We busted a few myths. So you can be efficient in your learning because just consuming 50 books a year doesn't mean you will retain those books. There are special strategies and special things you have to do. Like quiz yourself after each chapter or go over it in like interval. So like you quiz yourself every week and then after like a month and I give, gives you that retention skills, we then kind of cover the traditional why DevSecOps and like it's shift-left security, but I like to redefine it into more of a security focused area with threat modeling and everything else in the of which is a regular work in security nowadays.
And then we went over all the beautiful certifications that you can get. Why and how GSE super expensive or totally [00:02:00] worth it and all the platforms. So for example, you should probably get a safari books online because you get all the books and then some learnings on how not to implement training in the enterprise and what actually helps.
Glenn: [00:02:12] That was a pretty succinct of what you spoke about last night. So Josh you were at the meetup last night. Did you learn anything from what Marcus said, what was your key takeaway from last night?
Josh: [00:02:23] I think one of my key takeaways was just the sheer breadth of security certifications that exist out there in the world. And just trying to make sense of that mash of everything you could possibly do into the things actually kind of bring value, looking at the most expensive for the GSE or even just the fact that every CISO on LinkedIn has a CISSP is interesting stuff to know.
Right. The fact that if you want to be a CISO that you should probably get that along the way.
Glenn: [00:02:50] Yeah, absolutely. I was overwhelmed by that slide that you showed. So just for our listeners is a slide that showed the different across the top, skill sets that you would have in cybersecurity.
[00:03:00] And then going down in levels, starting from the highest level down to the lowest level, it tells you what sort of qualifications you can have. There were hundreds, hundreds on there. You did pick out GSE Marcus just talk us through why you picked out GSE and why you think it's of great value.
Marcus: [00:03:15] So, one thing that always stands out in online learning, and this is what they found when they were like you study for AWS exams to go over like multiple platforms and everything else. And the main thing you want a recognition. And two, you want good content, right? You don't want also waste your time.
Right? Like that. That's why like SIS is controversial where it's highly recognized, but the value might not be there right. With GSE, you know, you get SANs and like SANs is super respected in the industry. Right? Every SANs instructor is like massive in the industry on Twitter is everywhere else.
They give talks. Right. You know, you're learning from the best in the industry. And they're like, eh, Reassuringly expensive . So, you know that like , there is a [00:04:00] reason for that. And it's because there's so much value and they're like super intense. They're hard to get they've been running for a long time and they didn't like lose the same prestige.
Like there's still a limited amount of people who have it and like getting GSE. Is not just money, but it's the effort you have to put in. So , it really shows that you really went out there to become that professional and to, to mean something. And you have to write two goals, like what they have goal the standards, which is you have to get two papers written and peer reviewed if you want to actually get it.
So it's not enough to just write, to get the certs. You also have to be good at writing and proper security research. So yeah, like that's really established as your name.
Glenn: [00:04:44] Yeah, definitely.
MM: [00:04:45] Do you know anybody?
Marcus: [00:04:46] I don't know personally anybody, but I follow quite a few. So, because I think it's very US-based so like a lot of the training and whatnot, and now it started a little bit to be more in London.
But yeah, like it's [00:05:00] relatively very US focused. Like if you go to a lot of the conferences , you usually can get a sidetrack, with SANs to get certified on those.
MM: [00:05:08] So in your talk last night, Marcus there was a slide that covers what works? So you talked about sleeping retrieval practice, spacing out your learning and et cetera. What's, what's your routine with continuous learning or education?
Marcus: [00:05:23] So something, I didn't actually cover on the, on the talk was I do a lot of language learning as a, my spare time thing.
So I learned like security learning is one, one of the chapters, but something I really like is essentially having every day. I tracker where you do a little bit. So for example, I have Duolingo and I almost have now 900 days of learning Spanish on Duolingo. And it really reinforces that like, if you do it every day and you have that streak mentality, Like at some [00:06:00] point that's three is like, like some days are just like, don't even want to put in those five minutes, but you still march through the pain, just because like the streak has been so long, you don't want to lose it.
So if you really want to anchor some particular goal, I find streaks very helpful. But otherwise it's always sleep. Like I cannot do any work. I cannot do anything. I found sleep to be the most effective one. I don't do that much coffee or anything else. It's mostly sleep. I take some notes after I read something.
So I have that captured and then I do quizzes. So, eh, if you want, like, like there was at the end of the Gathering, some people ask for like some software recommendations. So like I use obsidian, which is a settled task and methods kind of thing. I don't use the full task as much. I just like it as mark done that the third and another approach is you can also use a software called
Which essentially creates flashcards. So if you were particularly studying for something like CISSP, that's probably the place where you'd really want [00:07:00] those, because there's like specific terminology of that you want to just recall on demand.
Glenn: [00:07:05] And Josh, is that similar for you as well? Do you study in a similar way or did you have a different approach?
Josh: [00:07:10] Yeah, similar, interestingly, my 300 odd day of Dutch on Duolingo. I lost it like three days ago. So that's quite hilarious that I realized, wow, this was a 900. Yeah. I often find, I try and learn some normally I'm trying to learn something applicable to what I'm trying to do right now. So it's only finding that spot to apply it right then and there.
I mean, I have an iPad with an apple pencil that I bought a couple of years ago that I write all my notes on after moving on from pen and paper, because I wanted them digitized. And so I can get different colors and do all that kind of stuff. But I've found that if I don't write notes, I don't retain.
Anything. And if I type it, it's nothing I have to actually physically write to retain. So I think it's sometimes just finding that style or that trick that works for you. That helps you to remember things like my wife needs to talk [00:08:00] about it. Otherwise it's in one ear out the other. So when she's studying, like we talked through things a lot and stuff like that.
So, but for me, it's all about writing at the end of the day.
Glenn: [00:08:09] That's interesting because in the presentation last night, Marcus, she showed us the pyramid where at the top of it, I think it was 10%. Of your ability to retain knowledge is through reading and at if the extreme end is 90% of your organizations retain knowledge is through teaching. And I think that pretty much sums up what Josh has just saying.
So when you're writing you're, explaining it again. You said you explain it to your wife as well, and you get that type of Like but it's it's to show someone else how it's done. And I think that's possibly the best way of doing it, you know , but for me, when I saw that pyramid, I think every level is important.
You're reading, listening, visuals, all that sort of stuff. I think you'll find your, find your niche in that.
MM: [00:08:53] How would you squeezing the small chunks of education for out your busy day? Is it [00:09:00] crack of Dawn? Your first hour that's that's when you do it, or is it after a very busy day at work.
Marcus: [00:09:06] So it's usually depends because I don't, I have like a variable wake-up schedule . So I go to bed and it might be six hours of sleep.
It might be eight hours of sleep. I just have an alarm like set there on nine where I know I have to like wake up for my standup team skull. Right. But. Like I usually wake up around eight or seven. If I get gain that additional hour, I will try to put it back in the morning because I like to just get it out, particularly if it's not something that I'm just keeping up my streak.
If it's something like Duolingo, I just do it whenever I have like some downtime, like something boring is happening and just real quickly, just go on my phone, do it. If it's something intense, I will do it both in the morning and in the evening because like OSCP, for example, I try to do the labs, like a lot, like two, three, four hours until I finished the lab.
MM: [00:09:59] What [00:10:00] about you, Josh? What's what's your routine?
