Build your own pentesting tools and master red teaming tactics | Ed Williams

WEBVTT
00:00:00.050 --> 00:00:01.580
Today on cyber work.
00:00:01.639 --> 00:00:06.709
Ed Williams of Trustwave joins me to discuss the ins and outs of pen testing and red teaming.
00:00:06.980 --> 00:00:07.099
Now.
00:00:07.099 --> 00:00:12.169
Ed's been pen testing since 2008 and he's seen methodologies and trends come and go.
00:00:12.455 --> 00:00:14.015
But the skills are always the same.
00:00:14.128 --> 00:00:19.737
you learn so much from other people, from listening to things, from building and tinkering.
00:00:19.888 --> 00:00:23.248
It takes me back to when I was that 7-year-old on the BBC.
00:00:23.248 --> 00:00:27.748
Um, I'm basically the same person now tinkering to tinkering around
00:00:27.917 --> 00:00:30.737
ed tells us about some of his favorite red team strategies.
00:00:31.007 --> 00:00:36.618
we would send, uh, an email saying, oh, somebody's gonna come and check the, um, the fire extinguishers in two weeks.
00:00:36.677 --> 00:00:36.828
two
00:00:36.932 --> 00:00:43.713
So then I'd come along then with my fire extinguisher testing kit on, um, you know, we let reception know and all this stuff.
00:00:43.773 --> 00:00:48.213
Explains how he co-authored a Red team tool in 2013 that won him accolades
00:00:48.362 --> 00:00:54.302
when you're sort of dealing with threats, the really, really good threat actors, you don't know they're there, you don't know they've even been there.
00:00:54.512 --> 00:00:56.042
So we're trying to mimic that,
00:00:56.103 --> 00:00:56.673
that,
00:00:56.853 --> 00:00:57.573
sure that,
00:00:57.753 --> 00:00:57.932
that,
00:00:57.932 --> 00:01:01.052
um, you know, files are not removed or not touched too heavily.
00:01:01.103 --> 00:01:07.643
And lets us know that small accumulations of knowledge every day can turn into powerful skill sets in a short period of time.
00:01:08.153 --> 00:01:11.962
Couple of steps forward, and you know what I call it like stacking days.
00:01:12.143 --> 00:01:13.403
So you might learn a little command.
00:01:13.582 --> 00:01:15.563
Eventually those stacking days will add up
00:01:15.668 --> 00:01:15.787
will
00:01:15.862 --> 00:01:18.233
and you'll be in some environment that you've never seen before.
00:01:18.442 --> 00:01:18.772
Oh yeah.
00:01:18.772 --> 00:01:19.373
Remember that?
00:01:19.433 --> 00:01:20.003
Boom, boom, boom.
00:01:20.033 --> 00:01:20.843
You're away your route.
00:01:21.263 --> 00:01:23.033
That's all today on cyber work.
00:01:23.120 --> 00:01:25.911
The IT and cybersecurity job market is thriving.
00:01:26.240 --> 00:01:31.490
The Bureau of Labor Statistics predicts 377, 500 new IT jobs annually.
00:01:31.930 --> 00:01:39.971
You need skill and hustle to obtain these jobs, of course, but the good news is that cybersecurity professionals can look forward to extremely competitive salaries.
00:01:40.290 --> 00:01:50.025
That's why InfoSec has leveraged 20 years of industry experience Drawing from multiple sources to give you, cyber work listeners, an analysis of the most popular and top paying industry certifications.
00:01:50.385 --> 00:01:53.495
You can use it to navigate your way to a good paying cyber security career.
00:01:53.796 --> 00:01:59.365
So to get your free copy of our cyber security salary guide ebook, just click the link in the description below.
00:01:59.365 --> 00:02:01.126
It's right there near the top, just below me.
00:02:01.126 --> 00:02:01.745
You can't miss it.
00:02:02.146 --> 00:02:07.016
click the link in the description and download our free cyber security salary guide ebook.
00:02:07.275 --> 00:02:09.596
Your cyber security journey starts here.
00:02:09.975 --> 00:02:11.445
Now let's get the show started.
00:02:17.145 --> 00:02:20.066
Welcome to this week's episode of the Cyber Work Podcast.
00:02:20.066 --> 00:02:21.626
I'm your host, Chris Sanko.
00:02:21.656 --> 00:02:25.346
My guests are a cross section of cybersecurity industry thought leaders.
00:02:25.675 --> 00:02:31.526
Our goal is to help you learn about cybersecurity trends and how those trends affect the work of InfoSec professionals.
00:02:31.850 --> 00:02:36.531
And leave you with some tips and advice for breaking in or moving up in the cybersecurity industry.
00:02:37.191 --> 00:02:43.550
guest today, ed Williams, is the Vice President of EMEA Consulting and professional services at trustwave.
00:02:43.971 --> 00:02:48.860
With over a decade of experience in cybersecurity, ed specializes in penetration testing, red teaming.
00:02:49.265 --> 00:02:52.895
And threat simulation for both government and private sector clients.
00:02:53.286 --> 00:02:58.566
As a recognized subject matter expert, ed frequently speaks at industry conferences and contributes to media outlets.
00:02:58.695 --> 00:03:01.575
Ed, thank you for joining us today and welcome to Cyber
00:03:01.635 --> 00:03:01.936
Thank you.
00:03:01.936 --> 00:03:02.475
It's great to be here.
00:03:02.515 --> 00:03:03.200
to be here.
00:03:03.596 --> 00:03:04.316
Uh, so great.
00:03:04.316 --> 00:03:08.156
So Ed, so let's, uh, start with a bit of you and your early years.
00:03:08.156 --> 00:03:18.175
No matter of how far back I researched into your bio and career, it seems to have always had at least one foot and more often than not both feet in IT information security and cybersecurity as a whole.
00:03:18.175 --> 00:03:23.605
Can you remember, uh, a moment or a specific incident that made you so excited for computers and tech?
00:03:23.691 --> 00:03:26.450
Yeah, that's a great question and very true as well.
00:03:26.450 --> 00:03:30.860
So I'm, I'm 46 years old and I can remember.
00:03:31.265 --> 00:03:42.246
My dad's been very advanced in these things, and he got a BBC micro, and we were the first, we must have been the first one in our little village to have a computer.
00:03:42.246 --> 00:03:46.566
So, so I was busy programming on the BBC micro with the old cassette tapes.
00:03:46.806 --> 00:03:50.195
So it got, got ahold of me pretty quick and pretty early in my life.
00:03:50.300 --> 00:03:50.496
So,
00:03:50.600 --> 00:03:50.811
life.
00:03:50.855 --> 00:03:54.966
as you said, I've, I've always had a step into computing and moving through school.
00:03:54.966 --> 00:03:56.675
Then it was, it was always there.
00:03:56.915 --> 00:03:57.876
It was never far away.
00:03:57.955 --> 00:03:58.376
far away.
00:03:58.491 --> 00:04:00.770
That's a, that's a brand that has not yet come up on the show.
00:04:00.770 --> 00:04:03.770
We've heard a lot of Commodore, a lot of TRS eighties, uh, radio Shack.
00:04:04.010 --> 00:04:04.580
Um.
00:04:05.480 --> 00:04:07.881
is B, B, C, is that related to the, uh, to the
00:04:08.181 --> 00:04:08.991
No, I don't think it's,
00:04:08.991 --> 00:04:09.381
break into
00:04:09.501 --> 00:04:11.091
I don't think it's anything to do with that actually.
00:04:11.091 --> 00:04:11.480
It was,
00:04:11.536 --> 00:04:11.616
actually.
00:04:11.901 --> 00:04:12.350
it was just a,
00:04:12.436 --> 00:04:12.656
It
00:04:12.955 --> 00:04:14.355
massive bit of kit that weighed
00:04:14.656 --> 00:04:14.895
That
00:04:14.895 --> 00:04:15.056
lot,
00:04:15.616 --> 00:04:15.735
a
00:04:15.836 --> 00:04:16.615
but it was just
00:04:16.821 --> 00:04:17.211
And it
00:04:17.286 --> 00:04:20.255
gave me into, got into basic programming and is brilliant.
00:04:21.081 --> 00:04:24.591
and, and, and as you mentioned it, it goes back to the days of, uh, putting
00:04:24.596 --> 00:04:24.886
Yeah.
00:04:25.011 --> 00:04:28.880
in there and, and waiting 45 seconds to three minutes for a program to
00:04:28.880 --> 00:04:32.000
And then turning it around and it would stop and break and
00:04:32.211 --> 00:04:32.271
it around.
00:04:32.781 --> 00:04:33.375
great times.
00:04:33.675 --> 00:04:36.766
hoping that it wouldn't, uh, wouldn't sort of kick out in the middle
00:04:37.065 --> 00:04:37.490
Absolutely.
00:04:37.550 --> 00:04:38.086
Absolutely.
00:04:38.386 --> 00:04:39.406
the, the golden age.
00:04:39.466 --> 00:04:49.425
Uh, so, alright, so Ed, looking at your career arc on LinkedIn, um, like I said, we're gonna be talking a lot about this, but you've been deeply entrenched in penetration testing for most of your adult life.
