逐字稿 🔗
WEBVTT
00:00:00.239 --> 00:00:04.240
The Security Champions Podcast is brought to you by Security Journey.
00:00:04.400 --> 00:00:10.960
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
00:00:11.119 --> 00:00:13.599
Learn more at SecurityJourney.com.
00:00:17.760 --> 00:00:21.280
Welcome to another episode of the Security Champion Podcast.
00:00:21.440 --> 00:00:26.239
I'm your host, Michael Birch, and today we have a unique episode.
00:00:26.480 --> 00:00:29.199
You'll notice I'm not in my usual studio setup.
00:00:29.359 --> 00:00:41.359
I'm joined today with a bunch of students from North Carolina State University that we partnered with over this last semester to create a really cool project to let us move faster in the way that we build content.
00:00:41.520 --> 00:00:48.799
And I brought them here to have a conversation about that experience, the things they learned, and kind of share that with the rest of the audience here.
00:00:48.960 --> 00:00:52.799
Because here's the reality these are some of the earliest security champions.
00:00:52.880 --> 00:01:00.159
These are people that are out there building tools, working in school, and showing that interest and security before they even get to the organization.
00:01:00.320 --> 00:01:04.159
So let's talk about what drives that and see their experience.
00:01:04.560 --> 00:01:09.599
To start with this, what I always do is we talk about what your security journeys are.
00:01:09.760 --> 00:01:18.959
I know you guys are maybe earlier in those security journeys, but I want me you to tell me about your experience, what you've done up to this point, what you're studying, what you want to do after this.
00:01:19.120 --> 00:01:20.560
So we're gonna start with you, Britton.
00:01:20.640 --> 00:01:25.359
Tell us your full name, who you are, um, and kind of your security journey.
00:01:25.599 --> 00:01:26.319
Thanks, Michael.
00:01:26.400 --> 00:01:28.400
Yeah, uh my name's Brittany Janae.
00:01:28.719 --> 00:01:32.159
Um I think my security journey started a long time ago.
00:01:32.239 --> 00:01:35.680
I've always been interested in technology in middle school.
00:01:35.760 --> 00:01:40.560
I I hate to say it, but I would try to get around the firewall to play games in class sometimes.
00:01:40.719 --> 00:01:42.560
And so I think that's where it kind of started.
00:01:42.640 --> 00:01:54.400
But eventually I was inspired my sophomore year at NC State by my first computer science professor to um hunt down like bad guys on the dark web.
00:01:54.480 --> 00:02:00.000
Um he showed us some steganography, and I was like, okay, if this is what I feel like this is my calling, like it feels righteous.
00:02:00.159 --> 00:02:10.639
And um eventually I just really enjoyed the actual process of learning um technology, especially in the offensive security field.
00:02:10.879 --> 00:02:21.280
So I started uh studying for my OSCP, I got my sec plus, and that kind of drove me to be a part of Security Journey Senior Design Group.
00:02:21.439 --> 00:02:31.680
I saw you guys were really into making offensive and defensive security labs, and because of that, I I felt drawn to the mission, and that's why I'm here.
00:02:32.000 --> 00:02:32.479
Awesome.
00:02:32.560 --> 00:02:37.039
And and so to like offensive stuff, amazing stuff, and I and that is kind of a caveat.
00:02:37.120 --> 00:02:49.199
I should let people know what we did here, is at Security Journey we sponsored a group of students to work on a project for us, and we picked something about building our our labs and helping automate and speed that process up.
00:02:49.439 --> 00:02:54.159
Um, out of that then, so so get what you're trying to study.
00:02:54.400 --> 00:02:56.080
Are you looking to get into off sec?
00:02:56.400 --> 00:02:58.159
Is that kind of your next step of your journey?
00:02:58.400 --> 00:02:59.360
Yes, 100%.
00:02:59.840 --> 00:03:12.560
I um I have my OSCP exam scheduled, but one thing I really want to do is I just feel like one of the best things that we can do is emulate the attackers and find the weaknesses before they can.
00:03:12.719 --> 00:03:20.800
And one of the best ways to do that is to do offensive security, opposes the attackers before they can find anything that they can use.
00:03:21.039 --> 00:03:22.639
Um it's also just fun to me.
00:03:22.719 --> 00:03:33.199
I really like puzzles, and I really like I really, really like not breaking things, but like seeing how I can like kind of like change things, like, oh, press a button, like, oh, what does this do?
00:03:33.360 --> 00:03:35.360
You know, when I'm not supposed to.
00:03:35.599 --> 00:03:48.240
And um, I think that um it's also extremely important just to show people like hey, this is extremely possible that something bad could happen, and then being able to actually use my skills to show them that.
00:03:48.560 --> 00:03:52.080
Um yeah, I I think that's definitely what I want to do.
00:03:52.159 --> 00:03:56.159
I'm pretty passionate about it, and it's something that I'm I'm very interested in.
00:03:56.479 --> 00:03:57.039
It's amazing.
00:03:57.199 --> 00:03:58.719
I can't wait to see what you do.
00:03:58.960 --> 00:04:00.800
All right, Quinn, tell us about you.
00:04:00.960 --> 00:04:05.360
Full name, what are you studying, what got you to the point you are, what are you doing next?
00:04:05.759 --> 00:04:06.879
So I'm Quinn Merkel.