Josh: [00:10:02] Idealize the idea of getting up and working before work starts, but I'm, I feel at this point, I'm genetically predisposed to being a night owl. I try and use Pomodoro technique to try and get, do 50 minutes on 10 minutes off. If it's something deep and try and listen to music with no lyrics in the background and try and block out all noise and try and focus.
What I've been trying to do more recently is scheduling. Times specifically to do things. And I think once the world gets more back to normal and we're not all working remote, it needs, it will need more structure than, as we all have to go back to community and everything else. And kind of the free time that we've enjoyed maybe a little bit more during the pandemic or go away.
So sometimes there's a restructuring going no tonight is I'm focusing on this and, you know, just trying to keep yourself accountable to it, I think is the important part.
Glenn: [00:10:55] So do you think during this pandemic that there that people are taking opportunity to learn more, [00:11:00] to recognize that they were going to come out of this pandemic with more qualifications or qualified people?
Josh: [00:11:05] I think it will be either extreme.
Like some people have gone hell to leather on picking up every cert they can under the hood and some people, just the nature of what they've needed to do that work-life balance. Everything else has caught on during the pandemic. Some people just haven't had the mental space to pursue anything as well.
So things will be kind of, I don't think we're many people in the middle ground. I think we'll leave that be people have gone. Absolutely. You know, to the wall, with everything they could do or they'll have done. Not that much. Cause they know they've needed to focus on other things and at different priorities.
MM: [00:11:38] Which type of person are you,
Josh: [00:11:40] Yeah, I definitely done too much. I think. Signed up for a lot of stuff with, I think what 10 conference talks this year, writing a book, multiple blog posts only once, only one certification this year so far, but I've got like three others book 10 for later in the year.
I have to somehow study for as well. So I don't advocate that people [00:12:00] work like me. I'm very privileged to have the opportunity and the time to do what I do. It's not for everyone for sure.
MM: [00:12:07] Marcus I understand it's your recertification year . So it's a bit crazy for you as well, right?
Marcus: [00:12:13] Yeah. It's because all my Kubernetes, certs it's, all my AWS servers have expired. And I was like, well and I didn't manage to get the OSCP. I was like, oh, well this is going to be a very busy year.
So I, also want to go back into more into Azure. Because I had the opportunity to work with it. And there is a lot of work and identity space and whatnot nowadays with the clients. So I fought to get all of those. So I got my essay pro I got my security specialty on AWS, and now it's onto Kubernetes and then Azure, and then OSCP at the end too.
And then I can celebrate that. It was a very productive time. I went through one that
MM: [00:12:55] says after your name, And have [00:13:00] you attempted the new CKS?
Marcus: [00:13:02] No. So that that's on my roadmap. Now I have the training. It's nice to see how they're being improving because I was the beta tester for CKA and I, that was kind of a rough of course, and like taking the exam experience and now it's a lot more polished.
I just wish they were. More real life as a, nobody really spins up a Kubernetes from scratch Kubernetes. The hard way is please leave that to Kelsey Hightower. Most people probably use EKS and they cast. Right. Okay.
MM: [00:13:36] So, so last night during the meetup one of our attendees spoke to us wanted to understand a bit more about.
DevSecOps training. I guess it not everybody really understands or have different definitions and interpretation of DevSecOps the title of your, of, of your talk last night from zero to DevSecOps hero. Do you think if you had a bit more time would [00:14:00] you include other aspects of training.
Marcus: [00:14:03] Yeah. So something that really came up that I definitely kind of just forgot and properly. Got it. As a given like people's skills and emotional intelligence and all of those are a big component to be successful. There is almost nobody at the top at the top level. That's like a hero. That doesn't do public speaking or write, or just can communicate well and is respected in the industry.
That's like a very critical skill. And that you'll learn like, as you grow, like managing a team and everything else the water aspect was. To kind of set what is really required from skills. Right. I wanted to kind of see, do a little bit more, like, let's say we wanted to hire you as a DevSecOps engineer and container.
Right. What skills are those required? And that kind of goes into, well, do you know Terraform? Do you know what shift left security is? Can you built in all this beautiful tooling? On the [00:15:00] left, those are kind of the core skills. And then you need to know some threat modeling and being just savvy about security, Sao understand like what architectural decisions are happening, how they can actually impact, right?
Like you are not implementing SDP policies. You don't means you don't have any guard rails. You now have to trust people. They don't open up public as free bucket. So that's kinda where I wanted to take it. But my. Like I have watched a lot of talks on YouTube on like different ways, how, how to like break in into security.
And there's like this two world apart situation where DevSecOps is very much Of evolution of dev ops, right? And it's those same people, pretty much just gaining some security skills and adding that on top. The approach I want to take, which is hopefully like more new and fresh to it is that I want to take security people.
And bring them to dev ops because that's what I been trying to do for the past [00:16:00] year is that like people from security side probably don't know anything about CICD. They don't know a lot of these things, but they bring a wealth of knowledge about the sock, about the threat hunting and everything else. And if you ask your of the mill.
Person who does like Jenkins CICD and you tell them like, well, what are apt threats? They're like, what APT is that? Like, you know, Debian thing to install packages. So that's kind of where we are. Right.
MM: [00:16:31] That's good. The points you bring up seems to me, very platform, infrastructure bias.
What about the application security code angle? What's your, what's your view on that?
Marcus: [00:16:44] So that that's probably like just shows where my, most of my work is being done is building platforms, landing zones, Kubernetes clusters. And I kind of come from a CIS admin background, even though I wanted to become a Ruby on rails developer in a past life.
So there a [00:17:00] little bit of that But I think the main, the main bit is that empathy to developer that's obviously always missing . It is its own involved, big area of, it sounds like secure coding and what actually secure coding is because there's always so many false positives from something like a Fortify or anything else.
And it's always hard to navigate and having that empathy that you ordered, all the stooling on the left and you got like, you're breaking the pipeline because. Something light it up like a Christmas tree, and you're just stopping that develop, like you're stopping someone's feedback loop . But yeah.
Security is a big end. Like maybe once I get into that more, what I'm sure Josh has a vague opinion about self software application security.
Josh: [00:17:45] I guess the bit on the platform side, the I see the value in is really at the end of the day, your application, you should assume your application is insecure.
Just that should be your baseline assumption. No one has perfect security. That's [00:18:00] kind of a given. So the platform side is your cap capping your risk on that one breach doesn't become. I breach everywhere. And that just getting through one application bearing in mind that there will be holes and you should, it's a matter of when not if that you can at least try and control the blast radius.
The, when something does happen on the application side, it gets very hard. I think the pressure comes on developers to deliver features and often they just can't see. The security angle. They don't have the right lens to look at what they're doing from a security perspective. It's very much changing that security notion from a custodial guardian of everything that happens to enablement and drawing a look at the team.
And how do you get the developers? They're not going to become security experts. That's not a realistic expectation, but how can you make it so they can at least see things the right way, whether that's threat modeling, whether it's security, chaos, engineering, whether it's. [00:19:00] You know, just sitting with them and the empathy side of things, which I think is so critical, but at the end of the day, yet the tooling and the software space, when you look at it is always incredibly expensive and it is honestly out of the reach for the, for the top quality, totally out of the reach of most companies to really go for, unless you're an enterprise, but a startup isn't going to pay you for a lot of them because they just can't afford it.