00:04:49.485 --> 00:05:00.045
Um, you know, when I think of like, sort of the, the early days of pen testing it, you know, you go back to 2008 and, uh, I've had, um, uh, Gemma Williams on the show as well and, uh.
00:05:00.425 --> 00:05:05.766
Uh, that feels like sort of like the earliest, you know, almost the pre-history of, of pen testing.
00:05:05.766 --> 00:05:13.716
You talk, talk about why you love it so much and why you've been doing it for so long and, uh, you know, with someone with a long arc around it like that.
00:05:13.716 --> 00:05:16.415
Uh, talk about how some of the practice has changed since those early days.
00:05:16.415 --> 00:05:17.555
Yeah, there's a lot there.
00:05:17.555 --> 00:05:18.456
That's a great question.
00:05:18.456 --> 00:05:18.875
So
00:05:19.355 --> 00:05:19.386
a
00:05:19.461 --> 00:05:22.206
I, I, I went to university to do computer studies.
00:05:22.386 --> 00:05:24.305
Um, seemed like a natural thing for me to do.
00:05:24.665 --> 00:05:30.365
And my, uh, the, the course that I did was very, very heavy into Unix.
00:05:30.365 --> 00:05:33.396
It was a real Unix heavy course, which is great, and I, I loved it
00:05:33.516 --> 00:05:33.755
I loved
00:05:33.755 --> 00:05:34.055
and.
00:05:34.446 --> 00:05:41.466
Looking back now I can see that security and sort of Unix admin and that type of thing is, is just embedded into security.
00:05:42.396 --> 00:05:43.805
So it is been there from the beginning.
00:05:44.105 --> 00:05:44.165
the
00:05:44.315 --> 00:05:45.245
So I did that.
00:05:45.276 --> 00:05:48.456
Then I did my, um, a master's degree in information security.
00:05:48.966 --> 00:05:52.956
I then went, I went traveling for a bit, but then I got a proper job as my parents would say,
00:05:53.196 --> 00:05:53.286
would
00:05:53.315 --> 00:05:55.235
as a Unix admin and analyst.
00:05:56.406 --> 00:05:59.406
And from there then security's always at the forefront.
00:05:59.735 --> 00:06:03.815
We got a pen tester to come in then into our organization.
00:06:04.326 --> 00:06:07.235
I thought I did a good job, but you absolutely ripped everything apart.
00:06:07.536 --> 00:06:08.136
apart.
00:06:08.165 --> 00:06:08.255
was,
00:06:08.435 --> 00:06:08.615
Uh, it was.
00:06:08.766 --> 00:06:11.136
it was very enlightening, should we put it that way.
00:06:11.375 --> 00:06:14.136
Um, and from then I was really on the sort of the.
00:06:14.630 --> 00:06:14.781
The,
00:06:14.930 --> 00:06:17.480
the forefront of, right, I need to do a better job here.
00:06:17.540 --> 00:06:17.810
job
00:06:17.810 --> 00:06:19.310
need to make sure that we're secure
00:06:19.341 --> 00:06:19.940
we're secure
00:06:19.940 --> 00:06:21.951
and that, you know, I get all the systems tight.
00:06:22.161 --> 00:06:23.540
And from there then the,
00:06:23.781 --> 00:06:24.170
the,
00:06:24.471 --> 00:06:28.850
pen test a year after and the same pente pen test that came back and said, this is much better
00:06:28.880 --> 00:06:29.060
much
00:06:29.120 --> 00:06:31.040
come and work for a consultants.
00:06:31.221 --> 00:06:31.880
So I applied,
00:06:32.180 --> 00:06:32.690
applied,
00:06:32.750 --> 00:06:34.911
had, I only had you next experience.
00:06:34.911 --> 00:06:36.261
I had no other
00:06:36.471 --> 00:06:36.951
other
00:06:37.250 --> 00:06:38.901
experience, but he said, no, no, that's fine.
00:06:39.081 --> 00:06:41.151
Come in, we'll get you trained up and you'll be good to go.
00:06:41.480 --> 00:06:43.401
And that's really how it, how it all started.
00:06:43.401 --> 00:06:43.461
I.
00:06:43.480 --> 00:06:43.761
started.
00:06:44.255 --> 00:06:44.406
Yeah.
00:06:44.461 --> 00:06:47.375
Did you, did you feel kind of, uh, over your head at that point?
00:06:47.375 --> 00:06:50.721
I mean,'cause I, I, I actually, I just realized my, my other guest name was Jimma Moore.
00:06:50.795 --> 00:06:50.915
Not
00:06:51.021 --> 00:06:51.800
Yes, I know jama.
00:06:51.800 --> 00:06:52.071
Yep.
00:06:52.086 --> 00:06:52.596
name with your name.
00:06:52.625 --> 00:07:01.355
But, uh, um, did you, you know, I got the sense from her and I, and I guess I, I'd like to hear your insight as well, but, uh.
00:07:01.716 --> 00:07:07.146
Uh, has the human skill needed to excel changed that much or is it mostly just a difference in tools?
00:07:07.146 --> 00:07:11.795
Because it seemed like there were less tools then, but there was also maybe less to do in certain ways.
00:07:11.841 --> 00:07:13.776
Uh, again, that's really, it's a good observation.
00:07:13.776 --> 00:07:15.125
So the way, the way I see it
00:07:15.425 --> 00:07:15.605
it
00:07:16.175 --> 00:07:19.776
you know, I was authoring reports 20 years ago
00:07:20.076 --> 00:07:20.615
ago.
00:07:20.646 --> 00:07:21.966
and I see reports there.
00:07:21.966 --> 00:07:23.706
I don't offer'em as much now as I used to,
00:07:23.750 --> 00:07:24.110
I used
00:07:24.216 --> 00:07:25.685
but they're pretty much the same.
00:07:25.745 --> 00:07:28.011
Uh, the tools and the tactics might have changed,
00:07:28.310 --> 00:07:28.911
changed,
00:07:29.211 --> 00:07:32.286
skill and the ability to be agile and to think
00:07:32.300 --> 00:07:32.420
to
00:07:32.555 --> 00:07:34.565
in a different way is exactly the same.
00:07:34.565 --> 00:07:34.956
So
00:07:35.180 --> 00:07:35.630
So
00:07:35.646 --> 00:07:39.276
everything has changed, I'd say nothing has changed as well in some regards.
00:07:39.576 --> 00:07:39.925
regards.
00:07:40.120 --> 00:07:42.175
Is there, is there a sort of a speed difference as well?
00:07:42.175 --> 00:07:54.745
Because I, I, you know, I've certainly, right now with the sort of, uh, proliferation of, of more tools and more automation and, you know, less sort of busy work, do you, are you sort of having to think on your feet faster now?
00:07:54.745 --> 00:07:55.795
Was it a slower process
00:07:55.821 --> 00:07:56.180
Um,
00:07:56.365 --> 00:07:56.425
Um,
00:07:56.781 --> 00:08:00.170
I would say you have to think in your feet quite a bit.
00:08:00.755 --> 00:08:02.196
You know, all the way through my career.
00:08:02.255 --> 00:08:07.865
Um, one, one thing I would sort of say that I'm pretty good at is, is thinking of my fate and, you know, trying to,
00:08:07.911 --> 00:08:08.091
you know,
00:08:08.136 --> 00:08:13.115
trying to join two dots that aren't ne necessarily that easily joinable you, sort of
00:08:13.310 --> 00:08:13.401
joinable
00:08:13.475 --> 00:08:14.615
brute force'em together.
00:08:14.615 --> 00:08:15.875
Um, I would say I.
00:08:15.980 --> 00:08:16.250
I would
00:08:16.581 --> 00:08:21.350
Like I did a lot of programming in my college and throughout my life, and that has been really useful.
00:08:21.651 --> 00:08:22.221
useful,
00:08:22.250 --> 00:08:25.346
to script up something really quickly on the fly
00:08:25.646 --> 00:08:25.865
fly.
00:08:25.880 --> 00:08:37.880
in an environment where you maybe didn't have the internet at your hand, and being able to work things out that that would sort of accelerate whether you were brute forcing something or you know, password cracking, something that you've not seen before.
00:08:38.120 --> 00:08:41.541
So to be able to do those, those types of things has always been invaluable.
00:08:41.841 --> 00:08:42.291
valuable.
00:08:42.770 --> 00:08:50.780
Uh, how did, how did you sort of build those skill sets the early on when there wasn't necessarily, you know, now you can look it up or you can ask chat GPT or
00:08:50.995 --> 00:08:51.365
Yeah.
00:08:51.441 --> 00:08:59.541
what, what, did you, was it just pure sort of problem solving or did you sort of have, uh, able to sort of connect dots that were already
00:08:59.706 --> 00:09:03.875
Uh, so probably all those things, you know, having good mentors is always good.
00:09:04.235 --> 00:09:06.875
I remember, I dunno if, if you're familiar with Unix,
00:09:07.235 --> 00:09:07.655
mm-hmm.
00:09:07.775 --> 00:09:09.400
a lot of people struggle to get out of vie.