00:04:07.120 --> 00:04:11.280
I I've always been interested in technology, same with Britain, ever back even back in middle school.
00:04:11.360 --> 00:04:13.360
I've always loved programming too.
00:04:13.520 --> 00:04:17.759
Um but then in about freshman year, I was like, I didn't know exactly what I wanted to go into.
00:04:17.839 --> 00:04:27.680
I knew I wanted to do engineering and something with computers, but I went I ended up going to computer science partly because I joined HackPack, a club
Load full transcript
at NC State, which is all about offensive security, actually.
00:04:27.920 --> 00:04:34.800
So they got me interested in all that kind of stuff, um, including uh, you know, just basic uh offensive security.
00:04:34.959 --> 00:04:44.000
And then I took a couple more classes in the cybersecurity concentration at state, you know, our class about offensive security, our network security class, stuff like that, and I got more and more interested.
00:04:44.160 --> 00:04:50.000
And then this summer I'm actually gonna go and get my OSCP done as well, so I can do some of that hopefully when I graduate.
00:04:50.240 --> 00:04:51.519
I'm surrounded by hackers.
00:04:51.600 --> 00:04:53.519
We got a lot of off sec going on here.
00:04:53.680 --> 00:04:54.399
That's awesome.
00:04:54.639 --> 00:04:56.959
Um so getting into the offsec stuff.
00:04:57.199 --> 00:05:05.040
All right, we practiced this like a dozen times to say your name right, but I think it's best if you just introduce yourself so I don't butcher it and tell me about what you do.
00:05:05.360 --> 00:05:11.680
Hi, uh I am Snehan Susamanza, and um my I well, I study computer science.
00:05:11.839 --> 00:05:15.439
Uh my securities journey, I mean, I don't know where when it started.
00:05:15.600 --> 00:05:24.720
It's it's basically, you know, when you're a kid and you are playing games on someone's phone, your mom's or your dad's or someone's phone, your grandparents.
00:05:25.040 --> 00:05:27.360
There's a phone in the house, you play games on it, right?
00:05:28.160 --> 00:05:32.959
I mean, whenever I played a game on it, it would probably I would probably break something.
00:05:33.439 --> 00:05:40.160
There would be some setting I would change and would literally break it, and I would always had have to fix that.
00:05:40.319 --> 00:05:41.920
And that was basically my thing.
00:05:42.079 --> 00:05:45.759
Every anytime there was a technological problem, I had to fix it.
00:05:46.000 --> 00:05:47.920
And that's just basically how it was.
00:05:48.160 --> 00:05:52.319
I also was I mean, I think I'm still pretty good at math.
00:05:52.720 --> 00:05:56.879
Um so because of that I just got into computer science.
00:05:56.959 --> 00:06:07.279
I just loved solving puzzles, fixing things, and just building something or just making something for a problem that I was just given to solve.
00:06:07.600 --> 00:06:15.360
And I actually was taught like I I had a coding class when in fifth grade, it wasn't basic.
00:06:16.079 --> 00:06:18.720
And that was just the beginning, I guess.
00:06:18.879 --> 00:06:21.360
It was pretty low level, but yeah.
00:06:22.000 --> 00:06:23.360
So what are you planning to do next?
00:06:23.439 --> 00:06:26.399
What's your what's your uh next step after this program?
00:06:26.879 --> 00:06:29.120
Yes, uh I am still figuring that out.
00:06:29.360 --> 00:06:31.040
Um I don't know.
00:06:31.199 --> 00:06:34.720
Uh I am just going as it goes, I guess.
00:06:34.800 --> 00:06:37.680
Um learning things.
00:06:37.839 --> 00:06:39.600
Um I think I'm just figuring out.
00:06:39.920 --> 00:06:40.240
You know what?
00:06:40.319 --> 00:06:42.560
I think I'm still figuring it out too, so you're right.
00:06:43.120 --> 00:06:46.720
That's one of the great things about this type of field and these type of studies, right?
00:06:46.879 --> 00:06:48.160
It's ever changing, right?
00:06:48.240 --> 00:06:56.399
If I were to talk to you guys about, I don't know, a year ago about what I did and what I was thinking, what I was working on, completely different than what I'm working on now, right?
00:06:56.480 --> 00:07:02.000
So not having it all figured out is perfectly okay in an industry that changes this fast, right?
00:07:02.399 --> 00:07:02.879
Absolutely.
00:07:03.519 --> 00:07:05.360
Constantly learning, trying to keep up.
00:07:05.680 --> 00:07:06.480
Absolutely.
00:07:06.720 --> 00:07:08.800
All right, so I have my team here.
00:07:08.959 --> 00:07:13.120
You guys all NC State students worked on a project with us.
00:07:13.199 --> 00:07:14.879
What we're gonna do is we're gonna take a quick break.
00:07:14.959 --> 00:07:22.480
We're gonna do a word from our sponsors, but then I want to start talking about the project that you guys worked on, what you guys learned and what your experience was.
00:07:23.279 --> 00:07:27.120
The Security Champions Podcast is brought to you by Security Journey.
00:07:27.439 --> 00:07:36.240
Security Journey is an enterprise class secure coding training platform with lessons that are built on learning science principles to deliver long-term, measurable results.
00:07:36.399 --> 00:07:38.639
Learn more at securityjourney.com.
00:07:40.319 --> 00:07:42.959
Alright, welcome back to the Security Journey Podcast.