It's more, it's like the equivalent of 10 developers, you know, kind of realm. So it gets really difficult.
Glenn: [00:19:33] That's where education is important because you know, the tooling side of it is very expensive. And, and there are other ways of actually introducing security into applications without going through the, the, you know, the procurement process, you know, writing your own unit tests, for example, about certain security aspects, you know, like free validation, for example you know, these are free to do just a little bit of time and extra time to do stuff, but.
Education is important. You know, developers need to [00:20:00] understand how to write good code, how to write secure code. And that's probably cheaper to do than to bring in tools to support them.
Josh: [00:20:08] Yeah, I think the cultural piece, like culture is dictated by action, not words. So getting the company to invest real time, money, and effort into things like one of the conference talks, I.
Do is from when we did a security, chaos engineering at a consultancy. We took everyone off client for a day in order to do that. So our revenue for the entire business was zero pounds for a day. And that was how importantly we took security and how we were going to invest in that. And that really paid dividends over the long term.
What I've had to. Kind of the question from that talk before has been, you know, how do you get your company to do this kind of thing? How'd you get them to invest in them? Why? Well, if they're not willing to invest that kind of scale, then how does it, how do they expect you to really care about [00:21:00] security?
If you're unwilling to take time off delivery, to give your teams the ability to invest in those skills, you can't expect Goodwill and free time to make up for it. All right. And really taking two days off to do game days and that kind of stuff. Really shouldn't be the end of all on delivery. Otherwise you've got other problems as well, but generally it shouldn't be something you can do.
MM: [00:21:22] Who should take responsibility of training individuals, the business educational establishment, such as universities and colleges.
Marcus: [00:21:31] Going into colleges and universities. That's like always a difficult thing, right? Because you go into the wall while universities are for getting PhDs and teaching for those, right. They're not preparing you for work. Obviously it depends on the university and that that's been changing.
Like I had a. Relatively decent one for when we were like learning Android development. And those are like, were real skills. I called reuse later, but that's not always the [00:22:00] case. There's all, it's also kind of lagging quite often. Like my security skills were like going over something like John, the ripper, like not that many people use John the ripper in their security gigs these days, please, from my experience I think it she'll be that someone she'll set the pattern as in.
This is the budget. This is how you do it and make sure it's self service. So people can just go and then decide where they want to go and build a community around it. Trying to do it via HR that does, like, I never saw a successful HR platform that created good training modules. It only was ever good.
If that was done through the community and it was just bubbling up to HR and they got those requirements. Otherwise you're trying to show her and people to, oh, you just like to go, Joe, let's say you want to switch. You're now assist admin on prem in the enterprise and you want to become a cloud [00:23:00] engineer.
They will just say, well, do those two AWS certifications and make sure you can do this. And then you can do it. That's not really realistic. And doesn't teach you the correct skills. Like there are proper learning paths and a lot of gotchas, and you need that detail when you're learning.
It cannot be just fully get on AWS as a pro. And you're a cloud engineer. Like life is a little bit more complicated.
Josh: [00:23:24] I think universities can make it hard sometimes because we already see it. And it sometimes there's like a bit of a lead CISM around computer science degrees, like, oh, in order to be a proper software engineer, you have to have a computer science degree.
I have one. I don't know how much you is nowadays. Like day-to-day sometimes I talk about big O notation to people and they look at me confused. I'm like, okay, well, you know, the rest of it was, it was fun to do, but I think it's important that it's digestible in the way and something that everyone can do.
And there aren't all these barriers to entry for people. Another bit is making [00:24:00] sure that the technical leadership in the company really invest in values. Training and kind of values where the company is going to be in six or 12 months. So for where it is today and helps grow that out and leads from the front with that.
Yeah, I don't think leaving it to HR, HR, can't give you the right direction on where you should grow because they don't know. They can only parrot back what they've been told by other people. Cause generally they don't have the technical skills, but I think it, it sits with the leadership of the management and the technical function to go.
It's their responsibility to help people grow. If they're not doing that, something needs to fundamentally change their like Marcus and IBOs on our engagements, we help try and grow the more junior members on the team. We work with them on areas of growth they outline or where we think they should go.
And all that kind of stuff and try and help them plan out what they're going to do and how they're going to spend the learning and development budget that we have at our container. [00:25:00] I think generally what happens is when people get involved with me, they use up all their budget very quickly because I keep pushing them to do it.
Cause I'm like, you should invest in yourself. Whereas sometimes the pressure of a client engagement can sometimes make people forget about it or the like all, but I'll do that in a month. It's like, it's going to be just as busy in a month. Just take the time and make sure you invest in yourself.
MM: [00:25:20] So it, it requires a lot of self-motivation and focus in terms of knowing what to study and then studying, absorbing them, putting that knowledge into practice so that you reinforce that those lessons. I guess some people would find that quite challenging. Any advice on how to overcome some of these challenges?
Marcus: [00:25:43] So I think the main one is one of the best things. The way I learn, particularly if you want to study for a particular exam is do some very basic research and properly essentially type in, in Google. I [00:26:00] passed and then exam name or my review of some exam. You will see how people studied and what was successful and particularly focused there.
Like now subreddits like AWS certifications, or there was CP one where you can go and people are say, Well, I passed or I failed those full failed are also very useful lessons. Right? Learn from other people failures, because it's very expensive to commend those failures. Right. It's like it's time and money.
If you're trying to like commit to all the same mistakes everyone else already did. Right. So there's a lot of learning there. The water births. Just talk to someone who actually did it to people for you look up to that kind of helps. For example, if we continue now, we have channel called practice learning.
And when someone wants to learn something or get some feedback, there might be someone for, I already did CISSP. For example, you have to be referred to get your system by someone. And like you have someone in the business it's amazing, [00:27:00] right? Like you, that feedback cycle is so much faster and you can say.
Well, is that a, you dummy course actually good, because like you, the is famously like a lot of variability in quality of courses and you can just go and find something useful that people actually tried out and like personal recommendations are always better than like, you know, reading those five star reviews that probably were paid off.
Glenn: [00:27:25] I think Josh you said earlier about you know, the education piece. So I said that is a computer science degree. There's a bit of snobbism around it, but you found it. It was actually not, not all that great value in the professional world is, is that mean that there's a misalignment really between universities and the real world and, and really the responsibility should be on the universities to start working very much with professional industries and start to.
Start to create better degrees for their students. So when they did come out of university, they have the skills to, pass on to those that need it.
Josh: [00:27:56] I think so. Yeah. I did do some guest lecturing at the [00:28:00] university. I went to a couple of years after I left and I went, I did like a tutorial for some masters level. Computer science students. And they started talking about Linus Torvalds, and they didn't know who I was talking about. I'm like, okay. All right.
Let's just step back. One, couple of steps here and go, okay. You know, Linux that you use, the guy who made that. Okay. Now we can continue. And it was just a bit of a you know, a bit of a gap there, like, as Marcus said earlier, like universities generally have the academic focus and. Also expecting it to take three years to be a developer.
If you're studying, full-time seems a lot to me, your universities co could do more. And I think they are trying to do more. I think all the coding, boot camps and other things around the space have, are disrupting them in that space. Which is nice to see. Yeah, they should hopefully get more professionals in and rotate more through and have closer alliances with the bigger [00:29:00] tech firms in the space and make sure they're coming through and giving that, you know, a real world experience versus the theoretical computer science stuff, like learning Lambda calculus is a lot of fun.