00:09:09.875 --> 00:09:10.446
And I was,
00:09:10.446 --> 00:09:10.806
I
00:09:10.926 --> 00:09:12.816
mentor said, you've gotta be able to use VI
00:09:12.846 --> 00:09:13.086
use
00:09:13.086 --> 00:09:17.225
'cause in every Unix environment there will be an editor there that you'll be able to use.
00:09:17.466 --> 00:09:18.370
And so those types of.
00:09:18.860 --> 00:09:20.225
Skills, which
00:09:20.525 --> 00:09:21.336
which are
00:09:21.635 --> 00:09:24.770
transferable, I guess, across different environments are really useful.
00:09:24.770 --> 00:09:30.561
Like I was a big C programmer then I was a big pearl programmer and that, and now I'm sort of a Python guy.
00:09:30.711 --> 00:09:33.260
So, you know, all of those skills are really useful.
00:09:33.410 --> 00:09:41.206
While I probably don't write much C these days, I'll still use Pearl if I need to, to do something, um, you know, with a file, make it easier to understand and to
00:09:41.505 --> 00:09:41.885
and to
00:09:41.931 --> 00:09:42.186
around.
00:09:42.291 --> 00:09:44.120
So I, I still use those skills now.
00:09:44.211 --> 00:09:44.765
still will use those skills well.
00:09:45.140 --> 00:09:45.860
Got it, got it.
00:09:45.860 --> 00:09:46.341
Very good.
00:09:46.581 --> 00:09:49.461
Uh, so I wanna know a little bit about your current work here.
00:09:49.461 --> 00:09:51.260
For people who are interested in, in what you do.
00:09:51.260 --> 00:09:54.201
Can you tell me what your position as vice President of, is it EMEA or
00:09:54.605 --> 00:09:55.865
Uh, you can say it both ways.
00:09:56.166 --> 00:09:56.365
please.
00:09:56.515 --> 00:09:56.806
Okay.
00:09:57.020 --> 00:09:58.640
Uh, so Vice President emea.
00:09:59.135 --> 00:10:01.265
Consulting and professional services at Trustwave.
00:10:01.265 --> 00:10:05.645
Like what are, what are your day-to-day responsibilities in this particular type of position?
00:10:05.645 --> 00:10:09.635
Because that's, that's a fairly, uh, word, heavy, uh, title.
00:10:09.666 --> 00:10:14.375
You, uh, and what skills from previous positions did you absolutely need to be qualified
00:10:14.390 --> 00:10:15.951
Oh, again, another great question.
00:10:15.951 --> 00:10:18.966
So, so my day to day work is, is managing teams.
00:10:19.265 --> 00:10:19.865
teams.
00:10:19.985 --> 00:10:23.586
I look after, I've got a pen test team, I've got a cyber advisory team.
00:10:23.586 --> 00:10:26.135
I've got people who do sort of threat type work as well.
00:10:26.316 --> 00:10:30.216
So you know, standard security consulting type work.
00:10:30.216 --> 00:10:35.946
So, so managing teams, making sure the clients are happy, making sure that we're delivering reports on time.
00:10:36.186 --> 00:10:39.936
Some, you know, some budget work, you know, making sure that we're hitting our numbers.
00:10:39.936 --> 00:10:41.436
All the boring stuff that nobody really.
00:10:41.691 --> 00:10:43.490
Cares about except me and my boss.
00:10:43.730 --> 00:10:45.806
So making, making sure those things are done.
00:10:46.105 --> 00:10:46.265
done.
00:10:46.341 --> 00:10:46.760
Um,
00:10:46.806 --> 00:10:47.025
Um,
00:10:47.120 --> 00:10:49.640
so sort of good, good man management.
00:10:50.331 --> 00:10:54.591
Uh, one thing I learned pretty pretty early is I used to do a lot of government work in a previous role,
00:10:54.890 --> 00:10:55.341
role,
00:10:55.341 --> 00:10:59.091
would be big teams of pen testers, you know, testing big environments.
00:10:59.150 --> 00:11:04.610
So an ability to lead a technical team to make sure that we're hitting our objectives.
00:11:04.730 --> 00:11:06.860
And, you know, these, these pen tests could last.
00:11:07.160 --> 00:11:07.821
last,
00:11:07.941 --> 00:11:10.341
weeks and there could be eight people there for three weeks.
00:11:10.341 --> 00:11:17.270
It's, it's a lot of man hours to, to corral and organize and get into something sensible at the end of that.
00:11:17.270 --> 00:11:26.900
So, so that was something that's been really, really useful throughout my career and that's basically what I'm doing now is corralling and, you know, getting people into the right place to do the right thing.
00:11:26.971 --> 00:11:26.974
the right thing.
00:11:27.846 --> 00:11:28.056
Yeah.
00:11:28.056 --> 00:11:33.576
You, you mentioned that, uh, the sort of number crunching is something that, that quote only you and your boss find interesting.
00:11:33.576 --> 00:11:38.105
But, you know, that's a, that's a, a push pull that we hear a lot with people who started in very heavy.
00:11:38.355 --> 00:11:41.926
Tech positions and now find themselves, uh, managing, or as you say,
00:11:42.296 --> 00:11:42.456
Yeah.
00:11:42.541 --> 00:11:43.995
uh, uh, groups of people.
00:11:43.995 --> 00:11:47.206
Uh, is, was that a, was that a point of friction for you originally?
00:11:47.206 --> 00:11:50.956
Because I know a lot of people say, you know, I really love doing the hands-on work.
00:11:50.956 --> 00:11:53.865
And then one day I was told, uh, you're a manager now.
00:11:53.865 --> 00:11:59.046
And it's like, you don't get to actually sort of play, uh, uh Was that, was that a hard thing for you or, or was it a pretty
00:11:59.346 --> 00:12:03.591
Uh, it was definitely a conscious, you know, I was, I was aware that it was going to change.
00:12:04.431 --> 00:12:12.380
Um, I, I did do like a mini MBA as part of my studies many years ago, so I did have an understanding of a balance sheet and, you know, profit and loss and
00:12:12.395 --> 00:12:12.725
loss
00:12:12.740 --> 00:12:14.211
revenue and all those types of things.
00:12:14.211 --> 00:12:14.421
So
00:12:14.495 --> 00:12:14.586
of
00:12:14.750 --> 00:12:27.860
I was aware of it in the background and sort of maybe subconsciously I knew it was gonna come, it's probably the right thing for my career development, but I, you know, I'd be lying if I said I don't miss pen testing something I've always enjoyed doing.
00:12:28.071 --> 00:12:31.160
So I take a lot of pride and pleasure actually reading pen test reports.
00:12:31.461 --> 00:12:31.941
results.
00:12:32.030 --> 00:12:32.061
Okay.
00:12:32.270 --> 00:12:37.461
and I still speak with clients, so if there's a, a quarterly business review or a enterprise business review,
00:12:37.760 --> 00:12:38.181
review,
00:12:38.211 --> 00:12:42.500
be there presenting, you know, sort of big issues or impactful issues.
00:12:42.500 --> 00:12:47.000
So I'm, I'm, while I might not be hands on keyboard all the time, I'm still there or thereabouts.
00:12:47.346 --> 00:12:47.796
Okay, good.
00:12:47.796 --> 00:12:49.416
Yeah, I was gonna ask if you still sort
00:12:49.461 --> 00:12:49.730
D
00:12:49.895 --> 00:12:49.956
a
00:12:50.000 --> 00:12:50.510
double.
00:12:50.556 --> 00:12:52.115
whatever, but you dabble a little bit.
00:12:52.145 --> 00:12:52.775
Okay, good, good.
00:12:52.775 --> 00:12:53.676
That's, that's cool.
00:12:53.735 --> 00:12:58.625
Like I said, every, um, everyone's career has, uh, has multiple, uh, acts to it, so, uh, that makes total sense.
00:12:59.466 --> 00:13:07.836
so yeah, uh, like I say, uh, whenever I read the comments in our, in our, in our website or on our YouTube page or whatever, cyber listeners always asking us to talk about.
00:13:08.331 --> 00:13:12.591
The process of pen testing, the use of pen testing tools, strategies that go into a good pen test.
00:13:12.591 --> 00:13:19.100
So, um, yeah, I want to start about you with maybe with your process of tool making to achieve your end.
00:13:19.100 --> 00:13:24.321
So I don't know if this is necessarily gonna go anywhere or not, and if, if you say this is a dead end, just let me know.
00:13:24.321 --> 00:13:35.030
But, uh, in 2013 you created a tool called, uh, red SNF to retrieve hashes and credentials from workstations, but was specifically designed to quote, leave no evidence on the host of intrusion or exfiltration.
00:13:35.211 --> 00:13:42.020
This includes files, processes, and services not cause undue damage to the host IE forcing the host to reboot.
00:13:42.321 --> 00:13:47.211
So that sounds like a fairly, um, granular and specific, uh, use of tool there.
