Home TEST lab

I first became interested in creating a home lab system when reading Lesley Carhart’s (AKA: hacks4pancakes) blog post about building “the fundamental knowledge needed to become a successful InfoSec professional”. Lesley Carhart – Starting an InfoSec Career. She recommended Carlos Perez’s (darkoperator) blog for more technical details. DarkOperator – Home Lab Design

The components I chose were similar to that of Carlos’, although I chose to wait on the NAS (Network Attached Storage). Here are the specs of my virtualization server:
HP ProLiant ML30 Gen 9 Tower
  • Quad Core 3.4GHz CPU
  • 36GB RAM
  • 800GB SSD
  • 2 Network Interfaces
IMG_0420(When they first shipped the server, they sent the wrong size drive cage)

For the base operating system I followed Carlos’ advice and went with the VMware ESXi Server “VMware vSphere Hypervisor is a free bare-metal hypervisor that virtualizes servers so you can consolidate your applications on less hardware.” VMware vSphere Hypervisor. With this, you can perform basic tasks using VMware Workstation Pro or VMware Fusion from your laptop, like create a new VM or change that particular VM’s settings. But, in order to perform more in depth management tasks you will need PowerCLI which is a PowerShell module. Download PowerCLI. There is a Mac version, called PowerCLI Core that I could not get working. Apparently it doesn’t give you all the same features as the windows version anyway.

For my next post, I will likely start describing the steps I took to configure the virtual network and the software router. ​I also hope to make a seperate vSwitch that is viewable to my home network so that I can offer up services to those systems. What services do you think my server should offer? Email? Web?

made man

I finally landed a job in infosec! It has been a long hard road to get here, but I have learned so much in the process. What tiny nuggets can I share with you?

  • It really does come down to who you know. I know it’s hard, but even us geeks have to get our schmooze on and network like a champ. Go to those office luncheons, participate in the water cooler talk, or join a local geeks that drink club, etc. This stuff really does matter.
  • That being said, you also need some solid skill and experience to round everything out. Volunteer for as many projects as you can. Setup a test LAN environment (or at least a virtual one). Practice attacking and defending actual systems.
  • Become familiar with the STAR method and keep it in mind as you are tackling challenging tasks or projects. Get very comfortable with talking about your accomplishments. “STAR” stands for:

    Situation: Describe the situation that you were in or the task that you needed to accomplish. You must describe a specific event or situation, not a generalized description of what you have done in the past. Be sure to give enough detail for the interviewer to understand. This situation can be from a previous job, from a volunteer experience, or any relevant event.

    Task: What goal were you working toward?

    Action: Describe the actions you took to address the situation with an appropriate amount of detail and keep the focus on YOU. What specific steps did you take and what was your particular contribution? Be careful that you don’t describe what the team or group did when talking about a project, but what you actually did. Use the word “I,” not “we” when describing actions.

    Result: Describe the outcome of your actions and don’t be shy about taking credit for your behavior. What happened? How did the event end? What did you accomplish? What did you learn? Make sure your answer contains multiple positive results.

  • See stressful situations at work and at home as opportunities for you to learn from. This stress can come from annoying co-workers, demanding clients, or even loved-ones. Try and see the good in those people that simply get under your skin or push your buttons.
  • If you haven’t already done so, take a personality test. I highly recommend the Enneagram, but there are others. This may even help you focus on a particular career path. It certainly helps you understand yourself, and if you can convince others to take it, it will help you understand them as well.

Free Enneagram Test

Enneagram Types

  • Learn how to take criticism and use it constructively to improve yourself. This perhaps may be the hardest to put into practice, but it is an invaluable skill. Look for the truth within the message and use it to recognize your own faults.

So, what’s in store for my future? As I continue to learn my new role, I will look for ways I can improve existing processes and ask the difficult questions that no one has thought of yet. I hope to see how I can support those who have entrusted me with this position and become a valuable member of the team.

Toxic Work Environments

I’m ashamed to say that it has been over a year since I have written words on this page. Life has been…complicated. At least outside of the office. However, I can confidently say that at work I have been intensely focused and productive and loving it. I come in every day, do my job, and do it well. That way, I can go home to my family with a clear conscience and a sense of accomplishment. It hasn’t been without it’s challenges though. In my workplace, I am a rare breed. Everyday I am surrounded by individuals who come into work for various reasons. One reason might be to prove something, one might be to get a paycheck, and the other might be to make friends. I cannot identify with any of these reasons. Don’t get me wrong. I enjoy getting a paycheck, I enjoy having friends, and I can understand having something to prove, but I don’t think that should be your motivation for getting out of bed in the morning, battling through traffic, and making it to the office on your designated arrival time.