You're not going to use it on a data that, well, I know some guys , but apart from them, no one else is going to kind of make use of that on a day-to-day basis. Right.
Glenn: [00:29:19] Yeah. And I was going to point out there is that if you going to become a doctor, you'd have to go through a, an education process starting at university and working your way through which some of it is also involves practicals. And then you, once you've gone through that, it could be many years you're let loose on your patients.
Do you think that. In some respects, computer engineering for those high levels needs to follow the same path, particularly if you're going to be working in, like, for example, a lot of health care. Look what happened in Ireland last week, for example, where the our health system is brought down to his knees by ransomware.
Does that mean that we should start thinking about. If you're going to work in a hospital, working in it, you need to [00:30:00] be at a certain level with your knowledge of engineering, security and so forth before you can even take on those roles is you reckon that that could be a way forward to, to protect our most critical assets within that countries?
Josh: [00:30:12] I think potentially I think one of the things that annoys me a lot in the it industry generally is a level of hubris that exists with a lot of, a lot of people. People think they can do things amazingly themselves all the time. And sometimes it's, you know, when that, one of the big things about going to the cloud is effectively, you are monetizing your security cost versus a lot of other people and ads can do a better job of security.
Then you can, for example, and just building, you know, realizing that. Over time as we kind of mature the industry, more stuff will be taken care of. And we're always going to be focusing higher up the stack. I think a lot of the time people still have this data center mentality and they're like, oh no, we can do this all ourselves.
[00:31:00] I he's like, yes, you theoretically could, is it right for the business? No. Is it right for your sanity and mental health? No. So how about we kind of move forward with this and I'm sure once me and Marcus get older, we'll probably turn into the old guard that I like know back in my day, we did it this way and it was fine, but hopefully as an issue of getting a little bit more used to the fact we've got to move with the times a little bit, you know, really the end of the day, it's hard to.
With all the ransomware stuff that is going around, it's hard to stop these kinds of new threats and everything else and make sure that you're completely on top of things. But I think it just means you've got to invest more and I don't think. I don't think you can just train people up to being able to do that is really getting practical and hands-on, and that's where game days.
And you know, some of the more practical certifications where it isn't just multiple choice, really start to actually have a lot more value, like the OCP, where you have to actually hat boxes to do that. That's where [00:32:00] exams should be going. Not which of these four choices. I shouldn't be able to get 25% on an exam if I don't know anything about the topic, which the multiple choice lets you do at the moment, which has a bit of a problem.
Glenn: [00:32:11] Gone quite deep there with the last two questions. So let's lighten the tone a bit. I think so there was a question that came up last night. What's what's so good about cats.
Marcus: [00:32:23] So I always found like I go to a lot of meetups. I watch a lot of talks. It is a time investment for both me making it and also for people watching it. Right. It's making a talk, takes a lot of research, a lot of things, kind of trying to make it succinct and whatnot. Right. So on for me, when I make my slides, I like to go and like, Like if I get bored or like, I don't find something, I just go look at some memes for five minutes and I find the perfect meme for that slide.
And then like, I go and continue my work. The other bit. I found that there now, particularly in logged down, [00:33:00] people being creative and like recording videos when they do give, they give their talks or like, you know, and that kind of Like pre presenter mode. But like the most thing is like, it's 45 minutes, right?
You it's, I want you to be engaged. Most people kind of zone out after 25. So if you don't keep that engagement and maybe that you already know that content, so you need something to keep your attention and they find, find gifts and cats and everything else. I do have water kind of slides where it's like be could choose or something else or.
But like, yeah, ha having some FIM to keep it light because people sometimes get too serious about these things. And like, this is like, this is a privilege to be working in this industry and you we'll have fun.
Glenn: [00:33:47] I saw, I agree with that. Totally because. Education should be fun. And what you were doing last night was educating the attendees, and it should be fun.
It should be something that you engage with throughout the whole 45 minutes. And not just [00:34:00] for the first time in five, 10 minutes, it's, you know, and, my personal philosophy is that education should be more fun. Shouldn't be that you know, that Victorian style of teaching that we have.
Go through school. Now we have a teacher at the front and pupils sitting there. They're like stone face, listen to their teachers. Talk about, you know, certain stuff. I, I, I, I think it needs to be more fun. So that was quite good to see last night. .
MM: [00:34:23] Is there anything else you guys want to share with our listeners?
Marcus: [00:34:27] I think the main one for me done, done stop learning. Like if you didn't get into it eh, go do it. And whatnot, because it is warfare particularly like there is a lot of ladders to climb in it. And a lot of side ladders, you can move too. So there's a lot of opportunity, particularly if that's something you want.
And it's always just like, like it's such a vast industry. Like I subscribe to multiple blogs and multiple newsletters. I kind of learn that. Well, I won't be able to let her know all the [00:35:00] things, but I can learn a few. And it's still very rewarding because there's so many interesting areas you can get into, right?
Like if you want, like, particularly right now, Like I remember when I was trying to study like some maths, right. There was no Khan academy back in the day, and now there's so much like not learning. Now. I remember when like they announced Coursera and Mitacs and other X. Right. You can go to Harvard lectures for free.
This has not been possible before. Like people traveled all around the world to get in. And it was like a massive thing. Now you have full curriculums available for you. And people just cannot be bothered because like, I don't want to. And not, there's just not that culture. Like, because everyone got burned by school and university, it feels like they didn't have those kinds of.
Role models Snyder from like for all their life. And they don't understand that there is actually amazing [00:36:00] engaging content from YouTube to MOOCs, to everything else.
Josh: [00:36:04] Yeah, I think just piggybacking off of mortgages, I think there's two things. One is that don't let high school English burn you out on reading. I think so many people, they enjoy reading when they're kids, they go through high school. By the time they get round to the other side and then through university, like I, they can't stand reading anymore and they kind of lose the practice.
I think even I had quite a few years in the wilderness on that ride. I did, I barely picked up a book for years. And then I kind of learned to love reading again, all of a sudden I can't stop and that's been really impactful. I think the other one is don't disregard the impact of the compounding nature of marginal gains.
Even if you're just improving 1% a week, when you start compounding that over a year, that's a massive difference, right? It's not that you have to take these huge swaths in huge learning and throw all your time away into it. Even just finding an hour or two a week to invest [00:37:00] starts to really add up over the longterm.
In a way that is not always so obvious in the first instance.
MM: [00:37:06] That's a very good tip. I like that. I also liked the saying that you quoted from sir Richard Branson last night, Marcus train people well enough. So vacant leave, treat them well enough. So where you don't want to. That's brilliant.
Marcus: [00:37:23] Yeah. That, that, that, and that's kinda, you will see when you have juniors to seniors and you, if you. Seeing the business, people who like stayed for a long time, like, you know, that like the business is investing usually particularly if they get, like, if you, because I had the pleasure of seeing some who like, just what learning their first Terraform, how to launch it, that were not sure, like they were fearful of releasing to prod.
And now they're the person to go to because the business invested into them. Right. And like, that's a massive, [00:38:00] like, it's very impressive to see and they don't leave because they recognize, right. Like if you got promoted from junior to senior, you kind of understand, well, there, there is like a future year.
