Guest Post - Adam Maxwell - "Popping my cherry - B-Sides London 2012"

[Today our guest post is by Adam Maxwell (@catalyst256). He registered for his first security conference, BSides London, and then decided to take it one step further and signed up to be a volunteer. This is a great example of how to make the most of a conference experience. 

This post originally published on Adam's personal blog, The IT Geek Chronicles.]

On April the 25th 2012 a group of crack InfoSec professionals, enthusiasts, hobbyist and newbies (that's me by the way), descended on the Barbican Centre in London for the security event of the year (in my opinion).

That's right; B-Sides London 2012 had arrived.

Most of you probably already know what the B-Sides events are all about, so I won't bore you with going over that, If you don't then you go find the main website here; http://www.securitybsides.com or the B-Sides London website is here; http://www.securitybsides.org.uk/.

This was going to be my first B-Sides event and as I was reading the website to find out as much as possible before the event, there were two comments on the front page that really stood out for me.

The first was this "built by the community for the community", I'm still trying to find my way in InfoSec, but what makes it easier (and more fun) is the people that have the passion, drive, commitment and wiliness to share their knowledge with people like me. Without community events like B-Sides (and there is others) trying to navigate your way around the world of InfoSec would be a lot harder.

The second comment was "So make BSidesLondon whatever you want it to be", for me this was really important I didn't want to attend an event and be anonymous. I have a tendency in new environments to be a little bit shy and I wanted to make the most of the day, meet new people and try to become part of the community rather than a lurker in the corner.

So with less than a week to the event, I volunteered to help out on the day, yes that's right I was now on the crew roster for B-Sides London 2012. Due to work commitments I wasn't able to get to the Barbican early to help out with setting up, but I would just like to say at this point a HUGE thank you to Iggy (@geekchickuk) and the rest of the B-Sides London crew for getting everything ready for the day and in fact for all their work during the day.

Working as crew on the day for me was awesome; I met a lot of new people and had a lot of fun. What did I do on the day?, well if you bought raffle tickets between 10:00 - 12:00 from the table in the corner next to the guys from SANS that was me (sorry about making you write out your own tickets), and in the afternoon (from about 14:30) I was on the swag desk. I may or may not have also been involved in the nerf rocket war between the B-Sides crew and the guys from MWR InfoSecurity.

In the end I only attended one talk which was by Robin Wood on "Breaking in to Security" (check out the B-Sides London website because a lot of the talks were videoed and will be available to watch), but for the me day was still a success. Would I help out again next year? Hell yeah, if fact I've already told Iggy I will, but next year I'm going to do a talk on Track 3 (that's the turn up and talk about something track), I have no idea what about yet, but I've got a year to work that out.

See you all next year...

Adam

Root the Box - April 7th, 2012 - Chandler, AZ

Today I talked with Zachary Julian, a student at the University of Advancing Technology, about a competition called Root the Box in Chandler, AZ this weekend, April 7th. Root the Box is a computer hacking (CTF) game that requires skill, speed and team work. Each team must scan and exploit systems on the attack network. If a team successfully obtains remote code execution they can upload a reporting service, which awards them points over time.

Check it out at rootthebox.com or on their FB page. There is still time to register for this weekend's event. Root the Box is put on once a semester.

-Who are you?
My name is Zach Julian, and I’m currently attending the University
of Advancing Technology for my Bachelors in Network Security. I
am also on the Root the Box organizing committee, where I serve
as the security officer for the competition. I have loved
computers for many years, and consider myself fortunate to have
found a good community of hackers here in Phoenix, Arizona.

-What's it like as an infosec student at University of Advancing Technology?
It’s a unique experience- Network Security is undoubtedly the best
program UAT has to offer. We have a pretty tight-knit group of
people within our major, which includes a wide range of skill
levels and specialities. If you’re serious about learning
security, UAT is definitely the place to come. Coming to UAT,
I’ve found the class material to be challenging and useful, my
peers extremely bright, and the opportunities to network
constant. I’m always inspired to attain higher levels of
hacker-fu.

-How did you get involved with Root the Box?
So far, I have competed in two Root the Box competitions. After
that, I felt it would be a worthwhile experience to help the
competition in some way. Since my current job consists of
Intrusion Detection analysis, I volunteered to set up and
monitor a Snort box during the competition. This is to ensure
that the participants stay within scope during their attacks. ;)

-How long has Root the Box been happening?
This will be Root the Box number 8. During that time, we’ve improved
on everything from the hacking challenges to the scoring engine.
After several years, the competition has matured quite a bit.

-What skills do you hope students get out of participating?
Each Root the Box is an excellent opportunity to refine and expand
your skills a little bit more. Hacking is the same as any skill
- reading and thinking about it will give you some knowledge,
but there’s no replacement for actual experience. That is why we
so strongly encourage people interested in security, at all
levels, to participate in Root the Box.
Newcomers to hacking will benefit the most - Root the Box features
challenges that draw from all types of digital security, from
reverse engineering to web applications. If security or
penetration testing is your intended career path, Root the Box
will show you what to expect and where to focus your learning.

-How can people get involved?
Come compete! Anyone interested in volunteering for Root the Box will
be able to meet our staff and get a good idea of just what goes
into putting on this competition. More specifics are available
at http://rootthebox.com.

Thank you Zachary for filling us in on this very cool competition! Good luck this weekend!

Communicating the value of security

Whether your work has you speaking in front of the media or just championing your ideas internally, whether or not those ideas are heard has as much to do with how they are presented as what the ideas are. In Information Security, the most important task we do is communicating the value of security. For this to be successful, you need to ensure your personal brand has integrity, trustworthiness, and experience. These factors take entire careers to build, but there are also resources that can help.

One of those resources is SECore.info. This new website created by the Open Security Foundation brings verified security experts and reporters together, as well as a tool to help experts promote their ideas through presenting at security conferences.

I'll be speaking more about this topic of self-promotion during Security B-Sides PHX this weekend. Check out the B-Sides page for more information.

SECore is also providing a great opportunity to increase your communication skills on security topics by hosting a workshop during RSA in San Francisco this month. This one-on-one training is co-hosted by the technology PR firm LEWIS Pulse, and will help you with personalized training on how to effectively communicate about your work to the media and to your co-workers.

SECore Media Training for Security Professionals
Date: Wednesday, February 29
Time: 8:15am - 6:00pm (hour-long sessions)
Location: Marriott Marquis, 55 4th Street, San Francisco

Register at EventBrite.

InfoSecMentors @ BSides Byte Size

Just a quick note to tell our UK friends that the crew from BSides London is throwing a little meetup in Central London called BSides Byte Size! It's Saturday, January 7th, at a venue to-be-disclosed closer to the date. I'll be there as well, and I'll bring InfoSecMentors stickers to give out to anyone that attends!