00:07:43.040 --> 00:07:52.959
I am joined by a group of North Carolina State University students that helped work on a project for Security Journey to actually help us build labs faster.
00:07:53.120 --> 00:07:53.759
So let's start.
00:07:53.839 --> 00:07:55.439
I'm gonna pick on you, Quinn.
00:07:55.839 --> 00:07:59.040
Give us kind of an overview of what you guys did this semester.
00:07:59.360 --> 00:08:05.360
So we were tasked with creating a product that could automate the setup of the configuration files for your lessons.
00:08:05.519 --> 00:08:09.199
So, you know, the Docker files, Kubernetes configuration files, stuff like that.
00:08:09.360 --> 00:08:15.759
Stuff that just a lot of busy work takes a lot of time because you've got to get things exactly right, but not a whole lot of actual thinking going on.
00:08:15.839 --> 00:08:17.360
You're just writing out code.
00:08:17.600 --> 00:08:24.240
So what we did is we take the output from your internal tool factory, and then we turn that into just the built-out files.
00:08:24.319 --> 00:08:27.519
And we take a little bit of user input to get some of the finer details right.
00:08:27.600 --> 00:08:32.240
And it's meant to not get you 100% of the
way there, but it gets you about 90% 99% of the way there.
00:08:32.399 --> 00:08:36.639
And you just got to fill in those just the little things that you know we can't account for on every single run.
00:08:36.960 --> 00:08:45.039
The biggest thing there is you took something that was a manual long process on our end and you condensed the amount of time it took us to do that, right?
00:08:45.200 --> 00:08:47.679
So what was kind of the what was the output effect of that?
00:08:48.000 --> 00:08:55.840
So our goal was to bring, because we were told that you're it took you guys about three to four hours to create just those configuration files, we can get it down to about 15 minutes, we hope.
00:08:56.159 --> 00:08:58.639
Well, that is an amazing output.
00:08:58.799 --> 00:08:59.679
I like the sign of that.
00:08:59.840 --> 00:09:03.840
I'm pretty sure my entire content team loves not having to do that manually, also.
00:09:04.320 --> 00:09:10.480
Um so a great project, and the biggest thing is it has a some complexity with that too, right?
00:09:10.559 --> 00:09:14.480
So, what are some of the complexities you guys ran into in solving this issue?
00:09:15.120 --> 00:09:31.039
I think I can start that off, but I I definitely want to tag these guys in eventually because we all had different things, but me personally, um uh so I started off by making the Kubernetes files, and originally I was like, okay, this is easy, it'll just be a file write.
00:09:31.279 --> 00:09:37.440
And eventually when I was talking with Noah, I realized, oh wow, there's actually a lot of complexity to this.
00:09:37.600 --> 00:09:42.960
So uh there would be niche application interfaces that they'd want um that you guys would want.
00:09:43.120 --> 00:10:02.080
So IDEs, um different coding languages for the actual IDE itself, uh whether it was a mobile device and or a Linux terminal, um, there were a bunch of different applications that we needed to add, but we didn't know what the actual basis was for adding them.
00:10:02.399 --> 00:10:14.799
Sometimes we would add them in the factory file from the application, it would come with three defined apps that they wanted to add, but then there would be more that we had to add after.
00:10:15.120 --> 00:10:23.519
And so figuring out how to do that, like those niche little edge cases, became probably the most complex problem out of all of them.
00:10:23.759 --> 00:10:29.200
Um and then on top of that, I'd honestly, Quinn, do you want to talk about standardizing the actual file creation?
00:10:29.360 --> 00:10:30.000
Yeah, go ahead.
00:10:30.320 --> 00:10:34.960
So there wasn't a huge really a standard before, because you know every developer does things slightly their own way.
00:10:35.039 --> 00:10:40.799
So the Docker files especially take a lot of you know individualism to them because there's it's just running commands.
00:10:40.960 --> 00:10:44.799
So what we did is we went through and we created a standard and made a set of
templates.
00:10:45.039 --> 00:10:50.799
And from there you can actually look at, we did a lot of work in making it so that this is very adaptable later.
00:10:50.960 --> 00:11:00.960
So you know, if things change, version numbers change, um, you want to start using different technologies, all you got to do is add a couple lines to one of our configuration files and everything stays working.
00:11:01.279 --> 00:11:01.840
Nice.
00:11:02.080 --> 00:11:07.600
So a lot of that is is taking these complex, diverse problems that have a lot of different use cases, right?
00:11:07.679 --> 00:11:11.600
Because we're not just building one kind of lab, we're not doing one type of process, right?
00:11:11.759 --> 00:11:20.320
A lot of diversity in what we're doing, and a lot of complexity, and how do we how do we capture all that and create a unified way to approach the problem, right?
00:11:20.559 --> 00:11:32.879
And that's that's definitely an exciting thing to kind of work on, especially when you think about the different styles of developers working on this, because we don't have one engineer working on it, we have all sorts of developers working on this, and how do we standardize that?
00:11:33.120 --> 00:11:35.919
Um, really fun and amazing problems to solve.
00:11:36.080 --> 00:11:43.679
I actually would love to like pull back a little bit and think about the way your guys' course work, because it wasn't just solving our problem, right?
00:11:43.840 --> 00:11:49.200
The point of your class isn't to learn how to use Docker files or learn how to build interfaces.
