InfoSecMentors @ BruCon 2011

Next week the InfoSecMentors team will be attending BruCon! We've been looking forward to this particular event all year because BruCon has been a valued supporter for the project. BruCon is a great conference not only because their slogan is "Hacking for Beer" but because they've captured that great balance between the black t-shirts and the suits. The trainings, presentations, and workshops are all very affordable (and a steal when you hear about the included after-party!) We're looking forward to learning a lot, meeting new friends, and drinking beer in amazing places.

This year, we're hosting a mentoring workshop on the second day. This workshop will tackle both sides of the mentoring relationship. For the mentees, we'll talk about ways to set yourself apart, how to efficiently do your homework, and what valuable benefits to expect from your mentorship. For the mentors, we'll go over different activity ideas, how to keep your mentee engaged, and the value mentors get out of the mentorship. After that, we'll put the question to the audience and try to define just what exactly counts as a successful mentoring relationship.

Our workshop panelists include David Rook (@securityninja), Chris Gates (@carnal0wnage), Wim Remes (@wimremes), and Marisa Fagan (@dewzi). We'll start at 19:30 Tuesday with a short presentation and open the floor for questions and experiences. Hope to see you there!

Exactly!

While The InfoSecMentors Project may be on a break until September, there are still plenty of conversations happening about mentoring! One blog post in particular has so correctly hit the nail on the head I wish I could copy and paste the whole thing! (But I won't. Remember kids, plagiarism is bad m'kay!)

This article comes from Ramit Sethi at iwillteachyoutoberich.com (not a security-related blog, but couldn't hurt to read it) called "Why Successful People Don't Want To Mentor You." His take is that these days so few people actually put in the work to be a good mentee that it has left a bad taste in everyone's mouth about being a mentor. So it's not entirely your fault that it is so hard to find a good mentor. Fortunately, those that really do want to put in the effort will be part of a very short list that gets catapulted to the top. Ramit explains exactly how to do just a few hours of work before you approach your ideal mentor to guarantee they will jump at the opportunity to work with you.

From the article:

• "Here is the 1-2-3 Choice Technique: “Hi Ramit, I love your book on blah blah. I noticed you said I should XYZ in chapter 5, and so I tried it. I’m stuck due to XYZ. So I’ve come up with 3 possible routes:
• blah blah1
• blah blah2
• blah blah3

Which do you think I should do?

This will get almost a 100% response rate, since you have actually done the work in your head…plus all I have to do is tell you which is best. GOOD JOB."

Brilliant!

I also thought the article had an interesting point about how as mentors we create these huge artificial barriers to intentionally make it difficult to contact us, perhaps without realizing it. Having your email address public may not be practical for other reasons, but at least consider making your LinkedIn profile public and be responsive there. And if you're a mentee, please be respectful of this direct access you have to the people in your industry. You may not realize it now but being "kooky," flakey, or lame is actually ruining it for the rest of us!

As part of the InfoSecMentors Project, I can vouch that everything in this article is true. The substantial majority of mentees are not doing the legwork, and so setting yourself apart is very doable (and totally worth it!) Look through past examples on this blog about the type of projects and jobs people get exposed to after they do the homework. Listen to the podcast at the end of Ramit's article for dozens more specific examples. Do this, and as Ramit said, "you will find people that LOVE helping other ambitious people who take action."

Good luck! (Not that you need it!)

Guest Post: Michelle Klinger "Interview with a Mentee...Mentee T"

This is the continuation in a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. Individuals have had to have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce an interview with a mentee.....Mentee T:

Q: What was your reasoning for engaging an infosec mentor that you were not able to do on your own?

A: To be honest, it was the experience really. I was looking for a way to broaden my horizons, and talk to all the people I could. I'm relatively new to the community, and one of the most important things that I've found, as well as the most rewarding, is just to talk to people. When I heard about the starting of the project, I was one of the first to pitch it to others.