MM: [00:38:11] Super great. Well, thank you for coming on to this episode, Marcus and Josh. Appreciate it.
Marcus: [00:38:19] It's been a pleasure.
Josh: [00:38:21] Thanks for having us.
And then we went over all the beautiful certifications that you can get. Why and how GSE super expensive or totally [00:02:00] worth it and all the platforms. So for example, you should probably get a safari books online because you get all the books and then some learnings on how not to implement training in the enterprise and what actually helps.
Glenn: [00:02:12] That was a pretty succinct of what you spoke about last night. So Josh you were at the meetup last night. Did you learn anything from what Marcus said, what was your key takeaway from last night?
Josh: [00:02:23] I think one of my key takeaways was just the sheer breadth of security certifications that exist out there in the world. And just trying to make sense of that mash of everything you could possibly do into the things actually kind of bring value, looking at the most expensive for the GSE or even just the fact that every CISO on LinkedIn has a CISSP is interesting stuff to know.
Right. The fact that if you want to be a CISO that you should probably get that along the way.
Glenn: [00:02:50] Yeah, absolutely. I was overwhelmed by that slide that you showed. So just for our listeners is a slide that showed the different across the top, skill sets that you would have in cybersecurity.
[00:03:00] And then going down in levels, starting from the highest level down to the lowest level, it tells you what sort of qualifications you can have. There were hundreds, hundreds on there. You did pick out GSE Marcus just talk us through why you picked out GSE and why you think it's of great value.
Marcus: [00:03:15] So, one thing that always stands out in online learning, and this is what they found when they were like you study for AWS exams to go over like multiple platforms and everything else. And the main thing you want a recognition. And two, you want good content, right? You don't want also waste your time.
Right? Like that. That's why like SIS is controversial where it's highly recognized, but the value might not be there right. With GSE, you know, you get SANs and like SANs is super respected in the industry. Right? Every SANs instructor is like massive in the industry on Twitter is everywhere else.
They give talks. Right. You know, you're learning from the best in the industry. And they're like, eh, Reassuringly expensive . So, you know that like , there is a [00:04:00] reason for that. And it's because there's so much value and they're like super intense. They're hard to get they've been running for a long time and they didn't like lose the same prestige.
Like there's still a limited amount of people who have it and like getting GSE. Is not just money, but it's the effort you have to put in. So , it really shows that you really went out there to become that professional and to, to mean something. And you have to write two goals, like what they have goal the standards, which is you have to get two papers written and peer reviewed if you want to actually get it.
So it's not enough to just write, to get the certs. You also have to be good at writing and proper security research. So yeah, like that's really established as your name.
Glenn: [00:04:44] Yeah, definitely.
MM: [00:04:45] Do you know anybody?
Marcus: [00:04:46] I don't know personally anybody, but I follow quite a few. So, because I think it's very US-based so like a lot of the training and whatnot, and now it started a little bit to be more in London.
But yeah, like it's [00:05:00] relatively very US focused. Like if you go to a lot of the conferences , you usually can get a sidetrack, with SANs to get certified on those.
MM: [00:05:08] So in your talk last night, Marcus there was a slide that covers what works? So you talked about sleeping retrieval practice, spacing out your learning and et cetera. What's, what's your routine with continuous learning or education?
Marcus: [00:05:23] So something, I didn't actually cover on the, on the talk was I do a lot of language learning as a, my spare time thing.
So I learned like security learning is one, one of the chapters, but something I really like is essentially having every day. I tracker where you do a little bit. So for example, I have Duolingo and I almost have now 900 days of learning Spanish on Duolingo. And it really reinforces that like, if you do it every day and you have that streak mentality, Like at some [00:06:00] point that's three is like, like some days are just like, don't even want to put in those five minutes, but you still march through the pain, just because like the streak has been so long, you don't want to lose it.
So if you really want to anchor some particular goal, I find streaks very helpful. But otherwise it's always sleep. Like I cannot do any work. I cannot do anything. I found sleep to be the most effective one. I don't do that much coffee or anything else. It's mostly sleep. I take some notes after I read something.
So I have that captured and then I do quizzes. So, eh, if you want, like, like there was at the end of the Gathering, some people ask for like some software recommendations. So like I use obsidian, which is a settled task and methods kind of thing. I don't use the full task as much. I just like it as mark done that the third and another approach is you can also use a software called
Which essentially creates flashcards. So if you were particularly studying for something like CISSP, that's probably the place where you'd really want [00:07:00] those, because there's like specific terminology of that you want to just recall on demand.
Glenn: [00:07:05] And Josh, is that similar for you as well? Do you study in a similar way or did you have a different approach?
Josh: [00:07:10] Yeah, similar, interestingly, my 300 odd day of Dutch on Duolingo. I lost it like three days ago. So that's quite hilarious that I realized, wow, this was a 900. Yeah. I often find, I try and learn some normally I'm trying to learn something applicable to what I'm trying to do right now. So it's only finding that spot to apply it right then and there.
I mean, I have an iPad with an apple pencil that I bought a couple of years ago that I write all my notes on after moving on from pen and paper, because I wanted them digitized. And so I can get different colors and do all that kind of stuff. But I've found that if I don't write notes, I don't retain.
Anything. And if I type it, it's nothing I have to actually physically write to retain. So I think it's sometimes just finding that style or that trick that works for you. That helps you to remember things like my wife needs to talk [00:08:00] about it. Otherwise it's in one ear out the other. So when she's studying, like we talked through things a lot and stuff like that.
So, but for me, it's all about writing at the end of the day.
Glenn: [00:08:09] That's interesting because in the presentation last night, Marcus, she showed us the pyramid where at the top of it, I think it was 10%. Of your ability to retain knowledge is through reading and at if the extreme end is 90% of your organizations retain knowledge is through teaching. And I think that pretty much sums up what Josh has just saying.
So when you're writing you're, explaining it again. You said you explain it to your wife as well, and you get that type of Like but it's it's to show someone else how it's done. And I think that's possibly the best way of doing it, you know , but for me, when I saw that pyramid, I think every level is important.
You're reading, listening, visuals, all that sort of stuff. I think you'll find your, find your niche in that.
MM: [00:08:53] How would you squeezing the small chunks of education for out your busy day? Is it [00:09:00] crack of Dawn? Your first hour that's that's when you do it, or is it after a very busy day at work.
Marcus: [00:09:06] So it's usually depends because I don't, I have like a variable wake-up schedule . So I go to bed and it might be six hours of sleep.
It might be eight hours of sleep. I just have an alarm like set there on nine where I know I have to like wake up for my standup team skull. Right. But. Like I usually wake up around eight or seven. If I get gain that additional hour, I will try to put it back in the morning because I like to just get it out, particularly if it's not something that I'm just keeping up my streak.
If it's something like Duolingo, I just do it whenever I have like some downtime, like something boring is happening and just real quickly, just go on my phone, do it. If it's something intense, I will do it both in the morning and in the evening because like OSCP, for example, I try to do the labs, like a lot, like two, three, four hours until I finished the lab.
MM: [00:09:59] What [00:10:00] about you, Josh? What's what's your routine?
Josh: [00:10:02] Idealize the idea of getting up and working before work starts, but I'm, I feel at this point, I'm genetically predisposed to being a night owl. I try and use Pomodoro technique to try and get, do 50 minutes on 10 minutes off. If it's something deep and try and listen to music with no lyrics in the background and try and block out all noise and try and focus.