From the BSides London website:

BSides Byte Size - The Acoustic Set Saturday 7th January 2012 Venue - TBC (A Pub in London) There are no invites, no sponsors, no projectors just you and beer. The Acoustic Set is a simple gathering of like minded people meeting, talking, listening, debating and drinking so come along and participate. So what makes this acoustic? Anyone speaking is not provided with any electronic assistance. If you want to talk you need to go low-tech. Who's speaking? We are going to have a few well known people come and speak but anyone can speak. Just turn up on the day. Tell people you're coming on Twitter by using #BSidesByteSize.

No tickets or RSVP is required, but please join us on the event's SECore.info profile and let everyone know that you're "interested" or "attending" and post comments.
So hopefully we'll see you there!

Happy Holidays!
-Marisa

InfoSecMentors @ BruCon 2011

Next week the InfoSecMentors team will be attending BruCon! We've been looking forward to this particular event all year because BruCon has been a valued supporter for the project. BruCon is a great conference not only because their slogan is "Hacking for Beer" but because they've captured that great balance between the black t-shirts and the suits. The trainings, presentations, and workshops are all very affordable (and a steal when you hear about the included after-party!) We're looking forward to learning a lot, meeting new friends, and drinking beer in amazing places.

This year, we're hosting a mentoring workshop on the second day. This workshop will tackle both sides of the mentoring relationship. For the mentees, we'll talk about ways to set yourself apart, how to efficiently do your homework, and what valuable benefits to expect from your mentorship. For the mentors, we'll go over different activity ideas, how to keep your mentee engaged, and the value mentors get out of the mentorship. After that, we'll put the question to the audience and try to define just what exactly counts as a successful mentoring relationship.

Our workshop panelists include David Rook (@securityninja), Chris Gates (@carnal0wnage), Wim Remes (@wimremes), and Marisa Fagan (@dewzi). We'll start at 19:30 Tuesday with a short presentation and open the floor for questions and experiences. Hope to see you there!

Exactly!

While The InfoSecMentors Project may be on a break until September, there are still plenty of conversations happening about mentoring! One blog post in particular has so correctly hit the nail on the head I wish I could copy and paste the whole thing! (But I won't. Remember kids, plagiarism is bad m'kay!)

This article comes from Ramit Sethi at iwillteachyoutoberich.com (not a security-related blog, but couldn't hurt to read it) called "Why Successful People Don't Want To Mentor You." His take is that these days so few people actually put in the work to be a good mentee that it has left a bad taste in everyone's mouth about being a mentor. So it's not entirely your fault that it is so hard to find a good mentor. Fortunately, those that really do want to put in the effort will be part of a very short list that gets catapulted to the top. Ramit explains exactly how to do just a few hours of work before you approach your ideal mentor to guarantee they will jump at the opportunity to work with you.

From the article:

• "Here is the 1-2-3 Choice Technique: “Hi Ramit, I love your book on blah blah. I noticed you said I should XYZ in chapter 5, and so I tried it. I’m stuck due to XYZ. So I’ve come up with 3 possible routes:
• blah blah1
• blah blah2
• blah blah3

Which do you think I should do?

This will get almost a 100% response rate, since you have actually done the work in your head…plus all I have to do is tell you which is best. GOOD JOB."

Brilliant!

I also thought the article had an interesting point about how as mentors we create these huge artificial barriers to intentionally make it difficult to contact us, perhaps without realizing it. Having your email address public may not be practical for other reasons, but at least consider making your LinkedIn profile public and be responsive there. And if you're a mentee, please be respectful of this direct access you have to the people in your industry. You may not realize it now but being "kooky," flakey, or lame is actually ruining it for the rest of us!

As part of the InfoSecMentors Project, I can vouch that everything in this article is true. The substantial majority of mentees are not doing the legwork, and so setting yourself apart is very doable (and totally worth it!) Look through past examples on this blog about the type of projects and jobs people get exposed to after they do the homework. Listen to the podcast at the end of Ramit's article for dozens more specific examples. Do this, and as Ramit said, "you will find people that LOVE helping other ambitious people who take action."

Good luck! (Not that you need it!)

Guest Post: Brandon Tansey "Practical Lessons"

Guest blogger Brandon Tansey is back this week to tell us about his experience as a mentee. He also has some suggestions for thing to do with your mentor, including setting up an at-home hacklab, and getting involved in the Security Community.

It's important to be clear that my last post isn't to say that practical lessons aren't great in a mentor/mentored relationship. My discussion with Marisa also included some thoughts I had on the practical aspects of working with a mentor. There were two main points I looked to get across: work with more than one mentee per mentor, and to focus on helping a mentee make the jump from methodology to practice. As I mentioned, my experience with Dan began when he started giving presentations at the group on campus. After each meeting he would come back to my apartment and work more closely with people who were interested. The setup we have is great! We're fortunate enough to have a Poweredge 2650 humming away in our apartment. We use it to virtualize all sorts of targets and services (ex: PFSense) and to practice taking down some machines. We used a mix of standard virtualized desktops/servers and some premade target distributions (Damn Vulnerable Linux, Damn Vulnerable Webapp, Metasploitable, etc) to bang on. Our setup makes having people over to practice easy, but having a big, loud server isn't the only way to safely practice on live targets. A desktop virtualization program like VirtualBox can be just as good! Boot up a VM with Metasploitable (or whatever you'd like to attack) and you've already got your own mini-hacklab! Some nights there were more people coming over than others, however there were two of us that made it week after week without fail. There was myself, and there was a junior networking major at Wentworth named Ian Abreu(@Ian_Abreu). Every week (and often in between) we'd meet up to work on something. Working as a trio was great; it allowed the dynamic to become less teacher/student like and more like a group of people working together. Everyone had something to bring to the group. I understand that not all mentors are able to devote the amount of time that Dan did. The trio is even better in these situations. Having multiple mentees in a group allows for dialogue even when the mentor is busy between talks. The mentees can help each other grow both their passion and technical ability. The other comment I had for Marisa was one that may have been more specific to my experiences, however I wouldn't be the least bit surprised to find that other students feel the same way. The comment I made was that it's incredibly handy for a mentor to help a mentee make the jump from methodology to practice. Before meeting Dan I had done quite a bit of reading. I think the most well-known book I read was Hacking Exposed. The book was an incredible way to learn principles. I feel that the main issue I face, however, isn't the principles. I personally had a hard time starting the jump from reading to doing. I felt that I could describe quite a few techniques and how they worked, but if you asked me how to actually do them I'd be stumped. Technology in general moves quickly, however InfoSec seems to move especially fast. It's because of this that a lot of the reading material out there is far outdated by the time people get to reading it. If I was to redo the last year's mentoring experiences, that is probably the one thing I'd change. I think it would've been incredibly handy to slowly step through a particular methodology and really learn how each step translates from theoretical to practical. There is one final tip that I feel is incredibly important to stress. Regardless of whether or not the pairing is local, getting mentees involved with the InfoSec community somehow is one of the best things you can do for them. Get them on twitter (or to start following the InfoSec crowd), get them on the mailing lists, if possible get them to local meetups and introduce them to people! The InfoSec community is a small one full of incredibly intelligent people. In my experience, many of these people are incredibly open (if not eager) to help people willing to take the time to learn. It is much easier to meet these people when you approach them with someone they already know! The best thing I personally got out of SOURCE was all of the incredible people I met, and I feel that was a direct result of volunteering for the conference which I did through the people I had already met at the local meetups! Overall, I'm incredibly glad I was able to find a mentor to work with. I'm not Dan, however I feel that Ian and I were able to give him something through working with him as well. I'd personally consider the InfoSecMentors Project a success for simply putting together a few mentors and mentees. Fortunately they're only limited by the amount of people that express interest! I really do advise you give it a try. You'll be incredibly glad you did regardless of which side of the relationship you sign up for!