Q: Prior to being matched, had you known of your mentor either personally or through social media forums? Were you hoping for someone “well known” in the social infosec social circle?

A: I was definitely aware of my mentor, and I think my mentor and I had mentioned each other on twitter once or twice, but had never actually conversed. Was I hoping for someone well known? I had no preference, really. One of the most important things about a project like this is coming into it with an open mind. Particularly as a mentee, you're really after someone who is well, smarter than you. So you have to throw out a lot of your preconceived notions and just go with the flow. (Also, wow, that was incredibly hippie-ish.)

Q: Was gender a concern when envisioning who you’d be paired with?

A: Not in the slightest. There are a lot of infosec chicks who are significantly smarter than me, and a lot of dudes who are as well. Like I said above, it was really about making the connections and conversations.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)?

A: I'm actually more active on social media than my mentor. Mentor did make a point to remind me to be careful what I say out there, but that wasn't much of a stretch more than what I already do. It's an often forgotten art, the act of not spewing every little thought on to the interwebs. Actually, if you watch my stream really closely, you'll see me tweet something, then within a minute or two, delete it after some thought.

Q: Was your pairing public via social media (i.e. Facebook, Twitter, LinkedIn) either by you or your mentor? What was the reasoning behind the decision?

A: It was actually kind of a game to see if people could figure it out. Even about 6 months or so later, once we had pretty well, if not officially ended the mentor/mentee relationship, that some folks were still trying to catch hints. But we never officially made it public. Just never felt the need, I suppose. Now, though, I wonder if that might have put some necessary pressure on the relationship.

Q: Did the initial meeting/conversation meet expectations? What did that initial communication entail?

A: The initial conversation actually threw up some red flags for me. Our initial introduction was through email (we didn't meet in person until BH/DC), and I went ahead and took the lead, since every conversation should be a two way street, by sending a few questions in my mentor’s direction. Just a few things like how mentor got 1st infosec start, what some of my mentor’s day to day duties and such are, and a few other questions just to get to know my mentor better. And while my mentor acknowledged that emails were received, I didn't receive a full response to those questions for about 2 weeks.

Understandably, that's a little rough on the start of what's supposed to be a back and forth relationship, just by definition of a mentor/mentee relationship. I understand being busy, I was in the process of writing and preparing a talk myself, but this definitely started us off on a rocky footing.

Q: Have you made any major changes or decisions based on advice or direction from your mentor?

A: Well, I'd like to say I have, since I received such advice as "Stay in school." "Don't let your ego get ahead of you." But I don't know that those are really personally specific, so I guess the answer is no.

Q: Were you given any “homework” or assignments to complete and did you actually do them? Did you see value in the tasks assigned?

A: In an odd turning of the tables, I was actually the one issuing homework. I was looking for feedback on my talks, and my topics, so I assigned my mentor to watch the recordings. However, I don't think that was ever done, so I suppose there wasn't much value from the assignment if it never got done.

Q: Do you feel the mentor you were paired up with was an accurate match?

A: That's a hard, hard question to answer. I think we had some similarities to be sure, and since I still don't have much of a direction in mind, just getting to know someone new was kind of rewarding. However, I am still definitely disappointed, thinking about what could have come out of it. Even meeting in person never lit much of a fire. This is an organic thing, it has to be nurtured and grown, which requires effort on both sides of the table. If that never happened, nothing ever grew, and then I don't know that we could call the match accurate. The important thing, though, is that I learned something from this, even if I'm not totally sure what I'm it is quite yet.

Q: If you could re-do any aspect of your interaction with your mentor to date, what would it be and why?

A: That's a loaded question, particularly after my comments above. Is there stuff that I would change? Hell yes. I'd love to have gotten to know my mentor a little better. I wish we could have shared a bit more than the IM conversations and a few hours of surface chat at BH/DC. I was in an area where I was trying to make some decisions and more than a line or two would have been greatly appreciated.