00:13:47.240 --> 00:13:50.480
Uh, can you know about how the project that required the creation of this specific tool came
00:13:50.640 --> 00:13:51.120
Yeah,
00:13:51.201 --> 00:13:51.321
is
00:13:51.451 --> 00:13:51.841
absolutely.
00:13:52.051 --> 00:13:57.061
Me and a colleague, we were on site doing some government work, so we, we couldn't get out to the internet.
00:13:57.421 --> 00:14:02.311
We had a lot of, a lot of hosts that we needed to sort of extract information from.
00:14:02.480 --> 00:14:02.870
from.
00:14:03.005 --> 00:14:08.946
We were very conscious that these were sensitive hosts, so we didn't want to, you know, drop anything and, you know, do anything silly.
00:14:09.186 --> 00:14:11.196
So we created some Python scripts.
00:14:11.255 --> 00:14:13.535
They very lightweight on purpose.
00:14:13.535 --> 00:14:14.390
They purposefully lightweight.
00:14:14.691 --> 00:14:15.260
lightweight.
00:14:15.336 --> 00:14:20.826
know, we would, we would use that set of tooling then to, to grab all the hashes and to crack them and
00:14:20.961 --> 00:14:21.171
them
00:14:21.306 --> 00:14:22.025
those types of things.
00:14:22.030 --> 00:14:24.051
So we would use that as the basis that was the idea.
00:14:24.350 --> 00:14:24.441
the
00:14:24.576 --> 00:14:34.745
And then from that, then we decided to create a tool that was, again, very lightweight, um, wouldn't be, you know, too heavy in terms of its processing power and not make too much mess on a computer.
00:14:35.046 --> 00:14:35.076
a
00:14:35.436 --> 00:14:36.666
Um, because, you know, you know,
00:14:36.785 --> 00:14:36.966
you know,
00:14:37.025 --> 00:14:42.966
when you're sort of dealing with threats, the really, really good threat actors, you don't know they're there, you don't know they've even been there.
00:14:43.176 --> 00:14:44.706
So we're trying to mimic that,
00:14:44.765 --> 00:14:45.336
that,
00:14:45.515 --> 00:14:46.235
sure that,
00:14:46.416 --> 00:14:46.596
that,
00:14:46.596 --> 00:14:49.716
um, you know, files are not removed or not touched too heavily.
00:14:49.716 --> 00:14:52.086
So, so that was the sort of the genesis of the idea.
00:14:52.446 --> 00:14:54.966
And it was just, you know, we, we built it.
00:14:55.056 --> 00:14:57.186
Um, and it just sort of kept adding to it.
00:14:57.426 --> 00:15:01.956
And some people we put on the GI repository internally and the organization kept adding to it.
00:15:02.061 --> 00:15:02.211
to
00:15:02.316 --> 00:15:03.905
Um, and it was, it was a great project.
00:15:03.905 --> 00:15:05.105
We won two of the year.
00:15:05.285 --> 00:15:05.676
Um,
00:15:05.975 --> 00:15:06.196
Ah,
00:15:06.576 --> 00:15:07.086
which was great.
00:15:07.086 --> 00:15:09.275
So I had a free iPad, which the kids could use.
00:15:09.456 --> 00:15:10.566
Yeah, it was fantastic.
00:15:11.775 --> 00:15:17.390
Now, uh, how long did it take to sort of, was it sort of a gradual price?
00:15:17.390 --> 00:15:19.160
So you put it on the kit, the gi, and then.
00:15:19.956 --> 00:15:22.145
Were you still sort of tinkering with it beyond
00:15:22.235 --> 00:15:24.275
Oh, continuously tinkering with it, you know, as,
00:15:24.576 --> 00:15:24.966
tinkering.
00:15:25.025 --> 00:15:32.750
tools and techniques change and develop, you know, we would always, we'd add a new feature or we'd even remove a feature if it was too heavy and too cumbersome.
00:15:33.051 --> 00:15:33.250
comfort.
00:15:33.336 --> 00:15:35.466
Always, you know, event logs were getting flashed or,
00:15:35.610 --> 00:15:35.770
or
00:15:35.855 --> 00:15:36.456
something like that.
00:15:36.456 --> 00:15:41.015
So we'd always be tinkering with it and trying to make it as, as lightweight and useful as possible.
00:15:41.166 --> 00:15:42.936
Um, now it, it doesn't get used anymore.
00:15:42.936 --> 00:15:46.775
I don't think anybody's looking after the repo anymore, which is a shame cause I put a lot of effort into it.
00:15:46.775 --> 00:15:48.905
But at a certain point in time it was, uh.
00:15:48.966 --> 00:15:49.296
it was,
00:15:49.326 --> 00:15:51.490
It was a big project for, for me and my team.
00:15:51.640 --> 00:15:52.115
and my team.
00:15:52.235 --> 00:15:52.716
Yeah.
00:15:52.716 --> 00:16:08.225
Um, I, I, I, I would imagine that, uh, sort of co-creating a tool that even if for a short period of time was being used and as you said, got got an award and was being used by the community, is a really good way to kind of get your name into the community.
00:16:08.225 --> 00:16:11.676
Did it, did you find like a sort of, people were like, oh, now I know who Ed Williams is a little
00:16:11.870 --> 00:16:15.740
Um, I, I wouldn't say it was that famous, but certainly ha having No, no.
00:16:15.740 --> 00:16:16.701
It was, it was a good tool.
00:16:16.701 --> 00:16:20.750
Like I, I would go places and present and people would be aware of it.
00:16:20.841 --> 00:16:23.990
Um, it was in, it was in Cali repos and things like that, so it was,
00:16:24.051 --> 00:16:24.230
that.
00:16:24.260 --> 00:16:27.561
it was definitely being used, um, out and about in, in the wild.
00:16:27.561 --> 00:16:31.341
But I would say for anybody who's looking to, to get into the industry.
00:16:31.696 --> 00:16:32.630
Creating a tool,
00:16:32.931 --> 00:16:33.020
a
00:16:33.321 --> 00:16:40.125
good, bad, or indifferent is a brilliant way to get into it and to really understand the process.
00:16:40.186 --> 00:16:41.655
Like using a tool is one thing.
00:16:41.985 --> 00:16:47.956
Building a tool and maintaining a tool is something completely different and something you get a lot of experience from.
00:16:48.316 --> 00:16:48.556
from.
00:16:48.831 --> 00:16:49.221
Okay.
00:16:49.221 --> 00:16:54.890
Well, uh, I'm, I'm gonna be asking you a little more about that a little later, actually, possibly after we turn the recorder off here.
00:16:54.890 --> 00:16:57.081
But, uh, uh, I want to definitely go back into that.
00:16:57.081 --> 00:16:58.490
So, uh, okay.
00:16:58.490 --> 00:17:03.740
So we want to talk, um, practicals and, and sort of like from a, from a job role here.
00:17:03.740 --> 00:17:08.750
Obviously you've been involved, uh, in pad testing through several different eras and styles, and I.
00:17:09.111 --> 00:17:12.651
Imagine we will see more big changes in the, in the coming years.
00:17:12.651 --> 00:17:13.221
It's hard not to
00:17:13.296 --> 00:17:13.746
Hmm.
00:17:13.820 --> 00:17:17.961
but, uh, uh, what advice do you have for aspiring pen testers and red teamers in 2025?
00:17:18.260 --> 00:17:18.486
Oh.
00:17:18.756 --> 00:17:22.445
Um, the one bit of advice would be to keep relevant.
00:17:22.895 --> 00:17:23.056
relevant.
00:17:23.675 --> 00:17:24.395
Um, keep,
00:17:24.486 --> 00:17:24.776
keep
00:17:25.076 --> 00:17:26.976
like you, you will never know everything.
00:17:26.976 --> 00:17:33.756
It's, you know, it's, it's not reasonable to, to expect that, but certainly don't be dismissive of new technologies.
00:17:33.996 --> 00:17:39.846
I remember when the clouds came out and there was a certain pa, certain member of the pen test community.
00:17:39.846 --> 00:17:40.476
Oh, that's just.
00:17:40.655 --> 00:17:41.226
almost just
00:17:41.391 --> 00:17:42.080
somewhere else.
00:17:42.276 --> 00:17:42.756
else.
00:17:42.996 --> 00:17:43.266
It's the
00:17:43.310 --> 00:17:44.361
Well, actually it's not the same.
00:17:44.361 --> 00:17:55.431
There's a different type of testing that's required, and now we're moving into AI ml That requires a different, you know, the same mindset, but it, it does require different methodologies.
00:17:56.421 --> 00:17:56.451
I.
00:17:56.451 --> 00:17:57.395
Um, uh, from before.
00:17:57.395 --> 00:18:04.326
So keeping relevant, keeping up to date, listening to podcasts, just enjoying the craft.
00:18:04.355 --> 00:18:06.905
I would say the craft of pen testing.
00:18:06.905 --> 00:18:08.016
testing because
00:18:08.016 --> 00:18:13.625
you learn so much from other people, from listening to things, from building and tinkering.
00:18:13.776 --> 00:18:17.135
It takes me back to when I was that 7-year-old on the BBC.
00:18:17.135 --> 00:18:22.986
Um, I'm basically the same person now tinkering to tinkering around making mistakes.