You can find Brandon Tansey on his new blog at The Wormhole, on his Twitter feed, or on LinkedIn.

Guest Post: Brandon Tansey "SOURCE Boston & Mentors"

Today, our guest blogger is Brandon Tansey. He is a networking student and is active in the Boston Information Security community. Here is Brandon's post with his thoughts after attending SOURCE Boston.

I'm one of the folks that was lucky enough to make it out to SOURCE Boston this year, and I'm incredibly glad I did. There was a great selection of talks as well as hallway conversations, but there were a few sessions and conversations that stood out to me. The InfoSecMentors Panel and the following social were definitely among them. The panel was primarily geared towards the mentors, however I found it quite interesting to listen to as a mentee. I feel that working with a mentor shouldn't be a one way street; the mentor should definitely be getting something out the relationship as well! Sitting in on the panel definitely gave me some insights to how mentors (at least the ones on the panel) view working with a mentee and the concerns they had. The panelists often had some differing opinions, however for the most part I didn't hear anything too unexpected. There was one answer that they all shared which shocked me, however: unresponsive mentees. The panelists were three people who are highly regarded when it comes to what they do professionally. There was Chris Gates(@carnal0wnage, Pentester at Rapid7), Andy Ellis(@csoandy, CSO at Akamai), and Allison Miller (@selenakyle, formerly a fraud specialist at Paypal). I was incredibly surprised to hear that even these three were having trouble with mentees not putting in the time. I found this to be a good problem as far as problems go, however. The fact that the program has mentors interested in more active mentees is great! To backtrack for just a moment, my name is Brandon Tansey(@BrandonTansey) and I'm a sophomore Networking major at the Wentworth Institute of Technology in Boston. I'm enjoying my time at school and it has given me a desire to explore the InfoSec field beyond what the major offers. It's because of this that I began following quite a few of the SecurityFocus mailing lists early fall semester. I came across an email with the subject of "University Plan" on the PenTest list, and that was where my incredible mentor/mentee experience began. As I was reading the discussion I saw something familiar. One of the people giving advice happened to have been describing the time he spent at Wentworth! I decided to email this mysterious Dan Crowley (@dan_crowley) and ask him a few questions about the school and the security field. After all, who could be better to ask than someone who started exactly where I was and happened to be exactly where I wanted to go? I found out that the answer to that is no one. The first time we spoke, I got the impression that he was even more excited about the hacklab setup my roommate and I have than we were. Within a week Dan started speaking (and would continue to do so weekly) at a club I help run on campus for technology enthusiasts. We'd also head back to my apartment afterwards with a few other classmates who really had an interest in exploring security. Dan is, of course, incredibly talented when it comes to the technical side of things. What stood out to me, however, was the passion he had for both what he did and helping others learn what he knew. This passion is what immediately came to mind when Marisa Fagan(@dewzi) of the InfoSecMentors Project asked me if there was anything that I had from my work with Dan that I could share. Our discussion covered quite a few topics and some practical tips (which I'll get to in later), but I think the main point I was trying to make was how important that passion is. I was certainly excited about security by the time I came across Dan (It definitely takes some level of interest to read through all of those SecurityFocus threads!). The passion I have now is on an entirely different order of magnitude, however. I'm also miles ahead of where I was in a technical regard, however I undoubtedly feel the biggest gain I've had has been in my interest of the subject. Without that I never would have done everything I've done on my own. I never would have been able to read the billions (give or take a few) of pages of security texts. I feel it's like the old "give a man a fish" proverb. A mentor can suggest a few vulnerabilities to look for or tools to use and call it a day, or they can help nurture the desire of the mentee to explore for themselves and keep learning between mentoring sessions. One of these will do much more for a mentee when he/she parts ways with the mentor, and I feel that's a large part of what the relationship is about: putting the mentee in a better position to help him or herself grow.

You can find Brandon Tansey on his new blog at The Wormhole, on his Twitter feed, or on LinkedIn.

InfoSecMentors at SOURCE Boston

We've been looking forward to April in Boston ever since last year when SOURCE Boston hosted a wonderful mentoring workshop. This week, Wim, Jimmy, and I will be attending the conference and hosting a mentoring workshop of our own! On Wednesday evening, there will be an interactive panel where we invite security professionals interested in the process of mentoring to come and learn about tricks and activities they can do with their mentee. Our panel of experienced mentors will be available to answer any type of questions. We also hope to brainstorm with our audience for new ideas for mentorship activities, like Open Source projects, CCDC, public speaking, and more.

Afterwards, it's the InfoSecMentors Project One Year Anniversary! We're inviting everyone out for drinks/snacks and networking with the mentors and mentees of the project. Look for more information in your SOURCE Boston schedule brochure.

The InfoSecMentors Project is going to be very active this year! Be sure to follow us on Twitter, @infosecmentors, to get the latest on our plans for scholarships, publications, and the party at Brucon!

To hear us discuss all of this, and much more, (more than you could ever want!!) listen to my interview with the EuroTrash Security Podcast Episode 20.

-Marisa

My SOURCE Boston Walkthrough

Let me introduce myself real quick, I'm Jimmy Vo and I've been a mentee in the InfoSec Mentors program for about 10 months now. I'm a recent Computer Science graduate and working my first year professionally as a systems analyst. I'm looking forward to going to my SOURCE Boston since it will be my first conference. I just wanted to do a walk through of some of the talks and workshops I'll be attending. If you see me, please say Hello.