00:11:49.360 --> 00:11:50.240
What's the point of the class?
00:11:50.320 --> 00:11:52.879
Like, what were you guys learning along the way?
00:11:53.679 --> 00:12:01.200
So the best way I think it was learning how to work as a team in a real production environment.
00:12:01.360 --> 00:12:05.840
Because before this, we take one other class that's on it, which is software engineering.
00:12:05.919 --> 00:12:14.960
And that kind of gets you like in it barely, but like a lot of the stuff that they give you is already well built out, and there's you're not really starting from nothing and you're not going into a production environment.
00:12:15.200 --> 00:12:27.600
So this is our first opp one of the first opportunities we get to really go through and learn how to work as a team of developers on a project that will end up being used and will be inspected very closely because of it.
00:12:27.919 --> 00:12:28.159
All right.
00:12:28.320 --> 00:12:30.080
You're not talking a lot, I'm gonna pick on you.
00:12:30.159 --> 00:12:32.559
What are some of those workflows that you guys had to do, right?
00:12:32.639 --> 00:12:36.960
Like it didn't just wasn't go just work on the project, you had to do stuff ahead of time.
00:12:37.120 --> 00:12:41.919
There's a bunch of like validation and testing and presentations, like what was involved in that.
00:12:42.240 --> 00:12:43.679
Yeah, well, we did some research.
00:12:43.840 --> 00:12:52.720
Um we were taught we were just thinking about um what ki what were the kind of kinds of designs that would that we would probably take up, you know.
00:12:52.879 --> 00:13:00.639
At first we were probably do thinking about making an a AWS standard function, which we kind of scrapped.
00:13:00.720 --> 00:13:11.759
Um Britton can explain why we did that, but oh um the reason why was because in order to get AWS access, um, there were some more steps we had to take.
00:13:11.919 --> 00:13:17.600
So also it wouldn't allow us the biggest thing was um the developers.
00:13:17.919 --> 00:13:30.159
It would be easier if we had a actual interface, like a CLI, in order for them to prompt, oh, hey, are there any other applications that you want to add to these Docker and Kubernetes files?
00:13:30.480 --> 00:13:34.799
So if we had an AWS Landua function, it would be automated, and we couldn't do that.
00:13:35.200 --> 00:13:46.879
But if we had a CLI, when you create the files from the factory file, it'll actually ask you, well, our our product, I mean, our product will actually ask you, like, hey, are this there anything else you want to add on here?
00:13:46.960 --> 00:13:51.120
And it'll be a multi-like a um oh gosh, multiple choice.
00:13:51.200 --> 00:13:52.000
That's what I mean to say.
00:13:52.159 --> 00:13:58.240
Multiple choice, and you can select them, and then it'll automatically add it based off of previous designs.
00:13:58.639 --> 00:13:59.120
Yeah.
00:13:59.360 --> 00:14:04.639
Um it's an independent package that you can use in your own command line interface.
00:14:05.039 --> 00:14:05.759
That's awesome.
00:14:05.919 --> 00:14:08.159
That's yeah, and that that's amazing.
00:14:08.559 --> 00:14:10.639
So design decision, right?
00:14:10.720 --> 00:14:11.679
That that's where you started.
00:14:11.919 --> 00:14:16.080
You had you had to come up with a bunch of different options of how you would solve this problem, right?
00:14:16.399 --> 00:14:23.600
And part of that was interacting with my team and individuals to understand our architecture and what you had to build onto, right?
00:14:23.919 --> 00:14:37.200
Um, as you did that design process, um, having seen how these classes go before, I'm pretty sure there's some other security tasks you might have had to do along the way, like I don't know, maybe some threat modeling, some security testing.
00:14:37.360 --> 00:14:39.679
Like, like talk to me some about that workflow.
00:14:39.759 --> 00:14:42.240
How did you do how did you manage project management?
00:14:42.399 --> 00:14:45.440
How did you do like what were those type of processes?
00:14:45.600 --> 00:14:47.039
What do you learn from that?
00:14:47.600 --> 00:14:49.279
So I think I can dig that one.
00:14:49.600 --> 00:14:50.399
Yeah, you want to go for it.
00:14:50.960 --> 00:14:53.440
So we kind of did a uh Scrum framework almost.
00:14:53.519 --> 00:15:00.879
We had weekly meetings, actually, we had bi-weekly meetings, we met at least twice a week, twice a week, and then another third time with our sponsor, with uh Noah.
00:15:01.279 --> 00:15:04.240
And then we went through and we planned out our tasks for that week.
00:15:04.399 --> 00:15:07.360
We checked in every meeting and we made sure that we were all keeping up to date.
00:15:07.519 --> 00:15:19.279
We used GitHub projects for our project management, so we had to plan out what tasks need to be done now, what can be left for a little bit later down the timeline, what do we when do we want to have our final project done, stuff like that.
00:15:19.759 --> 00:15:30.639
Yeah, and I think one of the biggest things in terms of the project management was we didn't have one like centralized leader telling um like keeping everyone on track.
00:15:30.799 --> 00:15:45.279
It was more we divided ourselves amongst what we thought were we I were identi able to identify each portion of the project and then who was the strongest or who knew the most in each, and then assign them to each individual task.
00:15:45.440 --> 00:15:50.639
Because there were a lot of moving parts to the tool that we were creating, and uh that was the most successful part.