00:18:23.046 --> 00:18:23.290
Um.
00:18:23.590 --> 00:18:23.721
Yep.
00:18:23.871 --> 00:18:25.820
Try not to make mistakes on client sites.
00:18:25.851 --> 00:18:29.391
Uh, we've all been, we've all been there and done things that we, we've regret.
00:18:29.840 --> 00:18:35.211
Um, but I would also say as well, owning up to mistakes and errors, um, you know, that that's okay.
00:18:35.256 --> 00:18:35.435
that's
00:18:35.480 --> 00:18:37.941
Like, uh, you know, I've certainly, when I've managed teams,
00:18:38.016 --> 00:18:38.615
teams
00:18:38.915 --> 00:18:41.691
members have made errors and it's, it's okay.
00:18:41.871 --> 00:18:43.010
You know, don't worry about it.
00:18:43.611 --> 00:18:44.570
Just don't do it again.
00:18:44.570 --> 00:18:47.780
And try and learn from that era is probably, probably what I would say.
00:18:47.790 --> 00:18:48.391
what I would say.
00:18:49.175 --> 00:18:52.596
You mentioned things like AI and, and ll UMS and so forth there.
00:18:52.625 --> 00:19:00.756
What are the, do you see like massive new learning areas opening up for people entering the industry now that they need to sort of like really get on top quickly?
00:19:00.846 --> 00:19:03.875
So I would say there's probably a shortcut with AI and ml.
00:19:03.875 --> 00:19:04.836
You can get to
00:19:04.836 --> 00:19:05.105
get
00:19:05.105 --> 00:19:08.165
the really interesting information of the really relevant information quicker
00:19:08.465 --> 00:19:08.885
quicker, rather
00:19:08.945 --> 00:19:11.496
than listening or, you know, reading a book and say, oh, that might be useful.
00:19:11.496 --> 00:19:12.486
That might be, be useful.
00:19:12.695 --> 00:19:13.865
I think AI and ML is.
00:19:14.185 --> 00:19:16.976
Is an accelerator for both attackers and defenders.
00:19:16.980 --> 00:19:17.611
In all honesty.
00:19:17.721 --> 00:19:18.320
all honesty.
00:19:18.770 --> 00:19:18.861
Yeah.
00:19:19.191 --> 00:19:19.461
Okay.
00:19:19.461 --> 00:19:19.941
That's great.
00:19:19.971 --> 00:19:33.171
Uh, uh, so I want to, uh, go back to collaborative element of your tool making, um, uh, you know, uh, uh, you've created some of your own, own tools, but you also collaborated on larger projects you said, of of, of varying levels.
00:19:33.171 --> 00:19:42.550
But at the same time, I think regardless of, of what you, uh, you know, contributed to it, you've, you've done things that have, multiple hands in the same project.
00:19:42.550 --> 00:19:45.881
And you've sort of had a community of, of kind of tool builders.
00:19:45.881 --> 00:19:52.270
Is this something, do you, uh, have any advice on how to get yourself out into the community and find these type of collaborators?
00:19:52.270 --> 00:19:58.480
Was was creating red snar sort of crucial to you asked by other people, Hey, help us with this?
00:19:58.480 --> 00:19:59.681
Or was it like a calling
00:19:59.980 --> 00:20:01.451
Uh, it, so that's a good question.
00:20:01.451 --> 00:20:02.980
So that, it was definitely an accelerator.
00:20:02.980 --> 00:20:11.141
It's helped not, not, not get my name out there, but, you know, I'm wi I was willing to contribute and willing to, to do something and have a go and roll my sleeves up.
00:20:11.185 --> 00:20:11.635
sleeves
00:20:11.651 --> 00:20:13.661
said, the pen test committee is brilliant.
00:20:13.750 --> 00:20:16.691
The, if somebody's having a go and doing something.
00:20:16.705 --> 00:20:17.246
something,
00:20:17.576 --> 00:20:19.016
you'll get a hundred percent support.
00:20:19.226 --> 00:20:21.355
The worst thing is the people on the sideline.
00:20:21.596 --> 00:20:22.736
You're the naysayers.
00:20:22.736 --> 00:20:25.915
You've gotta be in the arena giving it a go, giving it a crack.
00:20:25.915 --> 00:20:27.205
That, that is the main thing.
00:20:27.385 --> 00:20:28.945
So if it, my advice would be
00:20:29.246 --> 00:20:29.365
would
00:20:29.665 --> 00:20:30.536
create a tool.
00:20:30.655 --> 00:20:33.715
It doesn't matter what it is, doesn't matter how good or bad it is.
00:20:33.986 --> 00:20:39.685
Create a tool and I guarantee your next tool will be better and your next tool after that will be better again.
00:20:39.836 --> 00:20:40.915
And by the time you get to,
00:20:40.961 --> 00:20:41.141
get
00:20:41.215 --> 00:20:44.665
you know, your fifth for sixth, it'll probably be really, really useful for somebody.
00:20:44.736 --> 00:20:45.236
for somebody.
00:20:45.915 --> 00:20:46.155
Interesting.
00:20:46.155 --> 00:20:46.355
Yeah.
00:20:46.355 --> 00:20:46.556
Yeah.
00:20:46.576 --> 00:20:48.250
No, I think that's a, that's, that's great.
00:20:48.280 --> 00:20:49.510
Uh, great advice.
00:20:49.510 --> 00:21:01.090
I remember hearing a long, long time ago, someone I knew who was a skateboarder said like, if you do your own, like even, even if you do a thing that no one else wants to do on their skateboard, like no one can do it exactly the way you do it.
00:21:01.090 --> 00:21:03.490
And you, and you're gonna create a style just by
00:21:03.820 --> 00:21:04.421
Absolutely.
00:21:04.570 --> 00:21:04.750
Yeah.
00:21:04.840 --> 00:21:05.050
whatever.
00:21:05.230 --> 00:21:07.421
I think that's a, um, so, uh.
00:21:08.306 --> 00:21:11.816
I guess from more of like, um, professional cultivation period.
00:21:11.816 --> 00:21:20.516
How do, uh, I, I suppose the tool making process was part of it, but how do you sort of find your people in security and keep those working relationships, relationships and friendships
00:21:20.621 --> 00:21:20.816
Yeah.
00:21:21.340 --> 00:21:22.645
Again, so I would say the
00:21:22.651 --> 00:21:23.171
would say the
00:21:23.260 --> 00:21:23.965
pen desk community is actually quite a small
00:21:24.131 --> 00:21:24.211
actually
00:21:24.221 --> 00:21:26.111
community globally, quite.
00:21:26.411 --> 00:21:27.955
It's amazing once you meet somebody.
00:21:28.256 --> 00:21:28.945
somebody,
00:21:29.080 --> 00:21:33.310
You might move on in five years, you will know somebody who knows that person.
00:21:33.310 --> 00:21:36.881
It's, it's, it's actually a very small community, so once you can break into it,
00:21:37.181 --> 00:21:37.691
it,
00:21:37.990 --> 00:21:38.621
welcoming.
00:21:38.711 --> 00:21:39.070
Um,
00:21:39.371 --> 00:21:39.550
Um.
00:21:39.580 --> 00:21:44.471
I, I would say personally from my own experience, so, you know, be yourself, try, try not to be, um,
00:21:44.500 --> 00:21:45.101
be, um,
00:21:45.131 --> 00:21:46.901
too condescending, I would say.
00:21:46.901 --> 00:21:49.090
But that's, that's probably a rule for life, I would say.
00:21:49.361 --> 00:21:51.070
Um, you know, it'll be nice, be kind.
00:21:51.070 --> 00:21:56.861
All all the things that, that, that I would say to anybody outside of pen testing and it's, it is a great community.
00:21:56.861 --> 00:21:56.980
It's.
00:21:57.566 --> 00:21:59.036
It's very resilient.
00:21:59.066 --> 00:22:02.006
'cause it has to be,'cause things are hard and challenging.
00:22:02.006 --> 00:22:02.695
Your pen testing
00:22:02.996 --> 00:22:03.625
testing
00:22:03.836 --> 00:22:04.586
an easy job.
00:22:04.586 --> 00:22:06.145
Consulting is not an easy job.
00:22:06.145 --> 00:22:08.185
There's, there's a lot of expectation.
00:22:08.395 --> 00:22:11.486
You know, there's always deadlines, there's always, you know, people like me asking for more,
00:22:11.786 --> 00:22:11.875
for
00:22:11.965 --> 00:22:13.586
um, from the team members.
00:22:13.826 --> 00:22:16.316
So, yeah, you know, just, just keep going and be resilient.
00:22:16.346 --> 00:22:17.816
Is, is probably a good place to start.
00:22:17.905 --> 00:22:18.476
place to start.
00:22:18.836 --> 00:22:21.746
Yeah, I think that's, uh, I think that's, uh, excellent advice.
00:22:21.776 --> 00:22:24.865
So we've talked a lot about pen testing.