What I've been trying to do more recently is scheduling. Times specifically to do things. And I think once the world gets more back to normal and we're not all working remote, it needs, it will need more structure than, as we all have to go back to community and everything else. And kind of the free time that we've enjoyed maybe a little bit more during the pandemic or go away.
So sometimes there's a restructuring going no tonight is I'm focusing on this and, you know, just trying to keep yourself accountable to it, I think is the important part.
Glenn: [00:10:55] So do you think during this pandemic that there that people are taking opportunity to learn more, [00:11:00] to recognize that they were going to come out of this pandemic with more qualifications or qualified people?
Josh: [00:11:05] I think it will be either extreme.
Like some people have gone hell to leather on picking up every cert they can under the hood and some people, just the nature of what they've needed to do that work-life balance. Everything else has caught on during the pandemic. Some people just haven't had the mental space to pursue anything as well.
So things will be kind of, I don't think we're many people in the middle ground. I think we'll leave that be people have gone. Absolutely. You know, to the wall, with everything they could do or they'll have done. Not that much. Cause they know they've needed to focus on other things and at different priorities.
MM: [00:11:38] Which type of person are you,
Josh: [00:11:40] Yeah, I definitely done too much. I think. Signed up for a lot of stuff with, I think what 10 conference talks this year, writing a book, multiple blog posts only once, only one certification this year so far, but I've got like three others book 10 for later in the year.
I have to somehow study for as well. So I don't advocate that people [00:12:00] work like me. I'm very privileged to have the opportunity and the time to do what I do. It's not for everyone for sure.
MM: [00:12:07] Marcus I understand it's your recertification year . So it's a bit crazy for you as well, right?
Marcus: [00:12:13] Yeah. It's because all my Kubernetes, certs it's, all my AWS servers have expired. And I was like, well and I didn't manage to get the OSCP. I was like, oh, well this is going to be a very busy year.
So I, also want to go back into more into Azure. Because I had the opportunity to work with it. And there is a lot of work and identity space and whatnot nowadays with the clients. So I fought to get all of those. So I got my essay pro I got my security specialty on AWS, and now it's onto Kubernetes and then Azure, and then OSCP at the end too.
And then I can celebrate that. It was a very productive time. I went through one that
MM: [00:12:55] says after your name, And have [00:13:00] you attempted the new CKS?
Marcus: [00:13:02] No. So that that's on my roadmap. Now I have the training. It's nice to see how they're being improving because I was the beta tester for CKA and I, that was kind of a rough of course, and like taking the exam experience and now it's a lot more polished.
I just wish they were. More real life as a, nobody really spins up a Kubernetes from scratch Kubernetes. The hard way is please leave that to Kelsey Hightower. Most people probably use EKS and they cast. Right. Okay.
MM: [00:13:36] So, so last night during the meetup one of our attendees spoke to us wanted to understand a bit more about.
DevSecOps training. I guess it not everybody really understands or have different definitions and interpretation of DevSecOps the title of your, of, of your talk last night from zero to DevSecOps hero. Do you think if you had a bit more time would [00:14:00] you include other aspects of training.
Marcus: [00:14:03] Yeah. So something that really came up that I definitely kind of just forgot and properly. Got it. As a given like people's skills and emotional intelligence and all of those are a big component to be successful. There is almost nobody at the top at the top level. That's like a hero. That doesn't do public speaking or write, or just can communicate well and is respected in the industry.
That's like a very critical skill. And that you'll learn like, as you grow, like managing a team and everything else the water aspect was. To kind of set what is really required from skills. Right. I wanted to kind of see, do a little bit more, like, let's say we wanted to hire you as a DevSecOps engineer and container.
Right. What skills are those required? And that kind of goes into, well, do you know Terraform? Do you know what shift left security is? Can you built in all this beautiful tooling? On the [00:15:00] left, those are kind of the core skills. And then you need to know some threat modeling and being just savvy about security, Sao understand like what architectural decisions are happening, how they can actually impact, right?
Like you are not implementing SDP policies. You don't means you don't have any guard rails. You now have to trust people. They don't open up public as free bucket. So that's kinda where I wanted to take it. But my. Like I have watched a lot of talks on YouTube on like different ways, how, how to like break in into security.
And there's like this two world apart situation where DevSecOps is very much Of evolution of dev ops, right? And it's those same people, pretty much just gaining some security skills and adding that on top. The approach I want to take, which is hopefully like more new and fresh to it is that I want to take security people.
And bring them to dev ops because that's what I been trying to do for the past [00:16:00] year is that like people from security side probably don't know anything about CICD. They don't know a lot of these things, but they bring a wealth of knowledge about the sock, about the threat hunting and everything else. And if you ask your of the mill.
Person who does like Jenkins CICD and you tell them like, well, what are apt threats? They're like, what APT is that? Like, you know, Debian thing to install packages. So that's kind of where we are. Right.
MM: [00:16:31] That's good. The points you bring up seems to me, very platform, infrastructure bias.
What about the application security code angle? What's your, what's your view on that?
Marcus: [00:16:44] So that that's probably like just shows where my, most of my work is being done is building platforms, landing zones, Kubernetes clusters. And I kind of come from a CIS admin background, even though I wanted to become a Ruby on rails developer in a past life.
So there a [00:17:00] little bit of that But I think the main, the main bit is that empathy to developer that's obviously always missing . It is its own involved, big area of, it sounds like secure coding and what actually secure coding is because there's always so many false positives from something like a Fortify or anything else.
And it's always hard to navigate and having that empathy that you ordered, all the stooling on the left and you got like, you're breaking the pipeline because. Something light it up like a Christmas tree, and you're just stopping that develop, like you're stopping someone's feedback loop . But yeah.
Security is a big end. Like maybe once I get into that more, what I'm sure Josh has a vague opinion about self software application security.
Josh: [00:17:45] I guess the bit on the platform side, the I see the value in is really at the end of the day, your application, you should assume your application is insecure.
Just that should be your baseline assumption. No one has perfect security. That's [00:18:00] kind of a given. So the platform side is your cap capping your risk on that one breach doesn't become. I breach everywhere. And that just getting through one application bearing in mind that there will be holes and you should, it's a matter of when not if that you can at least try and control the blast radius.
The, when something does happen on the application side, it gets very hard. I think the pressure comes on developers to deliver features and often they just can't see. The security angle. They don't have the right lens to look at what they're doing from a security perspective. It's very much changing that security notion from a custodial guardian of everything that happens to enablement and drawing a look at the team.
And how do you get the developers? They're not going to become security experts. That's not a realistic expectation, but how can you make it so they can at least see things the right way, whether that's threat modeling, whether it's security, chaos, engineering, whether it's. [00:19:00] You know, just sitting with them and the empathy side of things, which I think is so critical, but at the end of the day, yet the tooling and the software space, when you look at it is always incredibly expensive and it is honestly out of the reach for the, for the top quality, totally out of the reach of most companies to really go for, unless you're an enterprise, but a startup isn't going to pay you for a lot of them because they just can't afford it.
It's more, it's like the equivalent of 10 developers, you know, kind of realm. So it gets really difficult.