00:15:50.960 --> 00:16:16.720
The threat modeling, uh, because you mentioned it, I thought this would be cool, but as of the time that we're talking about this, software supply chain attacks are running rampant right now, and that's actually the number one threat that we're gonna be experiencing, is because the packages that we use, obviously we have them pinned right now, but uh just like anyone else, um, they're vulnerable to you know malicious code.
00:16:16.960 --> 00:16:18.399
Fortunately, we're good.
00:16:19.200 --> 00:16:26.480
Like um we're uh that's probably the only threat that we have, but thankfully, because it's an insider tool, we should be good.
00:16:26.799 --> 00:16:27.120
Yeah.
00:16:27.519 --> 00:16:29.519
And that's an interesting part about this class, right?
00:16:29.759 --> 00:16:31.440
I love that NC State does this.
00:16:31.519 --> 00:16:40.399
They put you in this environment where not just solve a problem for business, it's understand how businesses solve these problems, right?
00:16:40.639 --> 00:16:49.440
Because you got not only the insight of you had to run your own business management, but you worked with us like a third-party source that you were consulting for, right?
00:16:49.519 --> 00:16:51.600
And you had a product owner, right?
00:16:51.679 --> 00:16:58.159
Which I would have to say was a big shout out to Noah Morris for being that that sponsor for you guys and working with you guys.
00:16:58.320 --> 00:17:05.359
If anyone doesn't know, Noah Morris is a senior security engineer that helps build a lot of our content on our side and was with you every step of the way.
00:17:05.599 --> 00:17:06.960
He was incredibly helpful the whole time.
00:17:07.200 --> 00:17:07.759
Yeah, he was.
00:17:07.920 --> 00:17:09.599
He
answered so many questions.
00:17:10.160 --> 00:17:10.480
Yeah.
00:17:10.799 --> 00:17:15.680
We were in touch with him on Slack, like for hours, like every single week.
00:17:15.920 --> 00:17:16.079
Yeah.
00:17:16.400 --> 00:17:16.640
Yeah.
00:17:17.039 --> 00:17:18.319
So so what's that like?
00:17:18.400 --> 00:17:26.319
And then what's what insight did that give to you into kind of working in like with a senior developer and security engineer that has a lot of this stuff?
00:17:26.480 --> 00:17:30.640
Like, what did you learn from kind of NOAA in this process too, I guess, along the way?
00:17:31.119 --> 00:17:32.079
That's a good question.
00:17:32.319 --> 00:17:32.880
Yes, it is.
00:17:33.119 --> 00:17:34.400
There are no stupid questions.
00:17:34.640 --> 00:17:36.160
There are absolutely no stupid questions.
00:17:36.319 --> 00:17:42.640
Everyone is totally human and you can have any questions at any time, no matter how small they are.
00:17:42.960 --> 00:17:43.279
Yeah.
00:17:43.440 --> 00:17:43.599
Yeah.
00:17:43.920 --> 00:17:44.480
100%.
00:17:45.039 --> 00:17:49.599
It's better to clarify than spend a bunch of time writing code that just won't work and then having to go back and refactor it.
00:17:49.839 --> 00:17:52.400
Yes, Nahanchi hit the nail on the coffin right there.
00:17:52.640 --> 00:17:53.279
There were so many.
00:17:53.680 --> 00:17:56.720
I was gonna ask I would ask him, like, hey, what does this mean?
00:17:57.359 --> 00:18:00.720
And he was so helpful, but that's what a senior developer does.
00:18:02.240 --> 00:18:04.720
Helped us set the standard for all the configuration files.
00:18:04.880 --> 00:18:15.680
Like for every small keyword, every small line of code that we had, we asked Noah every single detail, and he was incredibly helpful in answering each one of those questions.
00:18:16.000 --> 00:18:21.599
A big drive-home point for that, too, and something I hope you guys take away from this, is you think that's like a thing you're learning in school.
00:18:21.680 --> 00:18:24.960
No, this is things that teams get wrong all the time.
00:18:25.279 --> 00:18:25.599
Right?
00:18:25.839 --> 00:18:35.039
Actually understanding the end user problem, collecting the right information to solve it the right way before you do work, like it seems like the most critical part, which it is.
00:18:35.359 --> 00:18:38.400
You'd be amazed at how often teams struggle with this.
00:18:38.480 --> 00:18:39.599
There's dedicated jobs.
00:18:39.680 --> 00:18:52.400
That's what UIUX and a bunch of these other uh roles are for, is they help you actually take the dev team and they go and interact with the customer and end user for you and collect all the information and the testing to help influence what we build.
00:18:52.559 --> 00:18:55.519
And I've seen teams, I've worked on teams where that's disconnected.
00:18:55.599 --> 00:19:08.799
And when that disconnects, is engineers like, I have a problem, I know the best way I'd solve it, but they're not seeing it necessarily from the customer, and they're not talking to the customer, and all of a sudden they build something really great the customer can't use because it's not for the right problem, right?
00:19:09.039 --> 00:19:22.960
So that that that's something that's I really do hope you take away from this is ask a lot of questions, like know what you want to do before you build, because that front-end work is gonna help you so much along the way as you keep building.
00:19:23.200 --> 00:19:28.000
Um all right, so let's let's let's let's back into the project, some of the things you learned.
00:19:28.079 --> 00:19:28.880
Let's talk about AI.
00:19:28.960 --> 00:19:30.079
AI is a hot topic.
