yeah it was a lot you know it was a lot to take in and it's i'm still you know there's still so much there's a lot of stuff i left out there's like 10 slides i had to hide

Ayman38:25

Because it was just getting too much. So yeah, yeah.

Audience38:33

I really appreciate this talk. This was something I always wanted to do because I started noticing stuff like this a while ago. Like in 2015, I gave a talk at B-Sides Las Vegas called Why Does infosec Play Bass? Because I'm a bass player and that's why I noticed the pattern, but I kept running into other folks in infosec that played bass. I'm like, why am I not running into guitarists or drummers? Like, why that instrument? You know, so I did some surveys and stuff like that and presented what I found, but it didn't go nearly deep enough to satisfy my curiosity. 39:08 And I think your talk finally did it for me. Like, I think you finally went deep enough for me to, you know, really scratch that itch. So I'm going to watch it a few more times.

Ayman39:20

Nice yeah you know i just i have this like habit of just going deep i mean even with coffee i want to know like the exact chemical process of the water and the interchange so yeah i was glad you know i think we're really lucky that all a lot of this information is available online you know but definitely looking to take this research further so you know at the at least in a post covet era

Audience39:50

Yeah, so speaking of that, we do have a few questions. And one of them asks about, you know, is COVID an opportunity? Or is it going to have an impact, you know, as we kind of shut down societies and businesses are having to adapt? Like, is this is that an opportunity? Is that going to result in any major changes along these sorts of lines?

Ayman40:12

I think it's gonna you know I think it's gonna allow people to do a little more introspection about themselves so you know what I'm noticing is like people are either stuck you know or like kind of like you know taking this as like a failure and getting stuck or they're either getting past it and making the best out of it and so it's kind of like you know when you're in a CTF right do you sit there and you know get you know just Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah

Audience41:02

Another question, did you take a look at any personality profiles, common ones like MBTI during your research to see if that had any correlation with hacker types or like DISC profiles and other personality systems?

Ayman41:16

I thought about that, but I didn't want to complicate the topic. So I wanted to stick to pure neuroscience, but that's definitely in mind as well, taking a look at the correlation of some of these personality profiles to some of the stuff I mentioned here.

Audience41:31

Yeah, Myers-Briggs, stuff like that is a real rabbit hole.

Ayman41:34

Yeah, yeah, seriously.

Audience41:36

Yeah, I think that would be an interesting one to hear more on because I know, you know, a lot of HR, a lot of hiring actively uses some of those, you know, so that directly impacts a lot of us.

Ayman41:49

Yeah and you know what I you know in the whole field in general I think that's something that we sometimes get stuck in where we think hey I am this and that's it and that's you know it's good to understand that about yourself but you have to allow room for differences right because psychology I mean listen you know in the 60s they used to do electric shock and think that was like Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 42:33 When you know especially HR is a good example like if they do a personality test and like put people in these different buckets that's not what we are right you have to be able to see past some of these things use the indicator use it as something but don't let any bias affect that's my two cents on that feel free to answer the coffee questions if you want yeah so Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah,

Audience43:24

Yeah so i think that's about it for the questions you know feel free to jump into the discord and chat with folks there's some good conversation going on there yeah i big thanks to Farida also last year's keynote speaker so we have a tradition here i probably everyone doesn't know but The previous year's keynote speaker picks next year's keynote speaker. So very rarely have we had anybody just say, yeah, here's your keynote speaker. 43:58 Typically what happens is they say, here's three options, or I think Farida gave me like five or six or something like that. So I still have to make a hard decision. Which is half of the reason that I do this is it's a really tough decision and I'm being selfish and offloading it. But also I figure and what I was hoping would come out of it and it has is we get keynote speakers coming from completely different place direction than I would pick or any of the organizers would pick. 44:28 We've had You know, I think only one of our keynote speakers in the six years now are people that I were aware of or actively aware of before they came to us. So it's very cool for me. It's, you know, opening up my network of people that I know And I'm seeing talks I would have never seen otherwise and learning stuff I never would have otherwise. So you've got some time, Ayman, but eventually I'm going to come to you and say, okay, 2021, what are my options here? 44:59 Who do you think we should have do the keynote?

Ayman45:03

That's awesome. That's awesome. Yeah, I really appreciate the opportunity. I think this has been a hard talk to get, you know, submitted and accepted. Because, you know, a lot of times, it's hard to like kind of quantify. So I took a chance. To talk about something that, you know, I didn't have until I've been, you know, studying it for a while, but like, yeah, definitely appreciate the opportunity. I'm glad you liked it. And I want to thank all my friends that helped me review the deck. 45:37 I did a couple dry runs. So yeah, yeah. Thanks, Dan, Matt, Kavya, and Frida for helping out. So shout out to them. And shout out to the whole board. So this is this has been really exciting.

Audience45:52

Yeah, yeah, for us too. It's definitely a worthy keynote. Yeah, and didn't really know what the topic was going to be until like a day or two ago. But yeah, it was really awesome stuff. And I'm definitely going to go back and watch it a few more times. And if you don't have time to worry about it, somebody here will create a book list out of the slides that you presented and we'll get like an Audible or an Amazon list shared somewhere. 46:22 Cool, cool, cool.

Ayman46:24

Well, I posted... I posted the slides on that link that I had there. And then I guess if this would be on YouTube, we could update the description with the details. So I just have to catch up on this lack of sleep. And then I'll, I'll, I'll post all the it's been a tough week, man.

Audience46:45

Yeah.

Ayman46:47

So yeah, this is awesome. You know, I think, Yeah, yeah, it's exciting. There's some good talks too. I want to encourage everybody to check out some of the talks. I'm going to be probably hanging out in a lot of the track two talks. There's a lot of AWS talks and stuff like that. So you have a good conference going on here. So this is really cool. Yeah, yeah.

Audience47:11

Speaking of the AWS talk, make sure you catch that because that's one of the ones that we can't record and we can't live stream. So you've got to watch it through the GoToWebinar.

Ayman47:23

Oh, good to know.

Audience47:26

Yeah, so we already had one talk earlier, you know, a bunch of people, I think we got some people at the last minute in there that couldn't get in there. And yeah, just to warn you, I think that one's at 4pm in track two, if I'm correct here. Let's see. Yeah, that's automating disk and memory evidence collection in AWS with Ryan Tick and Talk on information security covering CISO, vCISO, fractional CISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 47:59 Talk on information security covering CISO, vCISO, fractional CISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, fractional CISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Sounds cool. You're going to hang out, watch some talks, and we will get prepped for the next call here. We actually have a few minutes. We'll let people take a break, soak in five minutes of sunshine, grab a bite, whatever you need to do, and we will get ready for the next round of talks.

Ayman48:40

All right. Awesome. Thank you so much.

Audience48:42

Awesome. Thank you.

Ayman48:43

All right. Take care. Bye-bye.