I believe that every employee should be compensated, but if that is your only motivation for going to work, you’re performance is only going to be sub-par at best. You are only going to do the required amount of work to get by, and even less if you can get away with it. This attitude also carries an element of entitlement. Any parents reading this may identify with having children who exhibit this attitude. It can be toxic in a work environment. This person will never volunteer to take on additional work or projects. They may commit to a project out of obligation but will never make a contribution. They are likely to fill the time at their desk surfing the web, watching Youtube videos, or chatting about random topics that have absolutely nothing to do with work. What makes this attitude more egregious for me is that this is a place where I come from. Years ago I worked for a company that left me a lot of down time. One of my fellow co-workers and I built high end workstations from spare parts, created a LAN, and used them to play video games for hours. Against each other! This was not the last time either. I can identify with this frame of mind, but the important thing is that I didn’t stay there. I recognized that a day in the office playing video games or watching movies left me feeling empty at the end of the day. I wanted something more.

I can also understand feeling like you have to prove yourself, and in some environments this can actually be necessary to get anywhere within the company. Especially, when the person is young and inexperienced (the rookie). Sometimes it takes a very driven person to get what they want and go for it, and not get left behind. However, often it can be taken too far. Sometimes this drive to succeed can mow right over everyone else along the way and make that person immune to learning some very important principals and gaining character. Principals like, learning that your point of view might not be the only one worth considering, everything does NOT need to be challenged or argued (if it ain’t broke, don’t fix it), and lastly there is something to be said for “doing your time” at an organization. In other words, you already have a job here, what exactly do you need to prove? Just do your job and do it to the best of your ability. Be available, keep your eyes and ears open, and learn as much as you can from others.

Because of this toxic environment, I often keep my headphones on all day. Which is a shame, because occasionally a colleague will actually need my help or ask for my input on something work related. The problem is, I never know when the constant office banter will result in a new idea or simply a 20 minute discussion on where everyone else is going for lunch and what they plan on having. So, what can I do about it? I could continue doing my thing, with my headphones on of course. Or, I could take control of my environment. Take on more of mentoring and leadership role. Actually share with them my vision for the team and get their buy in. I could inspire them to join me on my quest for continual learning, improvement, and innovation and delegate tasks that will foster collaboration. Are there risks? Certainly! They could take all of my hard work and experience, and use it for their own gain. They could not be interested in adding on additional work. They could continue to derail productivity.

But, I have to try something. I’ll let you know how it goes.

Dealing With Criticism

It is never easy to be criticized for your work or for something else you are doing wrong. The way I see it, there are two ways to deal with it: A.) Let yourself become resentful and lash out at anyone and everything that is critical of you, or B.) Search for truth within the critique and actually recognize your own faults.

I was recently reprimanded for not keeping a set work schedule and for often not being in the office when I should be. What they didn’t know was that I often do my best work when I don’t have the constant distraction of my co-workers. I am often pulled from what I am working on to answer questions that could easily be answered through other means. I sometimes feel pulled in different directions and that I’m in a sense babysitting my peers.

In an effort to choose Path B, I want to recognize that it is entirely possible that I am best suited to help my colleagues succeed and boost the morale of the office if I am physically present more often. I also recognize that this could be a perfect opportunity for me to develop key leadership skills. To be quite honest, I shutter at the thought of managing others. I’m the headphones on, , staring at my screen, hacker type; not some sharp dressed schmooze fest always wanting to shoot the breeze. Managers call pointless meetings to ask the same damn questions: 1.) What’s going well? 2.) What’s not going well? 3.) Do you have all the tools to do your job….blah…blah…blah.

I want to ask questions like: 1.) What is our client really asking when he says… 2.) What are the best ways to solve that particular problem? 3.) What else can we provide that person that we haven’t already? 4.) What are ways that we can improve that process?

There may have been a tiny bit of lashing out there, but the point is that I’m going to accept the criticism and move towards overcoming my negative habits. I’m going to serve myself a whopping slice of humble pie and dig in. Who knows? Maybe I will actually enjoy the process.

When The Unexpected Occurs

I recently had an amazing thing happen to me. My team had been working on a project for the past several months. We were tasked to provide a risk assessment that could have a major impact on the organization as a whole. Lately, however other duties have pulled me away from this project and onto other things (which I have been quite bitter about)

My team and I were invited to attend a planning meeting where some rather important individuals would be involved. My take was, that we would be mostly observing and possibly answering a few questions about the work we did (which I have been fairly out of the loop as of late).

The meeting organizer asked us all to introduce ourselves and state what department we were with, and then he announced that my team would be starting the meeting with a briefing on the work we have done. I looked over at my colleagues in surprise, but they both gave me the same look but even more intense (including my office mate who has done most of the work on this project)

They were both looking to me to take the lead! I don’t know if this was the fuel I needed, but I just said to myself, “Well, here we go!” and I began. Something took over me. I was confident, I was knowledgable, I was intriguing, I was engaging, I was on fire! The next 45 minutes felt like 45 seconds and when it was all done, I of course thanked God, and then proceeded to be in a state of shock for the rest of the day.

What were the ingredients for success here?