00:22:24.895 --> 00:22:27.955
Have you done any sort of red team work, any sort of offensive work as
00:22:28.000 --> 00:22:28.780
Yeah, so
00:22:28.945 --> 00:22:29.395
so
00:22:29.695 --> 00:22:30.191
moving on.
00:22:30.191 --> 00:22:30.911
So I did a lot of pen
00:22:30.925 --> 00:22:31.526
I did a lot of pen
00:22:31.661 --> 00:22:32.411
testing earlier, and then I sort of.
00:22:32.546 --> 00:22:32.726
of,
00:22:32.846 --> 00:22:34.465
I did still do some pen testing.
00:22:34.465 --> 00:22:35.576
We sort of changed
00:22:35.605 --> 00:22:36.296
changed
00:22:36.326 --> 00:22:39.175
lot of red teaming and that's really where the red SNF stuff come in.
00:22:39.175 --> 00:22:40.945
You know, not leaving too many tools behind
00:22:41.246 --> 00:22:41.695
Yeah,
00:22:41.996 --> 00:22:43.405
low and slow as they say.
00:22:43.405 --> 00:22:45.986
So yeah, do a lot of red teaming offensive work.
00:22:46.256 --> 00:22:52.885
But one thing I always tell clients is'cause there was a time when red teaming was, was the new new, and they were always there, oh, we need a red team.
00:22:52.885 --> 00:22:53.576
We need a red team.
00:22:53.740 --> 00:22:53.770
a
00:22:53.846 --> 00:22:55.465
I said, well, have you got your vulnerability scanning?
00:22:55.465 --> 00:22:56.875
Have you got your pen testing in place?
00:22:57.026 --> 00:22:59.006
All those other things that you need.
00:22:59.155 --> 00:22:59.395
need
00:22:59.395 --> 00:23:00.746
the red teaming is useless.
00:23:00.796 --> 00:23:01.155
useless.
00:23:01.240 --> 00:23:02.816
you haven't got those other things in place.
00:23:03.115 --> 00:23:03.195
yes.
00:23:03.310 --> 00:23:07.871
So as, as a boss now, I'm, you know, I'm sort of more sort of, you've gotta get that,
00:23:08.066 --> 00:23:08.546
that,
00:23:08.846 --> 00:23:11.830
continuum of security in your offset is important.
00:23:11.830 --> 00:23:15.611
But so is all the other stuff, the managed security testing services, all that stuff.
00:23:15.611 --> 00:23:21.161
So, so I try and be a bit more pragmatic now than certainly when I was, but everybody's gotta do red teaming.
00:23:21.161 --> 00:23:22.300
You should be doing it all the time.
00:23:22.300 --> 00:23:24.671
You know, we should have six months to conduct a red team and that's.
00:23:24.685 --> 00:23:24.895
red
00:23:24.925 --> 00:23:26.096
Not always feasible.
00:23:26.215 --> 00:23:31.165
So I try and be a lot more pragmatic and, and help organizations in terms of their maturity.
00:23:31.165 --> 00:23:32.215
That's, that's the key thing.
00:23:32.320 --> 00:23:32.800
the key thing.
00:23:33.010 --> 00:23:33.250
Yeah.
00:23:33.250 --> 00:23:34.240
The people.
00:23:34.240 --> 00:23:34.480
Yeah.
00:23:34.480 --> 00:23:36.911
Like having a red team done on you.
00:23:36.911 --> 00:23:38.756
It feels like, like, you know.
00:23:39.685 --> 00:23:50.036
Like if, like, if you haven't done the sort of basic sort of things that pen testing would catch and the basic, uh, sort of security hardening, it'd be like, you know, saying, I wanna fight Rocky Balboa tomorrow, but you haven't done
00:23:50.161 --> 00:23:50.451
Yeah.
00:23:50.750 --> 00:23:52.076
Like, he's, he's gonna pulverize
00:23:52.375 --> 00:23:53.635
That that is,
00:23:53.726 --> 00:23:54.205
what are you
00:23:54.506 --> 00:23:55.736
that's the perfect analogy.
00:23:55.796 --> 00:23:56.155
Absolutely.
00:23:56.155 --> 00:23:56.576
Spot on.
00:23:56.576 --> 00:23:58.346
gotta, you gotta train for a red team.
00:23:58.346 --> 00:24:00.955
Like the, the, the red team is, is sort of like the apex of
00:24:01.256 --> 00:24:01.645
Absolutely.
00:24:02.155 --> 00:24:02.455
Absolutely.
00:24:02.455 --> 00:24:05.395
And so if you, if you don't even really know your own.
00:24:05.770 --> 00:24:07.480
Security mind, like what are you, you know?
00:24:07.480 --> 00:24:07.691
Okay.
00:24:07.691 --> 00:24:11.560
So, uh, do you have any particular sort of, I don't know about war stories.
00:24:11.560 --> 00:24:12.250
I use war stories.
00:24:12.250 --> 00:24:19.121
That's a really bad metaphor, but like what, any unusual experiences with red teaming that you could, uh, relate, you know, within the realms of an
00:24:19.270 --> 00:24:19.961
Yeah, of course.
00:24:20.050 --> 00:24:21.925
Uh, my favorite one,
00:24:22.226 --> 00:24:22.445
one,
00:24:22.746 --> 00:24:28.871
um, is always when we would do some social engineering or some sort of physical attacks
00:24:29.171 --> 00:24:29.260
oh yeah.
00:24:29.560 --> 00:24:31.901
and then like the logical attacks as well.
00:24:32.171 --> 00:24:39.611
So working for an institution in Europe, we would compromise, um, an Office 365 mailbox as it was then,
00:24:39.655 --> 00:24:39.895
it was
00:24:40.090 --> 00:24:40.871
and then we would.
00:24:40.915 --> 00:24:41.336
then we would,
00:24:41.726 --> 00:24:45.445
After doing a lot of emailing and researching, so we had an email for told,
00:24:45.506 --> 00:24:45.655
for
00:24:45.746 --> 00:24:51.355
we would send, uh, an email saying, oh, somebody's gonna come and check the, um, the fire extinguishers in two weeks.
00:24:51.415 --> 00:24:51.566
two
00:24:51.671 --> 00:24:58.451
So then I'd come along then with my fire extinguisher testing kit on, um, you know, we let reception know and all this stuff.
00:24:58.510 --> 00:25:01.931
Then I'd get a little Blackberry device and we, we plug that in then on site.
00:25:01.931 --> 00:25:09.340
So, so while it's not particularly complicated and, you know, it's a well trodden methodology, I like, I, I like the ability of bringing.
00:25:09.641 --> 00:25:10.181
bringing
00:25:10.520 --> 00:25:11.750
and the logical together.
00:25:11.780 --> 00:25:13.810
'cause that's really what the bad guys
00:25:14.111 --> 00:25:14.590
guys
00:25:14.691 --> 00:25:19.490
You know, doing a pure, logical red team is good and definitely stress is an environment.
00:25:19.701 --> 00:25:22.221
Having that physical, social engineering path to it
00:25:22.270 --> 00:25:22.721
pathway to it.
00:25:22.760 --> 00:25:25.101
really, really good and you get a lot of benefit from that.
00:25:25.101 --> 00:25:25.550
I would say.
00:25:25.566 --> 00:25:34.721
that, I'm say, so to make sure you've, you've, you've compromised one particular, a couple of email accounts or whatever, and you've told some very specific people, oh, there's gonna be a fire extinguisher thing.
00:25:34.721 --> 00:25:39.550
And then those are the people who are gonna be kind of nearby when they, and they say, oh, there's, there's
00:25:39.580 --> 00:25:44.141
Yeah, there's the guy and then, you know, I've got the jacket on and I've got the all the ST stuff that I need.
00:25:44.441 --> 00:25:44.560
I
00:25:44.621 --> 00:25:47.651
So, you know, a lot of research and a lot of work, but a lot of fun as well.
00:25:47.965 --> 00:25:52.465
what would, would, I guess, I, I assume I know what the answer, what would, what would've been the workaround?
00:25:52.465 --> 00:25:56.096
Like if, you know, for someone to, uh, not fall for that.
00:25:56.096 --> 00:25:57.520
Just, just sort of confirm it with
00:25:57.820 --> 00:25:57.941
Yep.
00:25:58.240 --> 00:26:01.375
higher up or like, okay, it's weird fire extinguisher.
00:26:01.375 --> 00:26:03.865
And then just sort of ask around and they, and, and they didn't do it.
00:26:03.871 --> 00:26:07.510
Yeah, so generally people are helpful and they wanna be helpful.
00:26:07.601 --> 00:26:12.280
Um, like it was a, it was a reception and I was emailing reception, so they knew I was coming in.
00:26:12.520 --> 00:26:15.941
And again, receptionists by their very nature are helpful.
00:26:16.121 --> 00:26:18.310
They, they want you to move on to the next thing.
00:26:18.461 --> 00:26:19.510
So if you've got a bit of confidence.
00:26:19.810 --> 00:26:20.711
confidence
00:26:20.711 --> 00:26:24.490
got that sort of, that little pretext probably, probably gonna be okay.
00:26:24.730 --> 00:26:27.221
Um, but the checks obviously check up the chain.