00:19:30.160 --> 00:19:33.599
I can never get through a podcast without bringing it up at least once.
00:19:33.839 --> 00:19:37.039
Um, how did AI influence you guys' project?
00:19:37.680 --> 00:19:43.440
Yeah, a little bit, like initially a little bit of understanding just of the overall code base.
00:19:43.839 --> 00:19:53.359
I mean, there was a lot of detail on read on the README, but like some of the inner details of the code base, like some some of the directories, some of the files, yeah.
00:19:53.519 --> 00:19:56.319
It was easier to understand using AI.
00:19:56.720 --> 00:20:02.079
That's amazing, because that's something that I think people like don't give AI the credit it it deserves.
00:20:02.240 --> 00:20:06.400
So many was everyone's all about, well, it helps me build faster, it helps me write code.
00:20:06.640 --> 00:20:11.680
But what about that person that's coming on your project that needs faster insight of what's there?
00:20:11.839 --> 00:20:21.359
Like leveraging AI to dissect that and translate that in ways that and I'll be honest, most of us are not great at building the read me, or no, it's not nearly to the level that we should be.
00:20:21.440 --> 00:20:27.680
You have a couple rock star engineers that do that stuff well, but the majority of us out there leave out a lot of detail, right?
00:20:27.759 --> 00:20:33.920
And that's one of the hardest things to hand out for a project, but having AI to be able to distill that, that's powerful.
00:20:34.079 --> 00:20:38.160
Because that changes AI from replace, not just AI is doing work for me.
00:20:38.319 --> 00:20:43.680
AI is helping me learn, it's helping me understand, it's empowering me, and that's such a great use case of it.
00:20:43.839 --> 00:20:44.880
How well how else though?
00:20:44.960 --> 00:20:45.839
I gotta dig more.
00:20:45.920 --> 00:20:47.039
What else do you guys use AI for?
00:20:47.440 --> 00:20:51.039
I primarily used it in mine for debugging mostly.
00:20:51.119 --> 00:21:01.359
Like, you know, error comes up, I use it to understand the error that appeared, understand where in the code caused it, how to fix the syntax, how to learn syntax I didn't already know to make things more efficient, stuff like that.
00:21:02.000 --> 00:21:06.880
Yeah, I think for me it was more like finding tools and packages to use.
00:21:07.039 --> 00:21:17.920
So my when we first started, I would mention earlier having a CLI multiple choice list, and one thing we eventually adopted was a whole helper function called inquirer.
00:21:18.319 --> 00:21:31.119
And when I first started, I when I was talking to Noah, I was thinking, okay, well, we need something that will actually take in, show the user a list of 20 apps and actually allow them to choose it.
00:21:31.359 --> 00:21:34.880
And since we're using a CLI, I needed to find a CLI package.
00:21:35.039 --> 00:21:43.519
Um I asked I asked Google Gemini, I was like, hey, what's a great package to use for a command line interface multiple choice?
00:21:43.839 --> 00:21:51.279
Sure enough, led us to Inquirer Pi, and then we were able to put that into our project, implement it, and like I thought it was really cool.
00:21:51.440 --> 00:21:54.079
Noah thought it was really cool, and it ended up working perfectly.
00:21:54.160 --> 00:21:55.440
It was exactly what we needed.
00:21:55.759 --> 00:21:57.680
And that's a great place for it too, once again.
00:21:57.759 --> 00:22:01.839
And what I haven't heard any of you say is, oh, I just Use AI to try to write all of it for me.
00:22:02.000 --> 00:22:03.200
You used it for research.
00:22:03.279 --> 00:22:04.559
You used it for understanding.
00:22:04.720 --> 00:22:06.640
You used it for what was yours again?
00:22:06.799 --> 00:22:07.039
Analysis.
00:22:07.440 --> 00:22:08.240
Analysis, right?
00:22:08.559 --> 00:22:12.160
Like it enhanced your capability to do your job.
00:22:12.640 --> 00:22:17.119
So I'm really glad that was the answers, and not just, oh, ChatGPT wrote the whole thing.
00:22:17.200 --> 00:22:18.240
We didn't write any of this.
00:22:20.880 --> 00:22:24.559
I mean, one other thing that I didn't use it for was templating.
00:22:24.880 --> 00:22:29.359
So we are we use so many templates for the configuration files that we have.
00:22:30.000 --> 00:22:37.920
So at first we were just using text files and just reading them, and it was a whole nested process that was like just a little more time complex.
00:22:38.160 --> 00:22:40.559
Then our instructor, Dr.
00:22:40.640 --> 00:22:46.400
William Enk, he suggested that we use a templating library called Jinja, maybe.
00:22:46.720 --> 00:22:51.839
So we used that and the whole the entire process was was a little more linear.
00:22:52.000 --> 00:23:07.599
And uh with that, um well, like now we moved from one standard which was text files to another format which was Jinja readable, and doing that was like so much more helpful using AI, you know.
00:23:08.400 --> 00:23:09.279
Yeah, absolutely.
00:23:09.440 --> 00:23:12.400
I could absolutely see how that could immediately help and enable that.
00:23:12.720 --> 00:23:14.960
This was like around the deadline.
00:23:15.680 --> 00:23:22.480
So since we had a like we needed a quicker turn around turnaround, yeah, I used the app for that.
00:23:22.640 --> 00:23:24.079
I'm not gonna lie about that.