Every single talk and session I’ve seen for this years SOURCE looks amazing. There were a few talks that popped out on the schedule. Of course, I wish I could attend every talk.

Bringing Sexy Back: Defensive Measures That Actually Work
Paul Asadoorian, Founder & CEO, PaulDotCom Enterprises
April 20, 11:00am-11:50am

This talk focuses on implementing defensive measures that can mitigate and/or slow down attackers using many technologies. These technologies include honeypots, scripts, and traps. This talk goes beyond traditional defensive measure that do not work anymore. I’m looking forward to this talk because I’m a big fan of the PaulDotCom podcast and Paul and the rest of his crew are as entertaining as they are knowledgeable when it comes to information security.

In the land of the blind, the squinter rules
Wim Remes, Ernst & Young (@wimremes)
April 20, 2:30pm-3:20pm

This talk focuses on security visualization, which a topic that my Mentor and I have talked a few times about. Visualization is an easily digestible way to present data to colleagues and executives. This talk by Wim will cover the basics of visualization and then elaborate on gathering information using Davix and Google Chart API.

Getting Stuff Done: How to work with the rest of the business
Andy Ellis, Senior Director of Information Security, Akamai
April 20, 4:00pm-4:50pm

This should be a very useful and interesting talk. In many organizations information security importance is not totally understood. Sometimes it’s very difficult for technical people to work with other business units and co-workers. It took me a while to figure out operational people don’t care for the technical background and jargon, they just want to know if the systems working. I’m hoping to learn some information on working more cohesively with other business units.

Selling Security Without Selling Your Soul
Aaron Cohen, Managing Partner, MAD Security (@aaronco)
April 20, 5:00-5:30pm

I’m very excited about this talk Aaron is giving. It’s evident that security is not widely and truly embraced as it should be. I’m personally very excited with this talk because I’m always trying to get management buy in and project sponsorship for security initiatives.

InfoSec Mentors Workshop
April 20, 5:30-8:30 in The Constitution

This workshop is to celebrate the 1 year anniversary of the InfoSec Mentors program/project. I hear there’s going to be good food and a lot of fun. I’m excited to talk to other mentors/mentees. I also look forward to sharing my experience at the workshop.

Between 5:30 and 6:30 there will be an InfoSec Mentors panel that will be discussing mentoring tips and tricks. The Panel will focus on making great mentors even greater. The panel will consist of many professionals, InfoSec veterans, and speakers to share their experience and knowledge to build mentors.

After the InfoSec Mentors Panel there will be a mixer at 6:30-8:00. During this time mentors and mentees will have time to meet and party! Also there’s an open bar and food, automatically a good time. I’m looking forward to talking to other mentors and mentees to see some other perspectives on the program.

Across the Desk: Different Perspectives on InfoSec Hiring and Interviewing
Lenny Zeltser, Security Consulting Director,Savvis & Faculty Member, SANS Institute (@lennyzeltser) & Lee Kushner, President, LJ Kushner & Associates (@ljkush)
April 21, 10:00-10:50am

I always look forward to the content on Lenny Zeltser and Lee Kushner’s blog. The talk focuses on very important perspectives from the candidate and the employer. There is further discussion on important aspects such as resumes, job descriptions, interview communications and compensation. This is an extremely relevant talk for me since I’m a mentee trying to get into the InfoSec field.

So You Got That SIEM. Now What Do You Do?
Anton Chuvakin, Principal, Security Warrior Consulting (@anton_chuvakin)
April 22 - 11:10am-12pm

This talk by Dr. Anton Chuvakin helps navigate the challenges of deploying SIEM. Dr. Chuvakin shares some best practices and insight on how to achieve SIEM success. I’m interested in this talk because I’ve recently have been following Dr. Chuvakin’s blog which covers topics such as log management and SIEM. I’ll also be working with SIEM solutions in the near future.

The InfoSecMentors Project Essay Contest

The InfoSecMentors Project is giving away one ticket to Notacon 8 by having an essay contest. Each entrant should write an essay of less than 400 words about the following topic:

"Pretending I am your supervisor, write me an email requesting leave to attend a conference. Include reasons why attending conferences are valuable to the organization, and what you hope to learn from this hypothetical conference."

Submissions will be judged by an independent professional manager who makes decisions like this one. The submission that is most convincing and appropriate for a professional situation wins!

Email submissions to marisa@infosecmentors.com. Anyone can enter. The ticket will be available at will call. Contest ends April 8th 2:00pm ET. Winner announced April 9th.

Notacon is April 14-17 in Cleveland, OH. http://www.notacon.org

Guest Interview: Hadi El-Khoury and Jimmy Vo "Mentor & Mentee Q&A"

Today, our guest bloggers are Hadi El-Khoury and Jimmy Vo. Hadi and Jimmy are participants in the InfoSecMentors Project as mentor and mentee, respectively. This pair has been kind enough to keep us posted on their progress in the mentorship via updates on Twitter, and they have sent us the interview below where they both weigh in on several questions relating to mentoring in Information Security.