00:26:27.340 --> 00:26:29.050
Um, and you know that that's a good thing.
00:26:29.050 --> 00:26:31.691
You know, should, should we be having a fire extinguisher check today?
00:26:31.990 --> 00:26:32.381
today?
00:26:32.471 --> 00:26:36.131
You know, the, whoever looks after that part of the, the team, so yeah, absolutely.
00:26:36.925 --> 00:26:37.165
Okay.
00:26:37.165 --> 00:26:37.586
Interesting.
00:26:37.586 --> 00:26:46.226
So, uh, yeah, going back to the sort of nature of the jobs pen testing and red teaming are professions that are kind of hands-on by nature and they're very problem solving intensive.
00:26:46.226 --> 00:26:50.816
So like if you really want to crack a problem open and the world sees it, they want to hear more from you.
00:26:50.816 --> 00:26:58.105
And we talked about collaborators and so forth, but, uh, I guess because a lot of our listeners are just getting their career journey.
00:26:58.691 --> 00:26:59.441
Uh, started.
00:26:59.441 --> 00:27:07.330
What is your advice for newcomers, specifically trying to get early wins or make an early splash into sort of breaking into this type of
00:27:07.421 --> 00:27:12.550
So when I think back to my career for 24 months, I
00:27:12.580 --> 00:27:13.570
months, I
00:27:13.871 --> 00:27:14.980
obsessive.
00:27:15.611 --> 00:27:16.300
I would
00:27:16.421 --> 00:27:16.780
would
00:27:16.990 --> 00:27:17.560
sleep,
00:27:17.621 --> 00:27:18.310
sleep.
00:27:18.611 --> 00:27:20.621
about pen testing.
00:27:20.996 --> 00:27:23.395
You know, those are the days when a, when a book was really useful,
00:27:23.560 --> 00:27:24.040
useful,
00:27:24.056 --> 00:27:26.276
have a stack of books and I would just
00:27:26.411 --> 00:27:26.590
I would
00:27:26.891 --> 00:27:27.836
devour them all.
00:27:28.076 --> 00:27:30.476
I would practice, practice, practice.
00:27:30.685 --> 00:27:32.726
I was, I said, for a period of time.
00:27:32.800 --> 00:27:32.861
of
00:27:33.161 --> 00:27:37.270
My parents and my girlfriend at the time was now my wife would probably say I went mad
00:27:37.570 --> 00:27:37.871
mad.
00:27:37.931 --> 00:27:39.641
was the only thing I would do.
00:27:39.641 --> 00:27:41.260
It's the only thing I wanted to talk about.
00:27:41.500 --> 00:27:44.171
I was completely obsessed about it.
00:27:44.411 --> 00:27:47.500
So I, if you can get into that, that groove I.
00:27:48.171 --> 00:27:55.415
You, you're in a very smart space and when people start to say, hold on, you're doing too much, then you know you're in it, you know, you know you're in that groove.
00:27:55.715 --> 00:27:56.326
yeah, yeah.
00:27:56.326 --> 00:27:56.645
Great.
00:27:56.750 --> 00:27:57.681
doesn't last forever.
00:27:57.711 --> 00:27:59.480
'cause you, you, you can't keep that going.
00:27:59.480 --> 00:28:00.411
You will burn out.
00:28:00.471 --> 00:28:02.661
And I, that's, I, I did burn out, but I sort of
00:28:02.830 --> 00:28:03.131
I sort
00:28:03.171 --> 00:28:04.070
turned it down a bit.
00:28:04.070 --> 00:28:05.181
My, my girlfriend sort of.
00:28:05.590 --> 00:28:05.861
sort of
00:28:05.955 --> 00:28:07.246
got hold of me and we sort of
00:28:07.300 --> 00:28:07.510
and we
00:28:07.605 --> 00:28:09.796
had a bit more of a balance in life.
00:28:09.855 --> 00:28:16.605
But for certainly for that 24, even 36 months, I was obsessed and I got a job.
00:28:17.086 --> 00:28:22.395
Uh, that, that's the time from, uh, when we had the first pen test when I actually got a job, is that time period.
00:28:22.586 --> 00:28:22.976
period.
00:28:23.066 --> 00:28:23.546
just
00:28:23.695 --> 00:28:24.236
just
00:28:24.596 --> 00:28:26.336
as much information as I could,
00:28:26.365 --> 00:28:26.455
I
00:28:26.756 --> 00:28:28.165
practicing as much as I could.
00:28:28.375 --> 00:28:30.326
And I'd say now it's, it is easy to practice.
00:28:30.476 --> 00:28:33.865
There's labs online, there's a, there's a lot of shortcuts you can now do
00:28:33.925 --> 00:28:34.105
now
00:28:34.316 --> 00:28:34.855
to get you ahead.
00:28:34.885 --> 00:28:37.496
'cause in, in those days, I had to build all my own labs.
00:28:37.496 --> 00:28:39.236
I had to build my own machines, I had to
00:28:39.536 --> 00:28:39.596
Yeah.
00:28:39.895 --> 00:28:40.645
misconfigure them.
00:28:40.645 --> 00:28:43.885
I had to create an app that was mis misconfigured in some way.
00:28:43.885 --> 00:28:49.645
So, so those shortcuts used to your benefit, but get out there, put your name out there, create.
00:28:49.736 --> 00:28:50.306
there, create,
00:28:50.605 --> 00:28:51.746
Um, create tools.
00:28:51.986 --> 00:28:56.185
It doesn't matter if it's a tool that already exists, put your own spin on it exactly as you were saying.
00:28:56.185 --> 00:28:56.576
So there's,
00:28:56.786 --> 00:28:56.965
So
00:28:57.175 --> 00:29:04.016
you know, it's, it's probably easier now than it's ever been to be successful, but at the same time, it's easier to be distracted.
00:29:04.226 --> 00:29:07.165
So be really focused, have that bit of obsessive streak,
00:29:07.465 --> 00:29:07.976
streak
00:29:08.276 --> 00:29:09.986
be resilient, you know, don't take a knock back.
00:29:09.986 --> 00:29:11.830
Take it as a, the next move forward.
00:29:11.830 --> 00:29:12.471
next move forward.
00:29:13.286 --> 00:29:15.326
I want to keep, uh, sort of narrowing the aperture.
00:29:15.326 --> 00:29:19.766
'cause that's, that's great advice for like the first, maybe three to six months of, of work here.
00:29:19.766 --> 00:29:23.846
But because skill hap, skill learning happens steadily and over periods of time.
00:29:23.846 --> 00:29:28.976
Let me ask you this since our, once our listeners are done with this episode, blink turn the office episode off.
00:29:29.211 --> 00:29:30.111
Getting back to their day.
00:29:30.111 --> 00:29:41.810
What's one skill, no matter how small that they should try to learn today, if they want to get into it, whether it's proficiency in a c, a certain type of command line, prompt, or comfort with a certain tool or a productivity hack, what would you start
00:29:41.840 --> 00:29:42.651
Oh, I would say.
00:29:42.816 --> 00:29:43.056
I would
00:29:43.191 --> 00:29:43.556
I, I, I'll
00:29:43.736 --> 00:29:43.855
I,
00:29:43.855 --> 00:29:47.476
say two, if you can get out of vi I to ask anybody
00:29:47.776 --> 00:29:48.135
anybody.
00:29:48.205 --> 00:29:50.846
that that's a win, um, that that's a good thing.
00:29:50.996 --> 00:29:57.086
But being proficient at a programming language like Python, I'd say is a pretty good start.
00:29:57.476 --> 00:30:01.615
Be able to, you know, use sockets and powers a file.
00:30:01.645 --> 00:30:06.221
If you can do those two things, you're probably going to, you know, that's probably 80% of your effort
00:30:06.520 --> 00:30:07.151
effort
00:30:07.316 --> 00:30:11.336
you can create bruteforce tools, you can pause a file, you can cut it up as you want.
00:30:11.576 --> 00:30:13.465
So that, that would be a good start.
00:30:13.645 --> 00:30:17.365
And if you can do that on the command line, you know, using Cut or said or whatever it is,
00:30:17.365 --> 00:30:17.786
whatever,
00:30:17.905 --> 00:30:18.715
also really good.
00:30:18.715 --> 00:30:21.026
So, so be, be proficient with tools.
00:30:21.326 --> 00:30:22.921
with tools
00:30:23.221 --> 00:30:28.080
available, like, you know, there's probably a Python interpreter on most Unix boxes.
00:30:28.230 --> 00:30:31.770
You've gotta be unlucky for there not to be when somebody's had to actively remove it.
00:30:31.770 --> 00:30:32.971
And I would never do that.
00:30:33.181 --> 00:30:38.971
So just, just being professional tools that you've got, or even PowerShell, you know, PowerShell is, is, can be really powerful.
00:30:38.971 --> 00:30:40.201
You can get so much done with that.
00:30:40.530 --> 00:30:49.111
So, you know, so pick your poison Python PowerShell command line and be really good at it and you will quickly learn then, um, you know, o other tools and techniques.