However, I don't want my story to be a discouragement. More a...disclaimer, I think. As you go into your mentorship/menteeship, be aware this is definitely a relationship. It has to be a two way street, or this isn't going to work. Take a look at your time commitments before joining the program. This whole post could have been avoided early on, if my mentor had waited until a period where mentor had a little more time on his hands. And not even a whole lot, but enough to answer an email every few days. Just something to think about…..

Looking for other mentors/mentees...If you'd like to be interviewed, please contact me at securityindepth at gmail dot com

Suggestions for getting started

One part of participating in the InfoSecMentors project is the support resources found on this blog and over emails. One email in particular goes out to potential mentors and mentees before they meet their match, giving them suggestions for how to start the process. The first step is to bridge the familiarity gap and get to know each other. I've posted this email below, in case you were one of those volunteers who received it many months ago and were looking for a reference.

Hello participants,

If you're receiving this email, it means we have received all of your application information, and we are busy making a match for you! We've had an overwhelmingly successful number of participants, and we've begun making some great introductions. In the mean time, I thought I would create a small list of activities you should expect to do during the beginning phase of your mentoring relationship.

MENTORS
-Email your mentee with an introduction to yourself. Consider including the answers to questions like "What is your favorite duty on your job?" "When are you available and where are you located?" "What was your experience being a mentee in the past?" and "What do you expect from your mentee in this relationship?"
-Decide with your mentee on a single task that you can help them with, and execute.
-Promote your relationship. With their permission, talk about your mentee on Twitter or other forums. This is to increase the mentee's personal brand, and to make it easier for them to seek help or engage the community.
-Introduce them to other people that can help with another specific issue.
-Wash, Rinse, Repeat.

MENTEES
-Create a list of questions for your mentor.
-Email your mentor with an introduction to yourself. Include information about your experiences up to this point, and what goals you have.
-After getting to know your mentor's skill set, decide on a single task that they can help you with. The more specific, the better. (Not knowing what you want to be in 5 years is fine. Start with a goal of learning about your mentor's daily job. Ask questions about their background and style of living. Then ask them to guide you through introductions to other people in different jobs. It is important to be specific and have your questions ready.)
-Keep in touch! While it usually falls on the mentor to make the connection, it is very important for the mentee to *maintain* that connection. Plan on emailing your mentor every few months after your task is completed with updates to your professional life. This will definitely pay off down the road, I promise!

MANATEES
-Continue being adorable.

When you receive your introductions tomorrow, hopefully you will be pleased, but if there is a problem, just email us and we'll make a change. Problems that may arise include schedule conflicts, ethical/NDA conflicts, or you're already best friends and don't want to "go there." No problem. Give us another chance, and please be *specific* about your goals.

And keep an eye on our blog, http://infosecmentors.blogspot.com/. We have some helpful tips, and future blog posts planned interviewing some of you on your progress!

Best of luck,

Marisa
Founder, InfoSec Mentors
www.infosecmentors.com
====================

Guest Post: Michelle Klinger "Interview with a Mentor...Mentor R"

As previously mentioned, this is the continuation in a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. Individuals have had to have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce the first interview with a mentor.....Mentor R:

Q: What was your reasoning for choosing to offer your time and energy in becoming an infosec mentor? Had you ever been a mentor before (officially or unofficially)?

A: I have been both a mentor and mentee in my career so far. I had never taken part in a formal mentoring program before but I had been “taken under someone's wing”. That person helped me a lot in my career so I wanted to give something back to someone else wanting to get into information security.

I unofficially mentor people in my current role and continue to do so, the work I do with my infosecmentors mentee is largely the same as I do with my two unofficial mentees.

Q: Prior to being matched, had you known of your mentee either personally or through social media forums? Did you request your mentee?

A: No, I hadn’t heard of my mentee Q: beforehand and I didn’t request my mentee.