1. How long have you been in the program? Jimmy: Hadi had indicated that we’ve been in the InfoSec mentor program for about 6 months. Time flies when you’re having fun. Hadi: Indeed, mentoring Jimmy has been so enjoyable since he's keen on pushing forward in real life the new ideas and concepts we've been discussing. 2. What are your backgrounds? Jimmy: I am a recent college graduate from Richard Stockton College of New Jersey with my B.S in Computer Science/Information Systems, specializing in an Information Systems concentration. The Information systems concentration was more business orientated, which I found helpful already. I’ve worked part time help desk positions during my undergrad studies. I’ve started my first full time position as an IT Systems Analyst for a small business. I’ve always gravitated towards information security and had an interest in hacking. Most of my undergrad research was centered on information security. I’m currently attending Boston University for my M.S in Computer Information Systems – Security Concentration. Hadi: I hold a post-graduate degree in Network and Information Systems Security from the French Ecole Nationale Supérieure des Télécommunications. Prior to that, I graduated from the Beirut School of Engineering ESIB with a specialization in telecommunications. I am currently a Security Consulting Manager. For the last ten years, I've been dealing with information security and business continuity subjects on technical, organizational and business levels in line with ISMS (Information Security Management System) implementation while taking advantage of quality and business process management aspects for large financial institutions and critical private operators across Europe and the MENA region. 3. What were the main logistical challenges? Jimmy: Hadi resides in Paris, France so there is a six hour time difference. Despite the time difference we meet weekly via Skype. We usually chat for about an hour to an hour and a half about various topics which I’ll go into detail later. Hadi: Indeed, since it's often past midnight Paris time when Jimmy and I meet through Skype, I have to keep a Coke can by my side to regain some energy after a long day at work. 4. What were the covered topics? (Hard Skills) Jimmy: One of my main focuses is business continuity planning. We developed a plan to create a business continuity plan which involved business process modeling, dealing with vendors in regards to SLA, coming up with metrics, determining risks, and various other BCP related topics. We also discussed ways to improve an IT infrastructure, such as concepts like ITIL and other ISO standards. We also discussed various information security topics which deal with metrics, creating security awareness, OS hardening, integrating security into BCP, web application firewalls and securing the SDLC. Hadi: I am always stressing the importance of bridging the gap between the various disciplines governing IT, HR, business process modeling, information security, business continuity, risk analysis, to name of few.... Information security and business continuity are transversal by essence and should be dealt with as such. 5. What skills categories were covered? (Soft Skills) Jimmy: A great amount of emphasis is focused on developing soft skills that are essential to my success. We discussed effective communication with other business units. Hadi discussed the importance of working across different “silos” in order to assist in my organization’s success. There was discussion on persuasion and negotiation techniques. We talked of project management techniques to prevent project failures. Our mentorship was more than being technically able; it was about being approachable and tightly integrating technical initiatives within an organization. Hadi: The best "geek" in the world will remain unnoticed if he doesn't possess a minimum of soft skills, namely the ones just mentioned by Jimmy. When it comes to information security and business continuity, organizations are so reluctant to change their approach that the battle won't be won unless a significant load of soft skills is invested. To support this, I share the following quote from Wall Street Journal Deputy Managing Editor Alan Murray as he was discussing some of the lessons new managers can learn from his new book, "The Wall Street Journal Essential Guide to Management." It reads: "Even best-managed companies aren't protected from this destructive clash between whirlwind change & corporate inertia". IMHO, corporate inertia will exclusively be defeated by soft skills. 6. What was the used approach? (use cases, transversality, feedback, ...) Jimmy: From my perspective, Hadi has coached me rather than taught me. We didn’t spend our Skype sessions on going over step by step of configuring an intrusion detection system. Our discussions are at a higher level, which worked very effectively for me. I can just read a manual or Google a tutorial on deploying an IDS. In the contrary, I can’t read a manual on convincing management on the requirement of an IDS. Sometimes Hadi will assign me “assignments” which we go over during the following meeting. We also discuss interesting InfoSec related articles and try to apply them. Hadi: In addition, I'll just mention the mindset changing "Security by Analogy" approach. Readers can find an excellent example at the ISECOM website here: http://isecom.securenetltd.com/jack.1.0.en.pdf. I personally love the Electrician example, since it constitutes IMHO the very basic foundation of Information Security and Business Continuity. 7. What were the quick wins? (ROI, ...) Jimmy: One of the quickest wins was learning how to deal with salary negotiations. This was a skill that wasn’t taught in college. In the end, I was able to negotiate for more benefits. I was able to implement some initiatives for my organization with the help of Hadi. I see the wins every day at my workplace because of the knowledge and coaching I’m receiving. Hadi: Every Skype session with Jimmy is a quick win by itself since his motivation remains constant and his open mindset is ready to bust a new corporate silo. Jimmy is trying hard to tackle things properly each day despite corporate inertia. These are valuable assets for any wannabe Infosec practitioner. 8. What are the induced projects? Jimmy: My experiences beginning my professional career and discussions Hadi had motivated me to start a blog called Above Technical (.com). There are many technical blogs that focus on the mechanics of technology and/or information security. These skills are very important but the soft skills to communicate with others in an organization are even more important. The blog is focused on what I learn and the tips I’ve gathered in hopes to post some useful content for others. Hadi: Besides naturally contributing to Jimmy's new blog, I'm evaluating the feasibility of a larger scale mentoring program that takes advantage of the InfoSecMentors experience along with online news aggregators like the http://coaching.sekimia.com one. 9. What's new on your bookshelves? Jimmy: The newest book I’m reading is Yes! 50 Scientifically Proven ways to Be Persuasive by Noah J. Goldstein, Steve J. Martin, and Robert B. Cialdini. It’s a book Hadi had recommended for me. Hadi: Jimmy introduced me to the Toastmasters International website. I'm looking forward to delving into their leadership concepts.

You can find Hadi El-Khoury on LinkedIn and Twitter.

You can find Jimmy Vo on Twitter and at his blog, AboveTechnical.com.

Guest Post: Michelle Klinger "Interview with a Mentee...Mentee T"

This is the continuation in a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. Individuals have had to have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce an interview with a mentee.....Mentee T:

Q: What was your reasoning for engaging an infosec mentor that you were not able to do on your own?

A: To be honest, it was the experience really. I was looking for a way to broaden my horizons, and talk to all the people I could. I'm relatively new to the community, and one of the most important things that I've found, as well as the most rewarding, is just to talk to people. When I heard about the starting of the project, I was one of the first to pitch it to others.

Q: Prior to being matched, had you known of your mentor either personally or through social media forums? Were you hoping for someone “well known” in the social infosec social circle?

A: I was definitely aware of my mentor, and I think my mentor and I had mentioned each other on twitter once or twice, but had never actually conversed. Was I hoping for someone well known? I had no preference, really. One of the most important things about a project like this is coming into it with an open mind. Particularly as a mentee, you're really after someone who is well, smarter than you. So you have to throw out a lot of your preconceived notions and just go with the flow. (Also, wow, that was incredibly hippie-ish.)

Q: Was gender a concern when envisioning who you’d be paired with?

A: Not in the slightest. There are a lot of infosec chicks who are significantly smarter than me, and a lot of dudes who are as well. Like I said above, it was really about making the connections and conversations.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)?

A: I'm actually more active on social media than my mentor. Mentor did make a point to remind me to be careful what I say out there, but that wasn't much of a stretch more than what I already do. It's an often forgotten art, the act of not spewing every little thought on to the interwebs. Actually, if you watch my stream really closely, you'll see me tweet something, then within a minute or two, delete it after some thought.

Q: Was your pairing public via social media (i.e. Facebook, Twitter, LinkedIn) either by you or your mentor? What was the reasoning behind the decision?

A: It was actually kind of a game to see if people could figure it out. Even about 6 months or so later, once we had pretty well, if not officially ended the mentor/mentee relationship, that some folks were still trying to catch hints. But we never officially made it public. Just never felt the need, I suppose. Now, though, I wonder if that might have put some necessary pressure on the relationship.

Q: Did the initial meeting/conversation meet expectations? What did that initial communication entail?

