Root the Box - April 7th, 2012 - Chandler, AZ

Today I talked with Zachary Julian, a student at the University of Advancing Technology, about a competition called Root the Box in Chandler, AZ this weekend, April 7th. Root the Box is a computer hacking (CTF) game that requires skill, speed and team work. Each team must scan and exploit systems on the attack network. If a team successfully obtains remote code execution they can upload a reporting service, which awards them points over time.

Check it out at rootthebox.com or on their FB page. There is still time to register for this weekend's event. Root the Box is put on once a semester.

-Who are you?
My name is Zach Julian, and I’m currently attending the University
of Advancing Technology for my Bachelors in Network Security. I
am also on the Root the Box organizing committee, where I serve
as the security officer for the competition. I have loved
computers for many years, and consider myself fortunate to have
found a good community of hackers here in Phoenix, Arizona.

-What's it like as an infosec student at University of Advancing Technology?
It’s a unique experience- Network Security is undoubtedly the best
program UAT has to offer. We have a pretty tight-knit group of
people within our major, which includes a wide range of skill
levels and specialities. If you’re serious about learning
security, UAT is definitely the place to come. Coming to UAT,
I’ve found the class material to be challenging and useful, my
peers extremely bright, and the opportunities to network
constant. I’m always inspired to attain higher levels of
hacker-fu.

-How did you get involved with Root the Box?
So far, I have competed in two Root the Box competitions. After
that, I felt it would be a worthwhile experience to help the
competition in some way. Since my current job consists of
Intrusion Detection analysis, I volunteered to set up and
monitor a Snort box during the competition. This is to ensure
that the participants stay within scope during their attacks. ;)

-How long has Root the Box been happening?
This will be Root the Box number 8. During that time, we’ve improved
on everything from the hacking challenges to the scoring engine.
After several years, the competition has matured quite a bit.

-What skills do you hope students get out of participating?
Each Root the Box is an excellent opportunity to refine and expand
your skills a little bit more. Hacking is the same as any skill
- reading and thinking about it will give you some knowledge,
but there’s no replacement for actual experience. That is why we
so strongly encourage people interested in security, at all
levels, to participate in Root the Box.
Newcomers to hacking will benefit the most - Root the Box features
challenges that draw from all types of digital security, from
reverse engineering to web applications. If security or
penetration testing is your intended career path, Root the Box
will show you what to expect and where to focus your learning.

-How can people get involved?
Come compete! Anyone interested in volunteering for Root the Box will
be able to meet our staff and get a good idea of just what goes
into putting on this competition. More specifics are available
at http://rootthebox.com.

Thank you Zachary for filling us in on this very cool competition! Good luck this weekend!

InfoSecMentors @ BruCon 2011

Next week the InfoSecMentors team will be attending BruCon! We've been looking forward to this particular event all year because BruCon has been a valued supporter for the project. BruCon is a great conference not only because their slogan is "Hacking for Beer" but because they've captured that great balance between the black t-shirts and the suits. The trainings, presentations, and workshops are all very affordable (and a steal when you hear about the included after-party!) We're looking forward to learning a lot, meeting new friends, and drinking beer in amazing places.

This year, we're hosting a mentoring workshop on the second day. This workshop will tackle both sides of the mentoring relationship. For the mentees, we'll talk about ways to set yourself apart, how to efficiently do your homework, and what valuable benefits to expect from your mentorship. For the mentors, we'll go over different activity ideas, how to keep your mentee engaged, and the value mentors get out of the mentorship. After that, we'll put the question to the audience and try to define just what exactly counts as a successful mentoring relationship.

Our workshop panelists include David Rook (@securityninja), Chris Gates (@carnal0wnage), Wim Remes (@wimremes), and Marisa Fagan (@dewzi). We'll start at 19:30 Tuesday with a short presentation and open the floor for questions and experiences. Hope to see you there!

Guest Post: Michelle Klinger "Interview with a Mentee...Mentee T"

This is the continuation in a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. Individuals have had to have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce an interview with a mentee.....Mentee T:

Q: What was your reasoning for engaging an infosec mentor that you were not able to do on your own?

A: To be honest, it was the experience really. I was looking for a way to broaden my horizons, and talk to all the people I could. I'm relatively new to the community, and one of the most important things that I've found, as well as the most rewarding, is just to talk to people. When I heard about the starting of the project, I was one of the first to pitch it to others.

Q: Prior to being matched, had you known of your mentor either personally or through social media forums? Were you hoping for someone “well known” in the social infosec social circle?