Glenn: [00:19:33] That's where education is important because you know, the tooling side of it is very expensive. And, and there are other ways of actually introducing security into applications without going through the, the, you know, the procurement process, you know, writing your own unit tests, for example, about certain security aspects, you know, like free validation, for example you know, these are free to do just a little bit of time and extra time to do stuff, but.
Education is important. You know, developers need to [00:20:00] understand how to write good code, how to write secure code. And that's probably cheaper to do than to bring in tools to support them.
Josh: [00:20:08] Yeah, I think the cultural piece, like culture is dictated by action, not words. So getting the company to invest real time, money, and effort into things like one of the conference talks, I.
Do is from when we did a security, chaos engineering at a consultancy. We took everyone off client for a day in order to do that. So our revenue for the entire business was zero pounds for a day. And that was how importantly we took security and how we were going to invest in that. And that really paid dividends over the long term.
What I've had to. Kind of the question from that talk before has been, you know, how do you get your company to do this kind of thing? How'd you get them to invest in them? Why? Well, if they're not willing to invest that kind of scale, then how does it, how do they expect you to really care about [00:21:00] security?
If you're unwilling to take time off delivery, to give your teams the ability to invest in those skills, you can't expect Goodwill and free time to make up for it. All right. And really taking two days off to do game days and that kind of stuff. Really shouldn't be the end of all on delivery. Otherwise you've got other problems as well, but generally it shouldn't be something you can do.
MM: [00:21:22] Who should take responsibility of training individuals, the business educational establishment, such as universities and colleges.
Marcus: [00:21:31] Going into colleges and universities. That's like always a difficult thing, right? Because you go into the wall while universities are for getting PhDs and teaching for those, right. They're not preparing you for work. Obviously it depends on the university and that that's been changing.
Like I had a. Relatively decent one for when we were like learning Android development. And those are like, were real skills. I called reuse later, but that's not always the [00:22:00] case. There's all, it's also kind of lagging quite often. Like my security skills were like going over something like John, the ripper, like not that many people use John the ripper in their security gigs these days, please, from my experience I think it she'll be that someone she'll set the pattern as in.
This is the budget. This is how you do it and make sure it's self service. So people can just go and then decide where they want to go and build a community around it. Trying to do it via HR that does, like, I never saw a successful HR platform that created good training modules. It only was ever good.
If that was done through the community and it was just bubbling up to HR and they got those requirements. Otherwise you're trying to show her and people to, oh, you just like to go, Joe, let's say you want to switch. You're now assist admin on prem in the enterprise and you want to become a cloud [00:23:00] engineer.
They will just say, well, do those two AWS certifications and make sure you can do this. And then you can do it. That's not really realistic. And doesn't teach you the correct skills. Like there are proper learning paths and a lot of gotchas, and you need that detail when you're learning.
It cannot be just fully get on AWS as a pro. And you're a cloud engineer. Like life is a little bit more complicated.
Josh: [00:23:24] I think universities can make it hard sometimes because we already see it. And it sometimes there's like a bit of a lead CISM around computer science degrees, like, oh, in order to be a proper software engineer, you have to have a computer science degree.
I have one. I don't know how much you is nowadays. Like day-to-day sometimes I talk about big O notation to people and they look at me confused. I'm like, okay, well, you know, the rest of it was, it was fun to do, but I think it's important that it's digestible in the way and something that everyone can do.
And there aren't all these barriers to entry for people. Another bit is making [00:24:00] sure that the technical leadership in the company really invest in values. Training and kind of values where the company is going to be in six or 12 months. So for where it is today and helps grow that out and leads from the front with that.
Yeah, I don't think leaving it to HR, HR, can't give you the right direction on where you should grow because they don't know. They can only parrot back what they've been told by other people. Cause generally they don't have the technical skills, but I think it, it sits with the leadership of the management and the technical function to go.
It's their responsibility to help people grow. If they're not doing that, something needs to fundamentally change their like Marcus and IBOs on our engagements, we help try and grow the more junior members on the team. We work with them on areas of growth they outline or where we think they should go.
And all that kind of stuff and try and help them plan out what they're going to do and how they're going to spend the learning and development budget that we have at our container. [00:25:00] I think generally what happens is when people get involved with me, they use up all their budget very quickly because I keep pushing them to do it.
Cause I'm like, you should invest in yourself. Whereas sometimes the pressure of a client engagement can sometimes make people forget about it or the like all, but I'll do that in a month. It's like, it's going to be just as busy in a month. Just take the time and make sure you invest in yourself.
MM: [00:25:20] So it, it requires a lot of self-motivation and focus in terms of knowing what to study and then studying, absorbing them, putting that knowledge into practice so that you reinforce that those lessons. I guess some people would find that quite challenging. Any advice on how to overcome some of these challenges?
Marcus: [00:25:43] So I think the main one is one of the best things. The way I learn, particularly if you want to study for a particular exam is do some very basic research and properly essentially type in, in Google. I [00:26:00] passed and then exam name or my review of some exam. You will see how people studied and what was successful and particularly focused there.
Like now subreddits like AWS certifications, or there was CP one where you can go and people are say, Well, I passed or I failed those full failed are also very useful lessons. Right? Learn from other people failures, because it's very expensive to commend those failures. Right. It's like it's time and money.
If you're trying to like commit to all the same mistakes everyone else already did. Right. So there's a lot of learning there. The water births. Just talk to someone who actually did it to people for you look up to that kind of helps. For example, if we continue now, we have channel called practice learning.
And when someone wants to learn something or get some feedback, there might be someone for, I already did CISSP. For example, you have to be referred to get your system by someone. And like you have someone in the business it's amazing, [00:27:00] right? Like you, that feedback cycle is so much faster and you can say.
Well, is that a, you dummy course actually good, because like you, the is famously like a lot of variability in quality of courses and you can just go and find something useful that people actually tried out and like personal recommendations are always better than like, you know, reading those five star reviews that probably were paid off.
Glenn: [00:27:25] I think Josh you said earlier about you know, the education piece. So I said that is a computer science degree. There's a bit of snobbism around it, but you found it. It was actually not, not all that great value in the professional world is, is that mean that there's a misalignment really between universities and the real world and, and really the responsibility should be on the universities to start working very much with professional industries and start to.
Start to create better degrees for their students. So when they did come out of university, they have the skills to, pass on to those that need it.
Josh: [00:27:56] I think so. Yeah. I did do some guest lecturing at the [00:28:00] university. I went to a couple of years after I left and I went, I did like a tutorial for some masters level. Computer science students. And they started talking about Linus Torvalds, and they didn't know who I was talking about. I'm like, okay. All right.
Let's just step back. One, couple of steps here and go, okay. You know, Linux that you use, the guy who made that. Okay. Now we can continue. And it was just a bit of a you know, a bit of a gap there, like, as Marcus said earlier, like universities generally have the academic focus and. Also expecting it to take three years to be a developer.
If you're studying, full-time seems a lot to me, your universities co could do more. And I think they are trying to do more. I think all the coding, boot camps and other things around the space have, are disrupting them in that space. Which is nice to see. Yeah, they should hopefully get more professionals in and rotate more through and have closer alliances with the bigger [00:29:00] tech firms in the space and make sure they're coming through and giving that, you know, a real world experience versus the theoretical computer science stuff, like learning Lambda calculus is a lot of fun.
You're not going to use it on a data that, well, I know some guys , but apart from them, no one else is going to kind of make use of that on a day-to-day basis. Right.