A: The initial conversation actually threw up some red flags for me. Our initial introduction was through email (we didn't meet in person until BH/DC), and I went ahead and took the lead, since every conversation should be a two way street, by sending a few questions in my mentor’s direction. Just a few things like how mentor got 1st infosec start, what some of my mentor’s day to day duties and such are, and a few other questions just to get to know my mentor better. And while my mentor acknowledged that emails were received, I didn't receive a full response to those questions for about 2 weeks.

Understandably, that's a little rough on the start of what's supposed to be a back and forth relationship, just by definition of a mentor/mentee relationship. I understand being busy, I was in the process of writing and preparing a talk myself, but this definitely started us off on a rocky footing.

Q: Have you made any major changes or decisions based on advice or direction from your mentor?

A: Well, I'd like to say I have, since I received such advice as "Stay in school." "Don't let your ego get ahead of you." But I don't know that those are really personally specific, so I guess the answer is no.

Q: Were you given any “homework” or assignments to complete and did you actually do them? Did you see value in the tasks assigned?

A: In an odd turning of the tables, I was actually the one issuing homework. I was looking for feedback on my talks, and my topics, so I assigned my mentor to watch the recordings. However, I don't think that was ever done, so I suppose there wasn't much value from the assignment if it never got done.

Q: Do you feel the mentor you were paired up with was an accurate match?

A: That's a hard, hard question to answer. I think we had some similarities to be sure, and since I still don't have much of a direction in mind, just getting to know someone new was kind of rewarding. However, I am still definitely disappointed, thinking about what could have come out of it. Even meeting in person never lit much of a fire. This is an organic thing, it has to be nurtured and grown, which requires effort on both sides of the table. If that never happened, nothing ever grew, and then I don't know that we could call the match accurate. The important thing, though, is that I learned something from this, even if I'm not totally sure what I'm it is quite yet.

Q: If you could re-do any aspect of your interaction with your mentor to date, what would it be and why?

A: That's a loaded question, particularly after my comments above. Is there stuff that I would change? Hell yes. I'd love to have gotten to know my mentor a little better. I wish we could have shared a bit more than the IM conversations and a few hours of surface chat at BH/DC. I was in an area where I was trying to make some decisions and more than a line or two would have been greatly appreciated.

However, I don't want my story to be a discouragement. More a...disclaimer, I think. As you go into your mentorship/menteeship, be aware this is definitely a relationship. It has to be a two way street, or this isn't going to work. Take a look at your time commitments before joining the program. This whole post could have been avoided early on, if my mentor had waited until a period where mentor had a little more time on his hands. And not even a whole lot, but enough to answer an email every few days. Just something to think about…..

Looking for other mentors/mentees...If you'd like to be interviewed, please contact me at securityindepth at gmail dot com

Guest Post: Michelle Klinger "Interview with a Mentee...Mentee Y"

As previously mentioned, this is the continuation in a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. Individuals have had to have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce an interview with a mentee.....Mentee Y:

Q: What was your reasoning for engaging an infosec mentor that you were not able to do on your own?

A: I'd been working to transition into the pen-testing field but without direct experience it was difficult to get past initial interviews. I sought a mentor to help me identify the areas I was lacking and suggest how I could fill the gaps in my experience.

Q: Have you’ve ever had a mentor before? Was it organically developed or had you been a part of other mentor programs?

A: I've had mentors off and on throughout my life. In every case they were organically developed and made a huge contribution to my success at the time.

Q: Prior to being matched, had you known of your mentor either personally or through social media forums? Where you hoping for someone “well known” in the social infosec social circle? Why or why not?

A: Yes, I'd seen my mentor present at Shmoo earlier this year so I knew of them already. The fact that he is well known only helped me to more quickly understand how he could contribute and help me towards my goals. The "well known" factor wasn't a requirement for me though. As long as the mentor had the experience to understand what I was looking for and help me down that path, that's all that mattered to me.

Q: Was gender a concern when envisioning who you’d be paired with? Why or why not?

A: No, gender was of no concern to me. I've met plenty of highly experienced people in this field and their gender had little or nothing to do with that success. As long as we could communicate and work together that's all I cared about.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)? Have you? Why or why not? If you have, has aided in your original goals?

A: I was already engaged in most of the social media options when I was matched so no, he didn't suggest any of those. Of all the social media I use, Twitter has been the most valuable for keeping pace with what's happening as it's communicated by the infosec industry.

Q: Was your pairing public via social media (i.e. Facebook, Twitter, LinkedIn) either by you or your mentor? What was the reasoning behind the decision?

A: Yes, I know I tweeted about it immediately although I waited to say who my mentor was until after we'd exchanged an email or two.

Q: Did the initial meeting/conversation meet expectations? What did that initial communication entail?

A: It wasn't what I expected but that wasn't a bad thing either. I learned that my mentor and I shared many similar experiences which helped me to understand that my goals were reasonable. Basically, "If he could do it, then I had a shot too".

Q: Have you made any major changes or decisions based on advice or direction from your mentor?

A: Absolutely. His experience gave me an alternative path to consider for my job search. Ultimately this is what led me to my current new job that I've had for about a month now. It's not a pen-testing role like I'd been targeting but it turns out I'm probably 10x better at being an analyst than I would have been a pen tester. Plus, the company I'm with now has lots of opportunities internally when I'm ready to move into other areas, including pen testing.

Q: Were you given any “homework” or assignments to complete and did you actually do them? What are a few examples of assignments given? Did you see value in the tasks assigned?

A: He definitely gave me recommendations for web app lab configurations. It wasn't homework though and unfortunately I've never taken the time to set up the suggested lab systems. I do see value in this and when I do reach this point I know my mentor will still be there to help with any questions that may come up.

Q: Do you feel the mentor you were paired up with was an accurate match? Why or why not?

A: Yes, my mentor was an accurate match based on the information I provided in my questionnaire. The end result was a path I hadn't considered taking and was different from what I thought I was looking for but a win is a win.

In the end, the InfoSec Mentor experience was less what I was looking for, and more of what I needed. If you're open minded enough to see this and respect it for what it is, then it's a priceless lesson and an invaluable experience.

If you’d like to be interviewed, please contact me at securityindepth at gmail dot com

Unexpected difficulties from life on the road

As far as career highlights go, this past month has been one of the best. I'll never forget my trip to Source Barcelona where I hobnobbed with Really Smart Dudes™, had conversations that may well have changed the course of my business model, and convinced Wim Remes to be EU Director of the InfoSecMentors Project.

But the name of this post is about unexpected difficulties in traveling, not in its virtues.

Nobody will be surprised to hear it when I say that I made a rookie mistake. The conference was actually only two days, but I've been to Europe before, and I knew that if I was going to be human I would need two days beforehand to get over jetlag. Then, as long as I was in Europe, I decided I would stay through till my cousin's wedding. And I'd always wanted to see Italy. And I was set to coordinate Security B-Sides Atlanta in October. Before I knew it I had racked up 26 days away from home.