A: I was definitely aware of my mentor, and I think my mentor and I had mentioned each other on twitter once or twice, but had never actually conversed. Was I hoping for someone well known? I had no preference, really. One of the most important things about a project like this is coming into it with an open mind. Particularly as a mentee, you're really after someone who is well, smarter than you. So you have to throw out a lot of your preconceived notions and just go with the flow. (Also, wow, that was incredibly hippie-ish.)

Q: Was gender a concern when envisioning who you’d be paired with?

A: Not in the slightest. There are a lot of infosec chicks who are significantly smarter than me, and a lot of dudes who are as well. Like I said above, it was really about making the connections and conversations.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)?

A: I'm actually more active on social media than my mentor. Mentor did make a point to remind me to be careful what I say out there, but that wasn't much of a stretch more than what I already do. It's an often forgotten art, the act of not spewing every little thought on to the interwebs. Actually, if you watch my stream really closely, you'll see me tweet something, then within a minute or two, delete it after some thought.

Q: Was your pairing public via social media (i.e. Facebook, Twitter, LinkedIn) either by you or your mentor? What was the reasoning behind the decision?

A: It was actually kind of a game to see if people could figure it out. Even about 6 months or so later, once we had pretty well, if not officially ended the mentor/mentee relationship, that some folks were still trying to catch hints. But we never officially made it public. Just never felt the need, I suppose. Now, though, I wonder if that might have put some necessary pressure on the relationship.

Q: Did the initial meeting/conversation meet expectations? What did that initial communication entail?

A: The initial conversation actually threw up some red flags for me. Our initial introduction was through email (we didn't meet in person until BH/DC), and I went ahead and took the lead, since every conversation should be a two way street, by sending a few questions in my mentor’s direction. Just a few things like how mentor got 1st infosec start, what some of my mentor’s day to day duties and such are, and a few other questions just to get to know my mentor better. And while my mentor acknowledged that emails were received, I didn't receive a full response to those questions for about 2 weeks.

Understandably, that's a little rough on the start of what's supposed to be a back and forth relationship, just by definition of a mentor/mentee relationship. I understand being busy, I was in the process of writing and preparing a talk myself, but this definitely started us off on a rocky footing.

Q: Have you made any major changes or decisions based on advice or direction from your mentor?

A: Well, I'd like to say I have, since I received such advice as "Stay in school." "Don't let your ego get ahead of you." But I don't know that those are really personally specific, so I guess the answer is no.

Q: Were you given any “homework” or assignments to complete and did you actually do them? Did you see value in the tasks assigned?

A: In an odd turning of the tables, I was actually the one issuing homework. I was looking for feedback on my talks, and my topics, so I assigned my mentor to watch the recordings. However, I don't think that was ever done, so I suppose there wasn't much value from the assignment if it never got done.

Q: Do you feel the mentor you were paired up with was an accurate match?

A: That's a hard, hard question to answer. I think we had some similarities to be sure, and since I still don't have much of a direction in mind, just getting to know someone new was kind of rewarding. However, I am still definitely disappointed, thinking about what could have come out of it. Even meeting in person never lit much of a fire. This is an organic thing, it has to be nurtured and grown, which requires effort on both sides of the table. If that never happened, nothing ever grew, and then I don't know that we could call the match accurate. The important thing, though, is that I learned something from this, even if I'm not totally sure what I'm it is quite yet.

Q: If you could re-do any aspect of your interaction with your mentor to date, what would it be and why?

A: That's a loaded question, particularly after my comments above. Is there stuff that I would change? Hell yes. I'd love to have gotten to know my mentor a little better. I wish we could have shared a bit more than the IM conversations and a few hours of surface chat at BH/DC. I was in an area where I was trying to make some decisions and more than a line or two would have been greatly appreciated.

However, I don't want my story to be a discouragement. More a...disclaimer, I think. As you go into your mentorship/menteeship, be aware this is definitely a relationship. It has to be a two way street, or this isn't going to work. Take a look at your time commitments before joining the program. This whole post could have been avoided early on, if my mentor had waited until a period where mentor had a little more time on his hands. And not even a whole lot, but enough to answer an email every few days. Just something to think about…..

Looking for other mentors/mentees...If you'd like to be interviewed, please contact me at securityindepth at gmail dot com

Guest Post: Michelle Klinger "Interview with a Mentor...Mentor R"

As previously mentioned, this is the continuation in a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. Individuals have had to have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce the first interview with a mentor.....Mentor R:

Q: What was your reasoning for choosing to offer your time and energy in becoming an infosec mentor? Had you ever been a mentor before (officially or unofficially)?