Q: Was gender a concern when envisioning who you’d be paired with? Why or why not?

A: It wasn’t for me, I’ve worked with and been managed by females all through my career so I’ve never seen gender as a problem. I’ve been exposed to the struggles my own mother had through her career as a female in male dominated industries despite her knowledge and achievements.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)? Have you? Why or why not? If you have, has aided in your original goals?

A: I’m the mentor in this pairing but I suggested my mentee set up a blog which has helped build his profile in the web application security community. I also encouraged my mentee to be more active on Twitter and get involved in “conversations”.

Q: Was your pairing public via social media (i.e. Facebook, Twitter, and LinkedIn) either by you or your mentee? What was the reasoning behind the decision?

A: It was made public, by both of us. We had multiple reasons, we were happy to be paired together. I wanted to spread the message about the infosecmentors program as well. Obviously no one gets to see everything we discuss but we feel making some things public has helped, I know of people who have applied to join the program after reading about our work and pairing.

Q: For the initial meeting/conversation did you have a set idea of what you wanted to communicate regarding the mentor/mentee relationship? What did that initial communication entail?

A: I guess the fact I’m in Ireland and my mentee is in Las Vegas limited our choices when it came to communicating with each other. We have almost exclusively communicated via email, quick/small queries via DM’s and we spent a day together at DEF CON discussing future projects etc.

Q: What is your take on assigning “homework” or tasks to your mentor?

A: I am the mentor in this pairing, but if my mentee wanted to assign me “homework” I’d not be against the idea as long as they respected the fact I sometimes have no time to do this kind of work.

Q: Since your pairing, would you say that you were accurately paired with your mentee? Do you feel that you have the knowledge and skills to guide the mentee towards his/her goals?

A: Yes, definitely. I think we were are a great pairing, I felt this way just from our email conversations but after a lot of one on one discussions in Las Vegas I feel we both think alike and have the same work ethic and attitude towards information security.

Q: Would you say that being a mentor has taken up a significant amount of personal time?

A: No, if anything I sometimes feel like I should be giving more time to this but I just can’t spare much time when work and outside work projects get busy.

Q: If you could re-do any aspect of your interaction with your mentee to date, what would it be and why?

A: Probably spend more one on one time when I was in Las Vegas, given the distance between the pair of us one on one meetings are probably only going to happen once a year.

If you want to be interviewed, please contact me at securityindepth at gmail dot com

Interview with a Mentee...Mentee X

As previously mentioned, I planned on doing a series of interviews with both mentees and mentors on their experience with InfoSec Mentors to date. I tried to choose individuals that have been paired up for at least two months and I also chose to keep the participants anonymous as I thought I’d receive more honest answers, both praise and critique of the program. And with that I introduce the first interview with Mentee X:

Q: What was your reasoning for engaging an infosec mentor that you were not able to do on your own?

A: I guess my reasoning for joining the Infosec mentors is a little different to some others. I’m already in the industry and work as a penetration tester for a large bank. My goal wasn’t to get exposure, to get technical assistance or anything like that. My main issue was that I’d reached that point where I should be giving presentations and talking publicly about things I’m doing. For me that’s a hard hurdle to get over. Fear of speaking, or more aptly, fear of landing flat on my face, is my biggest issue right now. That’s something I hoped my mentor could help me with. To speak from experience about how he overcame that, and how I can start to present my research with confidence.

Q: Have you’ve ever had a mentor before? Was it organically developed or had you been a part of other mentor programs?

A: I’ve had a mentor before, but it’s been a long time since we’ve met. Since my previous mentor and I worked together at a company some years back, it was hard to keep in contact once I moved on. I wouldn’t say we came together organically as such. My previous company liked to run mentor schemes, and although we were (work) friends, I guess the program was the nudge we needed to make the agreement official. Since then both myself and my previous mentor have moved into other lines of work in other parts of the world, so it made little sense to continue the arrangement. He gave me a lot of good pointers however, and I’ll always credit him for giving me the drive to try new things and move forward.