Now, you industry veterans know before I even say it what my unexpected mistake was. In my excitement to experience the whirlwind jetset of a lifetime, I had completely abandoned my loving, dutiful significant other. By the time I realized what my trip was really costing me, the damage was pretty severe. I'm grateful to say that all is well now, but it left me thinking "I wish someone had talked to me about stuff like this." The InfoSecMentors Project blog is about advice for careers, but it's also about the ephemeral stuff that you may never realize, but really need to survive in the bigger game. So, thanks to some of the awesome supporters of the project, below are some thoughts from people I respect in the industry on the subject of traveling for work, and keeping that perspective on *what's really important.*

Does traveling for work put a strain on your relationship/family life?

Chris Hoff, someone who regularly crosses continents, said,

"Definitely. There are two aspects that are most difficult; logistics and emotional connectedness. I have 3 kids (6, 9, 14) and another on the way. My wife and I really do work like a transportation team when I'm home and I do most of the cooking so it's very difficult for her to maintain all of it by herself. She does a fantastic job but it's a nightmare trying to plan around three different schedules given the kids' activities.

Then, of course, there is the issue of not being there; not having a spouse, a friend, a dad. That's a terrible price to pay, but given how big of a part of my job this is and has been for some time, we learn to cope and try to quickly settle back into a routine when I get home."

How likely are you to forgo work travel for family reasons?

Following up on a topic he actually covered at HacKid Con in Boston, Josh Corman said,

"I travel BECAUSE of family, because I am the provider. I hate getting on a plane for work (although many friends/colleagues don't even have income right now.) I travel BECAUSE I love my family. The trade-offs between the Provider, Parent, and Spouse roles are very difficult."

Martin Fisher adds,

"I may not forgo the travel but I work hard to minimize impact. I plan for day-trips instead of 2 day events...2 day events versus a week away...and so forth. Sometimes long trips can't be helped but working hard to minimize the impact pays huge dividends."

How often do you "call home" while on a work trip? Which technologies do you use?

Ryan Russell said,

"At least daily, usually several times per day. At least one voice phone call, frequent texting, sometimes an email. My wife isn't into any social networking, but I see many other couples use that. I will sometimes interact with my older kids on Facebook. When I went to Germany a couple years back, I found my cell not working, and hotel phone ridiculously expensive. I was happy to find that Skype worked really well. (On the really expensive Hotel Internet, but that's not optional. ;) ) We have toyed with gmail video chat, and found it workable. We would probably use that in the future."

So, what's the secret, really?!?!

In classic Nickerson style, Chris weighs in on this one, touching on points I hadn't even considered.

"HAHAH... I really wish there was one. More than anything, it has to do with the level of understanding of your family. If they have always known you to fly 150k miles a year and only be home on the weekends.... they have their expectations set ( hell, i think Jes gets sick of me being home for more than a few weeks in a row) =)

If you are new to the JetSetting... communication is the key! Bust your butt on the job... so you can catch that early flight, plan your trips wisely, check in often, speak your mind... (this one is huge) Let them know what you are doing and why. They love ya and will understand. Sometimes there are compromises that can be made (a day here n there) that help them feel like they are part of the process ... not just collateral damage.

The gifts.... well.. thats lame. No need to try to buy it back. Instead... buy 'em gifts at random. It's more fun, and will always be unexpected. This way you are not trying to make an excuse for why you got them some crappy Barcelona t-shirt and a package of gummy bears from Berlin.

But in all seriousness, I have had many first timers work for me in the past and I always tell them that they need to make family first, and take care of them at all costs. (PS. for all you managers out there.... It's on you as well... don't be slave drive'n your employees just because "you can" and "they don't mind." You have to have some respect for their family life. If you are not sure if you are doing it... read their schedule to your spouse. See if they say "If you had to be gone that much I'd..." or something like it. Employees and partners alike, all need the checks n balances. Spouses, Bosses, and all you Jet Setters... you all have a responsibility to be vocal and make it work together. NO ONE can do it alone."

Hopefully this was helpful, or at least sits in the back of your mind. One of the topics I hear people worry about in this industry is "burn out." I've learned first hand that it's a real concern, and unless you keep your home life happy you'll never survive it.

Suggestions for getting started

One part of participating in the InfoSecMentors project is the support resources found on this blog and over emails. One email in particular goes out to potential mentors and mentees before they meet their match, giving them suggestions for how to start the process. The first step is to bridge the familiarity gap and get to know each other. I've posted this email below, in case you were one of those volunteers who received it many months ago and were looking for a reference.

Hello participants,

If you're receiving this email, it means we have received all of your application information, and we are busy making a match for you! We've had an overwhelmingly successful number of participants, and we've begun making some great introductions. In the mean time, I thought I would create a small list of activities you should expect to do during the beginning phase of your mentoring relationship.

MENTORS
-Email your mentee with an introduction to yourself. Consider including the answers to questions like "What is your favorite duty on your job?" "When are you available and where are you located?" "What was your experience being a mentee in the past?" and "What do you expect from your mentee in this relationship?"
-Decide with your mentee on a single task that you can help them with, and execute.
-Promote your relationship. With their permission, talk about your mentee on Twitter or other forums. This is to increase the mentee's personal brand, and to make it easier for them to seek help or engage the community.
-Introduce them to other people that can help with another specific issue.
-Wash, Rinse, Repeat.

MENTEES
-Create a list of questions for your mentor.
-Email your mentor with an introduction to yourself. Include information about your experiences up to this point, and what goals you have.
-After getting to know your mentor's skill set, decide on a single task that they can help you with. The more specific, the better. (Not knowing what you want to be in 5 years is fine. Start with a goal of learning about your mentor's daily job. Ask questions about their background and style of living. Then ask them to guide you through introductions to other people in different jobs. It is important to be specific and have your questions ready.)
-Keep in touch! While it usually falls on the mentor to make the connection, it is very important for the mentee to *maintain* that connection. Plan on emailing your mentor every few months after your task is completed with updates to your professional life. This will definitely pay off down the road, I promise!

MANATEES
-Continue being adorable.

When you receive your introductions tomorrow, hopefully you will be pleased, but if there is a problem, just email us and we'll make a change. Problems that may arise include schedule conflicts, ethical/NDA conflicts, or you're already best friends and don't want to "go there." No problem. Give us another chance, and please be *specific* about your goals.

And keep an eye on our blog, http://infosecmentors.blogspot.com/. We have some helpful tips, and future blog posts planned interviewing some of you on your progress!

Best of luck,

Marisa
Founder, InfoSec Mentors
www.infosecmentors.com
====================

Mentor vs. Mentee

Hiya ! We've been matching mentors and mentees at lightning speed in the past days and as one would come to expect, we have much more mentees than we have mentors.