00:23:24.319 --> 00:23:28.480
So I will say this too, because you because what's what are some of the things you guys have to do for this too, right?
00:23:28.559 --> 00:23:32.079
You're not just like you're accountable to us, but you're doing homework too, right?
00:23:32.799 --> 00:23:38.559
If I remember correctly, from what I did, is you had to write a whole paper and you had multiple phases of papers that you had to write.
00:23:38.720 --> 00:23:41.359
You have to do oral presentations on this stuff.
00:23:41.440 --> 00:23:49.519
Um, you had to have a threshold of security unit testing or unit testing, and even uh you might have had to like do uh behavioral testing, right?
00:23:49.680 --> 00:23:50.720
Everything along this, right?
00:23:50.880 --> 00:24:01.599
So that you had to do all these different components in a really condensed timeline and try to basically get a little exposure to everything you would think of seeing kind of that traditional development role.
00:24:01.920 --> 00:24:02.400
Absolutely.
00:24:03.119 --> 00:24:15.440
Like because our professors also, Lara and Will, they were talking about how we were given a much like we were only given a semester to do something that some in some companies might be taking six months, maybe longer even to try to implement.
00:24:15.599 --> 00:24:19.279
But we had to condense it down and get it done as fast as we could and get it done in a semester.
00:24:19.599 --> 00:24:19.839
Yeah.
00:24:20.079 --> 00:24:22.799
And having AI is incredibly helpful.
00:24:22.960 --> 00:24:30.559
Like even just removing some of the redundancies in the code, um, it's like very helpful when you have AI.
00:24:31.039 --> 00:24:33.200
Yeah, and that like I said, I think that's amazing.
00:24:33.359 --> 00:24:40.799
I think that finding those right use cases because it it let you complete a project that you might not have been able to finish otherwise, right?
00:24:40.880 --> 00:24:44.960
It let you it made you more productive across the way, it sped you up.
00:24:45.119 --> 00:24:49.200
Um here's the sad part you guys are gonna hit when you hit the rest of the industry.
00:24:49.359 --> 00:24:51.359
Um that's now the expectation.
00:24:52.079 --> 00:24:55.440
It's it's not gonna make you faster, it's gonna help you keep up with everybody else.
00:24:55.759 --> 00:24:56.559
Yeah, absolutely.
00:24:56.799 --> 00:25:04.160
I mean, yeah, since we were finishing like uh our tasks quicker, we were like, hey, how else can we make your life better?
00:25:04.319 --> 00:25:05.279
Like every time.
00:25:05.440 --> 00:25:11.359
Since we were finishing one phase, we were like, yeah, in the next phase we can how can we make this product even better?
00:25:11.519 --> 00:25:12.480
You know what I mean?
00:25:12.799 --> 00:25:13.599
Absolutely.
00:25:13.920 --> 00:25:17.680
Alright, so out of all this stuff, all yeah, just
touched a lot of different things.
00:25:17.759 --> 00:25:19.440
You built a really great product for us.
00:25:19.519 --> 00:25:21.359
It was great partnering with you guys.
00:25:21.599 --> 00:25:31.200
Um I'm gonna go through each one of you, and I want you give me kind of like your your your the number one thing you learned, your biggest takeaway going away from this project.
00:25:32.480 --> 00:25:34.160
Number one thing I learned.
00:25:34.400 --> 00:25:40.960
Um you know, getting started and how do I say this?
00:25:41.759 --> 00:25:42.559
Persistence.
00:25:42.880 --> 00:25:43.839
That's the biggest one.
00:25:44.079 --> 00:25:45.839
100% persistence.
00:25:46.319 --> 00:25:52.319
Um for context, I was really, really scared to start.
00:25:52.480 --> 00:25:56.400
I had never used Docker, I had no idea what a Kubernetes file was.
00:25:56.880 --> 00:26:05.359
I honestly didn't know um anything on how the project was situated because I had a lot of busy stuff going on the first week.
00:26:06.000 --> 00:26:16.880
Um and then eventually I just sat down and I said, okay, in the next four hours, I will have written code, I will have understood the entire project, and I will know what I'm gonna do next.
00:26:17.119 --> 00:26:19.759
And in those four hours, I did exactly that.
00:26:20.000 --> 00:26:25.839
And I sat down and I just I again like I used AI, or I didn't use AI actually.
00:26:26.000 --> 00:26:29.759
I literally just looked at the entire code base and I understood how everything was.
00:26:30.079 --> 00:26:37.119
Um and then uh I reached out to Noah and I asked him every single little question I could hey, how does this work?
00:26:37.279 --> 00:26:39.039
Hey, what does this mean?
00:26:39.440 --> 00:26:51.519
And eventually I just started typing, and one bit by bit the first bit of the file started coming together, and by the end of that, I understood exactly what we were going to do.
00:26:51.680 --> 00:26:58.160
I had a mission, uh, or I had an idea, a plan of what I wanted to do next, and brought that back to the team.
00:26:58.240 --> 00:27:03.039
And their next meeting, we ended up having a fleshed out idea of what we were going to do.
00:27:03.200 --> 00:27:09.920
So if I hadn't had that persistence at the very beginning just to sit down and do it, I think that that's I think that it wouldn't have gone as well.
00:27:10.000 --> 00:27:13.039
And I think that's the one thing I took away was just sitting down and actually doing it.