A: I have been both a mentor and mentee in my career so far. I had never taken part in a formal mentoring program before but I had been “taken under someone's wing”. That person helped me a lot in my career so I wanted to give something back to someone else wanting to get into information security.

I unofficially mentor people in my current role and continue to do so, the work I do with my infosecmentors mentee is largely the same as I do with my two unofficial mentees.

Q: Prior to being matched, had you known of your mentee either personally or through social media forums? Did you request your mentee?

A: No, I hadn’t heard of my mentee Q: beforehand and I didn’t request my mentee.

Q: Was gender a concern when envisioning who you’d be paired with? Why or why not?

A: It wasn’t for me, I’ve worked with and been managed by females all through my career so I’ve never seen gender as a problem. I’ve been exposed to the struggles my own mother had through her career as a female in male dominated industries despite her knowledge and achievements.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)? Have you? Why or why not? If you have, has aided in your original goals?

A: I’m the mentor in this pairing but I suggested my mentee set up a blog which has helped build his profile in the web application security community. I also encouraged my mentee to be more active on Twitter and get involved in “conversations”.

Q: Was your pairing public via social media (i.e. Facebook, Twitter, and LinkedIn) either by you or your mentee? What was the reasoning behind the decision?

A: It was made public, by both of us. We had multiple reasons, we were happy to be paired together. I wanted to spread the message about the infosecmentors program as well. Obviously no one gets to see everything we discuss but we feel making some things public has helped, I know of people who have applied to join the program after reading about our work and pairing.

Q: For the initial meeting/conversation did you have a set idea of what you wanted to communicate regarding the mentor/mentee relationship? What did that initial communication entail?

A: I guess the fact I’m in Ireland and my mentee is in Las Vegas limited our choices when it came to communicating with each other. We have almost exclusively communicated via email, quick/small queries via DM’s and we spent a day together at DEF CON discussing future projects etc.

Q: What is your take on assigning “homework” or tasks to your mentor?

A: I am the mentor in this pairing, but if my mentee wanted to assign me “homework” I’d not be against the idea as long as they respected the fact I sometimes have no time to do this kind of work.

Q: Since your pairing, would you say that you were accurately paired with your mentee? Do you feel that you have the knowledge and skills to guide the mentee towards his/her goals?

A: Yes, definitely. I think we were are a great pairing, I felt this way just from our email conversations but after a lot of one on one discussions in Las Vegas I feel we both think alike and have the same work ethic and attitude towards information security.

Q: Would you say that being a mentor has taken up a significant amount of personal time?

A: No, if anything I sometimes feel like I should be giving more time to this but I just can’t spare much time when work and outside work projects get busy.

Q: If you could re-do any aspect of your interaction with your mentee to date, what would it be and why?

A: Probably spend more one on one time when I was in Las Vegas, given the distance between the pair of us one on one meetings are probably only going to happen once a year.

If you want to be interviewed, please contact me at securityindepth at gmail dot com

Interview with a Mentee...Mentee X

As previously mentioned, I planned on doing a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. I tried to choose individuals that have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce the first interview with Mentee X:

Q: What was your reasoning for engaging an infosec mentor that you were not able to do on your own?

A: I guess my reasoning for joining the Infosec mentors is a little different to some others. I’m already in the industry and work as a penetration tester for a large bank. My goal wasn’t to get exposure, to get technical assistance or anything like that. My main issue was that I’d reached that point where I should be giving presentations and talking publicly about things I’m doing. For me that’s a hard hurdle to get over. Fear of speaking, or more aptly, fear of landing flat on my face, is my biggest issue right now. That’s something I hoped my mentor could help me with. To speak from experience about how he overcame that, and how I can start to present my research with confidence.

Q: Have you’ve ever had a mentor before? Was it organically developed or had you been a part of other mentor programs?

A: I’ve had a mentor before, but it’s been a long time since we’ve met. Since my previous mentor and I worked together at a company some years back, it was hard to keep in contact once I moved on. I wouldn’t say we came together organically as such. My previous company liked to run mentor schemes, and although we were (work) friends, I guess the program was the nudge we needed to make the agreement official. Since then both myself and my previous mentor have moved into other lines of work in other parts of the world, so it made little sense to continue the arrangement. He gave me a lot of good pointers however, and I’ll always credit him for giving me the drive to try new things and move forward.

Q: Prior to being matched, had you known of your mentor either personally or through social media forums? Where you hoping for someone “well known” in the social infosec social circle? Why or why not?