Q: Prior to being matched, had you known of your mentor either personally or through social media forums? Where you hoping for someone “well known” in the social infosec social circle? Why or why not?

A: Funny enough, I’d met my (now) mentor a few times previously, and we were what I would consider friends. Ironically I actually joked on Twitter that I’d get stuck with him… and look what happened. I don’t regret it for a minute though, as he’s a perfect fit for what I want to improve on.

I guess I was hoping for somebody to come along who I knew and respected… and I certainly wasn’t disappointed in that respect. Not that being well known makes you any better or worse at being a mentor, but I guess I had an image in my mind of what I wanted and that went well with it.

Q: Was gender a concern when envisioning who you’d be paired with? Why or why not?

A: No I don’t think so. I don’t think gender makes a difference in the industry. A lot of people have made a fuss about gender issues in security in the last few years but I’ve never seen the issue myself. I have respect for people in this industry regardless of the age, sex, race or experience. This isn’t an easy industry to work in, so the fact they’re here and trying means they’ve earned that respect.

Q: Has your mentor suggested or encouraged you to engage in social media (i.e. Facebook, Twitter, and LinkedIn)? Have you? Why or why not? If you have, has aided in your original goals?

A: Well I was already a social butterfly… in fact I think I’m on more social networks than he is. Not sure if that’s a good thing or not ;)

Twitter has been a big part of my success and been a great way to meet people. I can’t recommend it highly enough to people in the industry, or looking to break into it. You have to be part of the conversation after all… and everybody has a point to make!

Q: Was your pairing public via social media (i.e. Facebook, Twitter, and LinkedIn) either by you or your mentor? What was the reasoning behind the decision?

A: We announced our pairing pretty quickly on twitter and on my blog. It wasn’t really a discussion to be honest, as we’ve both been on Twitter for a long time, it just seemed natural. I’ve actually seen a lot of infosec mentees creating accounts on twitter when they’ve been paired with a mentor. I think that’s a good thing as it’s a great resource.

Q: Did the initial meeting/conversation meet expectations? What did that initial communication entail?

A: I’ve had a few really good talks with my mentor and gotten a lot out of them. We initially started talking over Skype and other online channels due to the distance (I’m in Europe and my mentor is in the US). We met up face to face again at BSides Las Vegas, which was a fun trip. I think our relationship is a little unstructured at the moment, as we’re both rushing around to conferences and the like... plus the obvious time difference. Hopefully we’ll be able to get together more often online or IRL in early 2011.

Q: Have you made any major changes or decisions based on advice or direction from your mentor?

A: Not at the moment. I’m still working on a few things that should come to fruition next year. Hopefully my mentor can help me iron out the many kinks before then.

Q: Were you given any “homework” or assignments to complete and did you actually do them? What are a few examples of assignments given? Did you see value in the tasks assigned?

A: My mentor did offer something you could call homework, but due to some bad timing I wasn’t able to take him up on the offer. Still, there will be other chances to show my presentation skills I hope. My mentor has also given me a number of smaller tasks to do, usually at the last minute… still it’s all good experience. They’ve certainly helped me look differently on things and change my opinion about a few key issues.

Q: Do you feel the mentor you were paired up with was an accurate match? Why or why not?

A: I think so. We have similar outlooks on things, which is great. Plus he has the perfect skill set to help me achieve what I want out of our relationship. I’m hoping the transfer isn’t all in one direction however as I see the mentor / mentee relationship as a two-way street. If it’s all work for the mentor and no benefit then that’s not good. So I hope I can add some interest to the mix and make a difference for him also.

I’d like to thank Marisa and everybody involved for the chance to be part of the InfoSec Mentor program. If you’ve not already signed up, you should take the time to do it… you’ve got nothing to lose!