  • I knew the material, even though I hadn’t done all the work myself.
  • I knew some of the target audience.
  • I knew that people were counting on me.
  • I didn’t have any time to talk myself out of it.

I think that last one may be key. Don’t get me wrong, I think preparation is important, but I think something happens when we have time to dwell on things. We imagine how things are going to go, and if they don’t go the way we expect, we get thrown for a loop and a train wreck ensues. This has happened to me in job interviews. The moment they ask a question I was not prepared for or did not expect, part of me shuts down and I bumble my way through. Is it possible to be prepared for any question? Is it possible to go into an interview with the same motivation that fueled me in this meeting? I don’t know the answers, but I am leaning towards the possibility that it is feasible.


Dear Reader,

It has been several months since my last post and to be honest, I’m feeling a bit discouraged and uninspired. I have put the job hunt on hold for a while so that I could manage an extremely busy workload at the office. I used to enjoy periods of monotonous work that did not involve much thought or concentration. Now I just feel like an overused cog in a giant machine. I’m not creating, not influencing, not making art.

On a positive note, I started another blog, swellsecure.wordpress.com that has potential to be a platform for which I can offer security advice to friends, family, and colleagues. It is not intended to be for other security professionals, but to increase the average person’s or small business owner’s security awareness. My hope is that someone will benefit from the information presented on SwellSecure and it will generate real discussion and interaction. 

Don’t Forget Your People Skills

I recently interviewed for a position that I was not selected for. To be honest, it didn’t seam like the best fit for me, but I still feel rejected and disappointed. I guess that’s natural. I did however walk away with some tidbits of self improvement and the realization that I am severely lacking in certain areas. Notably, in the social skills. I have been so focused on polishing my technical acumen (hours of research, hacking, documenting, etc.) that I have managed to shut myself off from the rest of the world. My last post on Facebook was more than 2 months ago. I haven’t tweeted anything for 7 months. My co-workers go to lunch together everyday. I never go with them. Someone once told me that “you can’t teach a nerd to be charming”. Tell that to Disney:

“Geek Charming is a 2011 Disney Channel Original Movie based on the novel by Robin Palmer. The film was directed by Jeffrey Hornaday and was written by Elizabeth Hackett and Hilary Galanoy. It stars Sarah Hyland and Matt Prokop. It premiered on November 11, 2011 on Disney Channel,[2] January 27, 2012 onDisney Channel (UK & Ireland) and January 28, 2012 on Disney Channel Asia. The premiere was watched by 4.9 million viewers, the fifth largest number for a cable show of that week.” (http://en.wikipedia.org/wiki/Geek_Charming)

Although I don’t see myself as a teen heartthrob (not to mention that would be really creepy), I would say that I consider myself a cool geek for what it’s worth. I know. I know. Coolness is an extremely subjective term. What I mean is I care about my appearance, hygiene, style, etc. I play guitar, write music and poetry, and have been known to create art that others have appreciated. All this to be said, it’s not enough. What good is all my geeky goodness if I can’t effectively communicate my ideas with others?

So I resolve to make more of an effort to participate in more discussions and maybe even take on some more leadership opportunities in my current position. If you happen to read a tweet or a post from me, please engage me in some real conversation so I can hone those people skills and become more like a geek charming.



The Title

I thought it made sense for my first post to explain the title of the blog and where the phrase came from. The phrase came from an interview that I did with a friend and mentor in the info sec industry which proved to be one of my more interesting and lively interviews. The interview was for a class assignment in which we were tasked with identifying 3 different individuals within the info sec industry and performing an informational interview. I would ask them questions about their current position/title, how they ended were they are today, and what pointers they had for someone new to the industry. I found these discussions so fascinating and such a great way to meet other professionals, that I kept doing them well after my assignment was complete.

One such interview turned out to take me completely by surprise. He didn’t just answer my questions, he started to give me a lesson on the fundamentals of true success. I was riveted. One of his main points was in regards to a common problem seen in the technologies industry. I’ve seen it, and chances are you have too. Often times, management will focus on the how and what of a project, because you could argue that is their job, but many times they neglect the question of why. What we commonly see in the tech industry:

1.) How you would do it?

2.) What would you do?

3.) Why?

Let me give you an example. Your manager follows a recommendation of someone else and authorizes the purchase of a new state of the art firewall system, point of sale system, or inventory tracking software. Someone has been sold on the idea that this piece of software or equipment will solve all of the companies’ problems. I’m sure you know what comes next. It sits there. And sits. And sits. Finally, when the maintenance agreement is about to expire someone is tasked with heading up a team to learn the equipment, and better understand how the equipment can be used effectively, essentially figuring out what problems need to be solved that this thing will fix. Sound backwards?

My friend gave the analogy of building a chair. You might know how you would build the chair. You might even know different techniques you might use to build the chair. But why do you want to build a chair in the first place? To be successfully when solving a problem, you must work your way from the core out, from the why out to the how. That is the question that I try and ask myself when tackling a new problem and a challenge you to do the same.