00:27:13.359 --> 00:27:33.440
You know, that's one of the things that I I think we take advantage of, or not advantage of, um we don't appreciate, is so often some of these tasks were handed in the this working world, is 90% of the battle is just just getting into the grind, and once you get going, like the momentum will keep you going, right?
00:27:33.599 --> 00:27:36.960
But that that first step quite often is quite the hardest.
00:27:37.039 --> 00:27:38.720
So that's amazing to hear.
00:27:38.880
--> 00:27:39.920
All right, Quinn, you're up.
00:27:40.160 --> 00:27:56.240
I was gonna say basically the same thing he did, but also I had the thing of in all my projects up till now have been something I've started from an idea I had or a project that we were given in school, where we were basically given a little bit of starter code, but we were writing the whole thing because the whole point was to teach us how the code worked.
00:27:56.480 --> 00:28:05.200
This was the first time where I was picking up on code a code base that already existed, ex requirements that already were there, and then augmenting it to make it better.
00:28:05.759 --> 00:28:07.920
And to like add a new functionality to it.
00:28:08.240 --> 00:28:11.680
Yeah, and that so that's another big thing too, and that's the world you're gonna live in, right?
00:28:11.839 --> 00:28:15.119
Not often are you gonna be like, oh, here's a start from scratch by yourself.
00:28:15.200 --> 00:28:21.200
No, you're gonna be dropped into an organization, they're like, all right, here's the monolith we've been building for 20 years, get working, right?
00:28:22.000 --> 00:28:22.480
Yep.
00:28:22.720 --> 00:28:23.279
Awesome.
00:28:23.440 --> 00:28:24.000
All right.
00:28:24.240 --> 00:28:28.000
Okay, um, yes, I would definitely agree with what these guys said.
00:28:28.160 --> 00:28:33.519
Uh something that I would definitely want to get over next time I'm starting a project is shame.
00:28:33.680 --> 00:28:48.079
Like when you're surrounded by like by brilliant people such as these, it's like you will always uh feel a certain kind of imposter syndrome um that you definitely want to get over um some way.
00:28:48.240 --> 00:28:55.200
And I have had um the privilege um to have the support of these guys who've helped me all the way through.
00:28:55.680 --> 00:29:05.200
Um because like in a team, you want everyone to succeed together because that's how you have something, the end product, it's gonna be beautiful.
00:29:05.759 --> 00:29:06.319
You know?
00:29:06.720 --> 00:29:07.920
So that's that's amazing.
00:29:08.079 --> 00:29:14.720
And the one of the biggest things is engineer work can often feel siloed if it's not done right, right?
00:29:14.880 --> 00:29:19.039
I'm oh it's me and my computer, it's me and my keyboard, I'm just pushing code.
00:29:19.359 --> 00:29:24.640
Um, the power of real builders, development, design, that's collaboration.
00:29:24.799 --> 00:29:27.839
It's working together and supporting each other, it's learning from each other.
00:29:28.000 --> 00:29:30.799
Like that's when you get teams that move at speed.
00:29:30.960 --> 00:29:35.839
Um, and like I said, I I'm it's amazing things that you guys did for us.
00:29:36.000 --> 00:29:37.680
I'm glad you guys learned a ton out of it.
00:29:37.839 --> 00:29:46.079
I gotta do a big shout out to Noah Morse, who wasn't able to be here today just because of timing, but um was really a driving force on this project.
00:29:46.400 --> 00:29:52.400
Um as that, we're gonna kind of think wrap it up at this point, but I want to thank you guys for all the work you guys did.
00:29:52.480 --> 00:29:55.440
Thank you for coming on and joining the podcast, sharing your stories.
00:29:55.759 --> 00:29:56.319
Thank you for having us.
00:29:56.559 --> 00:29:57.119
Thank you for having us.
00:29:57.359 --> 00:29:58.720
I'm so glad to be here.
00:29:59.119 --> 00:29:59.680
Absolutely.
00:29:59.759 --> 00:30:00.319
And you know what?
00:30:00.400 --> 00:30:04.640
And like I said, I'm it's such an honor to work with you guys, and especially like I said, big thanks to Noah.
00:30:04.799 --> 00:30:07.759
I want to reach out and say thank you to our audience for joining us today.
00:30:07.920 --> 00:30:12.799
Also, if you guys are looking for some bright young engineers, these are the people to be looking at, right?
00:30:12.960 --> 00:30:13.839
They do good work.
00:30:14.000 --> 00:30:15.519
We've already proved them out, right?
00:30:15.599 --> 00:30:19.119
Um, so uh we'll uh I'll promote you guys on LinkedIn, I promise.
00:30:19.359 --> 00:30:19.680
Thank you.
00:30:21.039 --> 00:30:22.000
We would need that.
00:30:22.319 --> 00:30:27.759
But yeah, like I said, all right, coming to the end here, I want to thank all of our audience for joining us for another great episode.
00:30:27.920 --> 00:30:31.920
And as we always say, remember, security is a journey, not a destination.
00:30:32.319 --> 00:30:36.079
The Security Champions Podcast is brought to you by Security Journey.
00:30:36.319 --> 00:30:45.200
Security Journey is an enterprise class secure coding training platform with lessons that are built on learning science principles to deliver long-term, measurable results.
00:30:45.359 --> 00:30:47.599
Learn more at securityjourney.com.