Glenn: [00:29:19] Yeah. And I was going to point out there is that if you going to become a doctor, you'd have to go through a, an education process starting at university and working your way through which some of it is also involves practicals. And then you, once you've gone through that, it could be many years you're let loose on your patients.
Do you think that. In some respects, computer engineering for those high levels needs to follow the same path, particularly if you're going to be working in, like, for example, a lot of health care. Look what happened in Ireland last week, for example, where the our health system is brought down to his knees by ransomware.
Does that mean that we should start thinking about. If you're going to work in a hospital, working in it, you need to [00:30:00] be at a certain level with your knowledge of engineering, security and so forth before you can even take on those roles is you reckon that that could be a way forward to, to protect our most critical assets within that countries?
Josh: [00:30:12] I think potentially I think one of the things that annoys me a lot in the it industry generally is a level of hubris that exists with a lot of, a lot of people. People think they can do things amazingly themselves all the time. And sometimes it's, you know, when that, one of the big things about going to the cloud is effectively, you are monetizing your security cost versus a lot of other people and ads can do a better job of security.
Then you can, for example, and just building, you know, realizing that. Over time as we kind of mature the industry, more stuff will be taken care of. And we're always going to be focusing higher up the stack. I think a lot of the time people still have this data center mentality and they're like, oh no, we can do this all ourselves.
[00:31:00] I he's like, yes, you theoretically could, is it right for the business? No. Is it right for your sanity and mental health? No. So how about we kind of move forward with this and I'm sure once me and Marcus get older, we'll probably turn into the old guard that I like know back in my day, we did it this way and it was fine, but hopefully as an issue of getting a little bit more used to the fact we've got to move with the times a little bit, you know, really the end of the day, it's hard to.
With all the ransomware stuff that is going around, it's hard to stop these kinds of new threats and everything else and make sure that you're completely on top of things. But I think it just means you've got to invest more and I don't think. I don't think you can just train people up to being able to do that is really getting practical and hands-on, and that's where game days.
And you know, some of the more practical certifications where it isn't just multiple choice, really start to actually have a lot more value, like the OCP, where you have to actually hat boxes to do that. That's where [00:32:00] exams should be going. Not which of these four choices. I shouldn't be able to get 25% on an exam if I don't know anything about the topic, which the multiple choice lets you do at the moment, which has a bit of a problem.
Glenn: [00:32:11] Gone quite deep there with the last two questions. So let's lighten the tone a bit. I think so there was a question that came up last night. What's what's so good about cats.
Marcus: [00:32:23] So I always found like I go to a lot of meetups. I watch a lot of talks. It is a time investment for both me making it and also for people watching it. Right. It's making a talk, takes a lot of research, a lot of things, kind of trying to make it succinct and whatnot. Right. So on for me, when I make my slides, I like to go and like, Like if I get bored or like, I don't find something, I just go look at some memes for five minutes and I find the perfect meme for that slide.
And then like, I go and continue my work. The other bit. I found that there now, particularly in logged down, [00:33:00] people being creative and like recording videos when they do give, they give their talks or like, you know, and that kind of Like pre presenter mode. But like the most thing is like, it's 45 minutes, right?
You it's, I want you to be engaged. Most people kind of zone out after 25. So if you don't keep that engagement and maybe that you already know that content, so you need something to keep your attention and they find, find gifts and cats and everything else. I do have water kind of slides where it's like be could choose or something else or.
But like, yeah, ha having some FIM to keep it light because people sometimes get too serious about these things. And like, this is like, this is a privilege to be working in this industry and you we'll have fun.
Glenn: [00:33:47] I saw, I agree with that. Totally because. Education should be fun. And what you were doing last night was educating the attendees, and it should be fun.
It should be something that you engage with throughout the whole 45 minutes. And not just [00:34:00] for the first time in five, 10 minutes, it's, you know, and, my personal philosophy is that education should be more fun. Shouldn't be that you know, that Victorian style of teaching that we have.
Go through school. Now we have a teacher at the front and pupils sitting there. They're like stone face, listen to their teachers. Talk about, you know, certain stuff. I, I, I, I think it needs to be more fun. So that was quite good to see last night. .
MM: [00:34:23] Is there anything else you guys want to share with our listeners?
Marcus: [00:34:27] I think the main one for me done, done stop learning. Like if you didn't get into it eh, go do it. And whatnot, because it is warfare particularly like there is a lot of ladders to climb in it. And a lot of side ladders, you can move too. So there's a lot of opportunity, particularly if that's something you want.
And it's always just like, like it's such a vast industry. Like I subscribe to multiple blogs and multiple newsletters. I kind of learn that. Well, I won't be able to let her know all the [00:35:00] things, but I can learn a few. And it's still very rewarding because there's so many interesting areas you can get into, right?
Like if you want, like, particularly right now, Like I remember when I was trying to study like some maths, right. There was no Khan academy back in the day, and now there's so much like not learning. Now. I remember when like they announced Coursera and Mitacs and other X. Right. You can go to Harvard lectures for free.
This has not been possible before. Like people traveled all around the world to get in. And it was like a massive thing. Now you have full curriculums available for you. And people just cannot be bothered because like, I don't want to. And not, there's just not that culture. Like, because everyone got burned by school and university, it feels like they didn't have those kinds of.
Role models Snyder from like for all their life. And they don't understand that there is actually amazing [00:36:00] engaging content from YouTube to MOOCs, to everything else.
Josh: [00:36:04] Yeah, I think just piggybacking off of mortgages, I think there's two things. One is that don't let high school English burn you out on reading. I think so many people, they enjoy reading when they're kids, they go through high school. By the time they get round to the other side and then through university, like I, they can't stand reading anymore and they kind of lose the practice.
I think even I had quite a few years in the wilderness on that ride. I did, I barely picked up a book for years. And then I kind of learned to love reading again, all of a sudden I can't stop and that's been really impactful. I think the other one is don't disregard the impact of the compounding nature of marginal gains.
Even if you're just improving 1% a week, when you start compounding that over a year, that's a massive difference, right? It's not that you have to take these huge swaths in huge learning and throw all your time away into it. Even just finding an hour or two a week to invest [00:37:00] starts to really add up over the longterm.
In a way that is not always so obvious in the first instance.
MM: [00:37:06] That's a very good tip. I like that. I also liked the saying that you quoted from sir Richard Branson last night, Marcus train people well enough. So vacant leave, treat them well enough. So where you don't want to. That's brilliant.
Marcus: [00:37:23] Yeah. That, that, that, and that's kinda, you will see when you have juniors to seniors and you, if you. Seeing the business, people who like stayed for a long time, like, you know, that like the business is investing usually particularly if they get, like, if you, because I had the pleasure of seeing some who like, just what learning their first Terraform, how to launch it, that were not sure, like they were fearful of releasing to prod.
And now they're the person to go to because the business invested into them. Right. And like, that's a massive, [00:38:00] like, it's very impressive to see and they don't leave because they recognize, right. Like if you got promoted from junior to senior, you kind of understand, well, there, there is like a future year.
MM: [00:38:11] Super great. Well, thank you for coming on to this episode, Marcus and Josh. Appreciate it.
Marcus: [00:38:19] It's been a pleasure.
Josh: [00:38:21] Thanks for having us.