00:30:49.871 --> 00:30:54.941
I think that's, that's great advice too because it, it sort of gets you out of the mindset of.
00:30:55.645 --> 00:31:01.165
I want to start doing this, I need to buy or acquire a thing like this is all stuff that you already probably
00:31:01.465 --> 00:31:02.336
Yeah, absolutely.
00:31:02.635 --> 00:31:03.175
access to.
00:31:03.175 --> 00:31:08.486
Like start with your backyard, start with the thing that's already, you know, came, came standard with your
00:31:08.695 --> 00:31:13.286
Uh, you know, as a good pen test, I would say isn't bringing in unnecessary tools.
00:31:13.586 --> 00:31:14.185
tools.
00:31:14.246 --> 00:31:14.605
Yeah, if
00:31:14.726 --> 00:31:16.060
you know, if there's something that you can use.
00:31:16.076 --> 00:31:16.316
that you.
00:31:16.750 --> 00:31:18.161
That's there, ready to go.
00:31:18.310 --> 00:31:23.381
Just use that because the, the, the noise is just a lot less, you're less likely to get caught or to get ped.
00:31:23.451 --> 00:31:24.230
or to get ped.
00:31:24.536 --> 00:31:24.776
Yeah.
00:31:25.105 --> 00:31:30.701
Uh, so before we go here, ed, I want to ask something of you that I ask all of our guests, what's the best piece of career advice you ever received?
00:31:31.000 --> 00:31:31.601
Oh,
00:31:31.691 --> 00:31:31.911
Oh,
00:31:32.230 --> 00:31:33.131
be resilient.
00:31:34.165 --> 00:31:34.496
Okay.
00:31:34.796 --> 00:31:35.381
don't give up.
00:31:35.590 --> 00:31:36.221
Never give up.
00:31:36.266 --> 00:31:36.776
Yeah,
00:31:36.790 --> 00:31:37.391
ever give up
00:31:37.590 --> 00:31:37.750
Give up.
00:31:38.201 --> 00:31:39.641
because it's easy to give up.
00:31:39.760 --> 00:31:41.351
You know, most people give up.
00:31:41.441 --> 00:31:42.175
Just keep going.
00:31:42.476 --> 00:31:43.016
going.
00:31:43.090 --> 00:31:43.961
going backwards.
00:31:44.290 --> 00:31:48.101
Couple of steps forward, and you know what I call it like stacking days.
00:31:48.280 --> 00:31:49.540
So you might learn a little command.
00:31:49.721 --> 00:31:51.701
Eventually those stacking days will add up
00:31:51.806 --> 00:31:51.925
will
00:31:52.000 --> 00:31:54.371
and you'll be in some environment that you've never seen before.
00:31:54.580 --> 00:31:54.911
Oh yeah.
00:31:54.911 --> 00:31:55.510
Remember that?
00:31:55.570 --> 00:31:56.141
Boom, boom, boom.
00:31:56.171 --> 00:31:56.980
You're away your route.
00:31:57.401 --> 00:31:58.451
So Yeah, never give up.
00:31:58.500 --> 00:31:59.020
Never get up.
00:31:59.276 --> 00:31:59.695
Heck yeah.
00:31:59.905 --> 00:32:00.986
Knock down seven times.
00:32:00.986 --> 00:32:01.195
Get up
00:32:01.496 --> 00:32:01.871
Exactly.
00:32:02.080 --> 00:32:02.546
Exactly.
00:32:02.846 --> 00:32:08.336
So, um, as we wrap up, uh, ed, um, we didn't talk about it a lot, but, uh, Trustwave is kind a big name.
00:32:08.336 --> 00:32:12.056
Tell our listeners all about, uh, Trustwave and, and and what you do for your, uh, your
00:32:12.355 --> 00:32:15.445
Yeah, so we're a, a managed security service provider at MSSP.
00:32:15.820 --> 00:32:17.260
Um, that's, that's not my team.
00:32:17.260 --> 00:32:19.780
I look after the consulting and professional services.
00:32:19.961 --> 00:32:24.790
So we do, we do pen testing, red teaming, cyber advisory, dfa, all, all that good stuff.
00:32:24.851 --> 00:32:24.971
good
00:32:25.270 --> 00:32:29.560
Um, so we're part of the Spy Labs team, so we've been around for 25 years.
00:32:29.560 --> 00:32:31.181
We've written loads of good tools.
00:32:31.750 --> 00:32:33.191
We're, we've been around a long time.
00:32:33.191 --> 00:32:33.911
We know what we're doing.
00:32:33.971 --> 00:32:35.500
That's, that's what I say to people.
00:32:35.560 --> 00:32:35.830
to people.
00:32:36.101 --> 00:32:36.431
Yeah.
00:32:36.490 --> 00:32:37.000
That's awesome.
00:32:37.000 --> 00:32:38.590
So, uh, one last question.
00:32:38.590 --> 00:32:44.260
Tell our listeners where to find out more about Ed Williams Trustwave or any events or things you'd like to promote about yourself
00:32:44.290 --> 00:32:44.560
Yeah.
00:32:44.800 --> 00:32:45.820
Uh, go on the website,
00:32:45.855 --> 00:32:46.076
The
00:32:46.375 --> 00:32:46.810
trustwave.com.
00:32:46.840 --> 00:32:47.530
Pretty straightforward.
00:32:47.590 --> 00:32:49.631
Um, I'm on LinkedIn, Edward Williams.
00:32:49.691 --> 00:32:51.221
Please link in LinkedIn to me.
00:32:51.611 --> 00:32:54.276
I've got the, um, the BBC Micro as my background, so you'll,
00:32:54.576 --> 00:32:54.875
so you,
00:32:55.175 --> 00:32:56.320
you'll recognize.
00:32:56.736 --> 00:32:56.955
all
00:32:57.161 --> 00:32:57.520
Yeah.
00:32:57.576 --> 00:32:57.836
All right.
00:32:58.451 --> 00:32:59.621
So you'll recognize that.
00:32:59.621 --> 00:33:00.611
I'm happy to connect.
00:33:00.760 --> 00:33:02.260
I get a lot of people asking me questions.
00:33:02.260 --> 00:33:03.941
I'm always happy to, to do my best.
00:33:04.000 --> 00:33:04.510
do my best.
00:33:04.570 --> 00:33:05.800
Somewhere just out of frame.
00:33:05.800 --> 00:33:09.340
A uh, a, a old cassette player is, is humming and, uh, yeah.
00:33:09.520 --> 00:33:10.090
Yeah.
00:33:10.391 --> 00:33:11.320
Ready to deliver your
00:33:11.381 --> 00:33:11.861
Exactly.
00:33:11.951 --> 00:33:12.401
Ed William.
00:33:12.760 --> 00:33:16.540
Ed Williams, thank you for regaling our listeners with some of your best pet tests and red team stories.
00:33:16.540 --> 00:33:17.951
I know they're gonna love this episode.
00:33:18.040 --> 00:33:18.490
My pleasure.
00:33:19.615 --> 00:33:23.846
Uh, and thank you to everyone who watches, listens, and writes into the podcast with feedback.
00:33:23.846 --> 00:33:28.705
If you have any topics you'd like us to cover or guests you'd like to see on the show, uh, drop'em in the comments below.
00:33:28.705 --> 00:33:29.965
We'll try and do what we can.
00:33:30.205 --> 00:33:37.675
Now before we go, don't forget InfoSec institute.com/free is where you can get a whole bunch of free and exclusive stuff for cyber work listeners.
00:33:37.675 --> 00:33:45.385
It's here that you'll find our free cybersecurity Talent Development Playbook, which includes in-depth training plans and strategies for the 12 most common security roles.
00:33:45.671 --> 00:33:53.230
Including stock analyst, pen tester, cloud security engineer, information risk analyst, privacy manager, secure coder, ISCS, professional and more.
00:33:53.740 --> 00:33:56.020
Wanna know how much a career in cybersecurity pays.
00:33:56.050 --> 00:34:01.780
Get our free cybersecurity salary guide for the latest data on popular certifications in their related roles.
00:34:02.111 --> 00:34:07.810
There's also security awareness posters, eBooks, and you can sign up for a hundred plus free courses in our InfoSec skills platform.
00:34:08.021 --> 00:34:11.170
You can learn incident response, forensic security architecture and more.
00:34:11.440 --> 00:34:13.181
Uh, even I've played around in there and.
00:34:13.206 --> 00:34:16.025
I didn't cry once, so it's uh, actually pretty easy to use.
00:34:16.025 --> 00:34:16.626
One more time.
00:34:16.835 --> 00:34:20.916
That's InfoSec institute.com/free, and the link is in the description below.
00:34:21.246 --> 00:34:25.505
One last time, thank you to Ed Williams and Trustwave, and thank you all for watching and listening.
00:34:25.775 --> 00:34:27.186
This is Chris Sanko signing off.
00:34:27.186 --> 00:34:29.916
Until next time, make sure to learn something new every day.
00:34:29.945 --> 00:34:33.215
Keep one step ahead of the story and don't forget to have a little fun along the way.
00:34:33.485 --> 00:34:34.025
Bye for now.