A: Funny enough, I’d met my (now) mentor a few times previously, and we were what I would consider friends. Ironically I actually joked on Twitter that I’d get stuck with him… and look what happened. I don’t regret it for a minute though, as he’s a perfect fit for what I want to improve on.

I guess I was hoping for somebody to come along who I knew and respected… and I certainly wasn’t disappointed in that respect. Not that being well known makes you any better or worse at being a mentor, but I guess I had an image in my mind of what I wanted and that went well with it.

Q: Was gender a concern when envisioning who you’d be paired with? Why or why not?

A: No I don’t think so. I don’t think gender makes a difference in the industry. A lot of people have made a fuss about gender issues in security in the last few years but I’ve never seen the issue myself. I have respect for people in this industry regardless of the age, sex, race or experience. This isn’t an easy industry to work in, so the fact they’re here and trying means they’ve earned that respect.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)? Have you? Why or why not? If you have, has aided in your original goals?

A: Well I was already a social butterfly… in fact I think I’m on more social networks than he is. Not sure if that’s a good thing or not ;)

Twitter has been a big part of my success and been a great way to meet people. I can’t recommend it highly enough to people in the industry, or looking to break into it. You have to be part of the conversation after all… and everybody has a point to make!

Q: Was your pairing public via social media (i.e. Facebook, Twitter, and LinkedIn) either by you or your mentor? What was the reasoning behind the decision?

A: We announced our pairing pretty quickly on twitter and on my blog. It wasn’t really a discussion to be honest, as we’ve both been on Twitter for a long time, it just seemed natural. I’ve actually seen a lot of infosec mentees creating accounts on twitter when they’ve been paired with a mentor. I think that’s a good thing as it’s a great resource.

Q: Did the initial meeting/conversation meet expectations? What did that initial communication entail?

A: I’ve had a few really good talks with my mentor and gotten a lot out of them. We initially started talking over Skype and other online channels due to the distance (I’m in Europe and my mentor is in the US). We met up face to face again at BSides Las Vegas, which was a fun trip. I think our relationship is a little unstructured at the moment, as we’re both rushing around to conferences and the like... plus the obvious time difference. Hopefully we’ll be able to get together more often online or IRL in early 2011.

Q: Have you made any major changes or decisions based on advice or direction from your mentor?

A: Not at the moment. I’m still working on a few things that should come to fruition next year. Hopefully my mentor can help me iron out the many kinks before then.

Q: Were you given any “homework” or assignments to complete and did you actually do them? What are a few examples of assignments given? Did you see value in the tasks assigned?

A: My mentor did offer something you could call homework, but due to some bad timing I wasn’t able to take him up on the offer. Still, there will be other chances to show my presentation skills I hope. My mentor has also given me a number of smaller tasks to do, usually at the last minute… still it’s all good experience. They’ve certainly helped me look differently on things and change my opinion about a few key issues.

Q: Do you feel the mentor you were paired up with was an accurate match? Why or why not?

A: I think so. We have similar outlooks on things, which is great. Plus he has the perfect skill set to help me achieve what I want out of our relationship. I’m hoping the transfer isn’t all in one direction however as I see the mentor / mentee relationship as a two-way street. If it’s all work for the mentor and no benefit then that’s not good. So I hope I can add some interest to the mix and make a difference for him also.

I’d like to thank Marisa and everybody involved for the chance to be part of the InfoSec Mentor program. If you’ve not already signed up, you should take the time to do it… you’ve got nothing to lose!

It's only just begun.....

Now that it has been a few months since the highly anticipated mentor/mentee pairing, I wanted to touch base with a few of the participants to see if the rose is still on the bloom or if the honeymoon is over. Over the course of a few weeks I’ll be interviewing both mentors and mentees and get their thoughts on the process so far. Since the InfoSecMentors program is in its infancy, this may help identify strengths and weaknesses to better improve the experience of everyone involved. Also for those contemplating joining, they will have a better idea of what to expect or what to do differently.

I’ve chosen for the interviewees to remain anonymous to both the general public reading this blog and those within the InfoSecMentor’s leadership so as to encourage more candid responses.

Sample Questions:

• Prior to being matched, had you known of your mentor/mentee either personally or through social media forums?
• Was your pairing made public on the various social media outlets?
• Were you given any “homework” or assignments to complete and did you actually do them?
• Do you feel the mentor you were paired up with was an accurate match?
• Was gender a concern when envisioning who you’d be paired with?

Stay tuned as the mentors & mentees reveal their experiences with the process thus far.

If you are interested in being interviewed, please contact me securityindepth {at} gmail or @diami03