At first glance this would seem natural, the infosec people I've met all had one thing in common : their thirst for knowledge. If we pick up a subject, we want to know it all. When it seems we master a subject, a whole new aspect of that same subject jumps from the woodwork. It's an eternal process. We (need to) keep learning.

When I look at the list of people who have subscribed to infosecmentors as a mentee, I sit back and wonder. Among them are people I would love to have as a mentor because I know they possess a wealth of knowledge and more importantly, knowledge that some of the other mentees crave.

Whatever your reason is for not subscribing as a mentor, I ask you to think again. And this is why :

Several years ago I picked up a book at a local second hand book market and I decided to take it with me. That book was "The Cycle of Leadership" by Noel M. Tichy and it describes how top-performing companies stand out because of their ability to develop leaders at every level of their organisation. These companies develop virtuous teaching cycles in order to keep a steady flow of leaders within the company. Most importantly, Mr. Tichy stresses the importance of the teaching and learning being reciprocal. The best teachers are those who are willing to learn from their students.

After I read the book, I started paying attention to this concept. I try to grasp every opportunity to learn from anybody. Sure I can learn a lot from another person, much smarter than me, in my own trade but I learn from the C-level executive, the helpdesk guy, the cleaning lady and my mom too. Sometimes I teach. Not in the classroom sense of the world but I share knowledge. And even then, I'm learning too. By getting feedback, people proving me wrong or people providing completely new insights that challenge me to learn even more. And it's fun !

Let's bring that spirit to infosecmentors! I promise you that being a mentor will not be a boring task and even as a mentor, you'll learn a lot !

We need you !

Mentoring in funny accents ...

I have to be honest. When Marisa came out with the whole infosecmentors idea, I must have been her worst critic. Infosecmentors was launched with the idea of bringing mentors and mentees together during BH/DC in July and I was totally rebuffed. I loved the idea, but I felt excluded since I wouldn't make it to Vegas in 2010. How could I ever participate ? I didn't sign up and let the idea slip away.

Months passed by, 0-day got released, several Patch Tuesdays came and went and somewhere in the back of my mind a thought was lingering: "could I be a mentor or rather embrace my inner n00b and become a mentee?"

Then came September and I flew to picturesque Barcelona to speak at and attend the Source conference. How much did I know my life was about to be changed ? There must have been sangria and tapas involved but then and there I was personally introduced to Marisa. Now, I have to tell you, if you happen to run into Marisa the first thing you notice is the copious amounts of positive energy she exudes. After apologizing umpteen times about my behaviour a few months back, we kept talking about this project and the way she talked about it, the energy she puts into it got quite infectious. Somehow along the way I had a choice to make : either I was gonna be the bystander who criticizes and does nothing or I was going to get involved and give my everything to make this work.

I didn't think twice, or maybe I did but after 2 more cups of sangria it didn't really matter.

Since more and more people from Europe are putting their names down as mentors and mentees and the time difference would require Marisa to either clone herself or outsource the matching process Elbonia, As of now I will be your contact person for this part of the world. Together with Marisa, I'm totally convinced that we will all benefit from the mentor/mentee relationships we want to foster and we're more ready than ever to make this work.

For those that don't know me, I'm @wimremes on Twitter and the rest can be found using Maltego. Now let me get back to finding you the right mentor/mentee and enable you to get as much out of that relationship as possible.

--Wim

Guest Post: Michelle Klinger "Interview with a Mentor...Mentor R"

As previously mentioned, this is the continuation in a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. Individuals have had to have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce the first interview with a mentor.....Mentor R:

Q: What was your reasoning for choosing to offer your time and energy in becoming an infosec mentor? Had you ever been a mentor before (officially or unofficially)?

A: I have been both a mentor and mentee in my career so far. I had never taken part in a formal mentoring program before but I had been “taken under someone's wing”. That person helped me a lot in my career so I wanted to give something back to someone else wanting to get into information security.

I unofficially mentor people in my current role and continue to do so, the work I do with my infosecmentors mentee is largely the same as I do with my two unofficial mentees.

Q: Prior to being matched, had you known of your mentee either personally or through social media forums? Did you request your mentee?

A: No, I hadn’t heard of my mentee Q: beforehand and I didn’t request my mentee.

Q: Was gender a concern when envisioning who you’d be paired with? Why or why not?

A: It wasn’t for me, I’ve worked with and been managed by females all through my career so I’ve never seen gender as a problem. I’ve been exposed to the struggles my own mother had through her career as a female in male dominated industries despite her knowledge and achievements.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)? Have you? Why or why not? If you have, has aided in your original goals?

A: I’m the mentor in this pairing but I suggested my mentee set up a blog which has helped build his profile in the web application security community. I also encouraged my mentee to be more active on Twitter and get involved in “conversations”.

Q: Was your pairing public via social media (i.e. Facebook, Twitter, and LinkedIn) either by you or your mentee? What was the reasoning behind the decision?

A: It was made public, by both of us. We had multiple reasons, we were happy to be paired together. I wanted to spread the message about the infosecmentors program as well. Obviously no one gets to see everything we discuss but we feel making some things public has helped, I know of people who have applied to join the program after reading about our work and pairing.

Q: For the initial meeting/conversation did you have a set idea of what you wanted to communicate regarding the mentor/mentee relationship? What did that initial communication entail?

A: I guess the fact I’m in Ireland and my mentee is in Las Vegas limited our choices when it came to communicating with each other. We have almost exclusively communicated via email, quick/small queries via DM’s and we spent a day together at DEF CON discussing future projects etc.

Q: What is your take on assigning “homework” or tasks to your mentor?

A: I am the mentor in this pairing, but if my mentee wanted to assign me “homework” I’d not be against the idea as long as they respected the fact I sometimes have no time to do this kind of work.

Q: Since your pairing, would you say that you were accurately paired with your mentee? Do you feel that you have the knowledge and skills to guide the mentee towards his/her goals?

A: Yes, definitely. I think we were are a great pairing, I felt this way just from our email conversations but after a lot of one on one discussions in Las Vegas I feel we both think alike and have the same work ethic and attitude towards information security.

Q: Would you say that being a mentor has taken up a significant amount of personal time?

A: No, if anything I sometimes feel like I should be giving more time to this but I just can’t spare much time when work and outside work projects get busy.

Q: If you could re-do any aspect of your interaction with your mentee to date, what would it be and why?

A: Probably spend more one on one time when I was in Las Vegas, given the distance between the pair of us one on one meetings are probably only going to happen once a year.

If you want to be interviewed, please contact me at securityindepth at gmail dot com