how infosec professionals can come out of this mess better

How Infosec Professionals Can Come Out of This Mess Better Than Before

Copyright © Ted Demopoulos 2

• I was enjoying myself at The Red Sea, having fun teaching a SANS Class

• Next was Holiday in Jordan, seeing Petra and The Dead Sea etc.

• Instead, I took a frenzied flight back to the USA on Friday the 13th

• 90% of my work disappeared on the flight home

• Travel, a love of my life, ceased

• My Life and The World became a very different place

• Lots of uncertainty going forwards

(Infosec) Consultant for 30+ years◦ Wide variety of clients from

startups to Fortune 500 togovernment entities worldwide

SANS Instructor for 17 years!

Author of Class “Successful Infosec Consulting”

Recent Books:

“Infosec Rock Star: How to Accelerate Your Career Because Geek Will Only Get You So Far”and the forthcoming

“Infosec Consulting 101”

Copyright © Ted Demopoulos SuccessfulInfosecConsulting.com 3

Of course there are serious problems we are confronting now

Luck certainly does play a role◦ BUT what can we do to maximize the probability of

coming out of this better than before?

This talk covers concrete things you can do to weather the pandemic and thrive, both during and afterwards


What can we do to maximize the probability?

Obviously preparation is helpful◦ But we are looking at going forward primarily

Chance for a fresh start (in some ways)

Even people and companies in some hard hit areas/industries are doing well◦ Not all, my gym closed forever in late March


In the airline business, or furniture business, or a gym owner, or in the restaurant business, or …

We may not be uniquely poised to do somewhere between OK <-> Great but we are in better shape than most◦ Still, some of us are unemployed◦ Friday the 13th in March I lost 90%+ of my work◦ People including loved ones are dying◦ We cannot downplay the seriousness of the situation

◦ “Much of the world is now coping with a coronavirus resurgence.”-New York Times 7/28


We are not all in the same boat◦ But we are all in the same storm

We have two choices now (just like always):

◦“I Can”

◦“I Can’t”


Do you want to “come out of this better than before?”◦ Not going to organically happen◦ Need to do some “good things”

Requires planning

Takes FOCUSED effort◦ What’s important to you?

Expecting (partial) failuresalong the way


Running a sub 4 minute mile◦ Until Roger Bannister did 6 May 1954◦ Record only lasted 46 days◦ Now been done by over 1400

◦ “It always seems impossible until it’s done” -Nelson Mandela

I’m sure you’ve done things others thought you couldn’t before? What are they. You’ve probably forgotten.

“Whether you think you can, or you think you can't--you're right”- Henry Ford


These alone are not “Good Things” (just) Dreaming◦ Vague plans with no action◦ I’m guilty sometimes for sure!

I’m going to play the piano I’m going to get in shape I’m going to set up a home lab and …

Complaining◦ Times are tough you know

Yet still some are doing incredible things

Platitudes ◦ "take care of yourself, stay healthy" etc.

Yeah, of course you should!

Positive thinking (alone)


Take a class (many great paid and free options)◦ SANS, Coursera, MIT OpenCourseware, Udemy

Write a Crypto Class Build/Enhance a Home Lab◦ Webcast: How to Build a Home Lab (BHIS)

Learn a Foreign Language◦ Duolingo is one free option

Learn to Cook or Study Mixology◦ I’m studying Tiki Drinks

Play the Piano semi-seriously Write a Book Read a Book Get in Better Physical Shape


Spreading yourself too thin leads to lotsof failures or at bestpartial success and lots of frustration

A little of this and a little of that might work a buffet but – might lead to nothing significant getting done


You should have a “Not To Do List” – this is mine:

Write Crypto Class◦ Probably by doing 3-5 crypto webcasts as base material

Build/Enhance a Home Lab◦ Although I did get very excited by the BHIS Webcast

Play Piano at least a few minutes a day (basically relearn to play)

Get in better shape◦ I am “maintaining” my last two years weight loss (I hope) of approximately

2.5 stones

Running a Short Class/Challenge based on this Webcast◦ It’s a serious thought with some people nudging me forwards


(Quickly) jot down a few things you would love to do but are not going to do

◦ At least not now!


(and still does to an extent certainly)

Sprints: Very focused effort over the short term

For example I business group I’m in had a series of 17 day sprints

Get something seriously good done by focusing on it for a shortish period of time◦ I did a significant update to my Successful Infosec

Consulting class◦ I read 2 books a week the first 3 weeks home◦ A friend enhanced his home lab and played with it every

night for two weeks


Some friends from my former gym started a “Get Fit in August” challenge

James Altucher has a 30 day write a book challenge◦ Google his podcast – last Fridays episode

Russell Brunson (marketing guy) started a 30 day “Funnel Hacking Challenge” this week


Marathons require more planning You can certainly get more significant things

accomplished in a 6-18 months than a few weeks◦ Working at Sprint pace you will burn out!

Working Definitions:◦ Short Term: now to a few months out◦ Long Term: 6 months-decades

Your definitions may vary somewhat

(For me long term is 18 months+)


“Plans are worthless. Planning is priceless”

-flexibility is essential

MY PLAN will help me:

Come out of GREAT REBOOT strong -better than before -I think this yours should too

Which requires having a plan!


Historically I have been a horrific planner◦ Just a “go with the flow” dude!

Doing Strategic Security Planning for others has helped me become a very solid planner◦ And having children and an ex wife has made me

do it in my personal and professional life as well

Planning CREATES FREEDOM◦ (Some) Structure creates freedom◦ And as things change/evolve you “go with the flow”◦ Helps to let you see possibilities


Copyright © Ted Demopoulos

Vision

Where youare now

Past

Vision: Where you want to go, your big picture goalCompanies have visions, their big picture/long term goal: Where they want to go, what they want to be when they grow upYou should have visions or big picture/longer term goals also

The further out you go the less certain the future is and hence thelarger the cone of plausibility

Alternate Future 1Alternate Future 2

Alternate Future 3

21


Vision

Where youare now

Past

The Past is Fuzzy too!The further back you go the less certain the past isThe past absolutely affects the present & future

Our understanding of what happened is rarely “Perfect”The further back we go the less sure we are• I might know what I had for lunch yesterday but are we sure George

Washington really had wooden teeth?• Our understanding of the present is rarely “Perfect” also


Alternate Future 3

Assessing where we were pre-COVID

Assessing (as accurately as possible) where we are now◦ There is LOTS of uncertainty now

Big Picture/Longer Term Goals◦ Just a very few, this is not a “bucket list”

Smaller Supporting Goals◦ Remember the “Not To Do List”

Planning Tips for Success


The P

lannin

g P

rocess


Where youare now

12 March

Really good stable incomeGreat lifestyleTeaching & Consulting a lotSpending time in my favorite places• Amsterdam, Brussels, GreeceSeeing family a lot• More would have been betterLots of Flexibility/Freedom

3 August

Lots of uncertaintyIncome recovered. Stable?Very different lifestyle99% Remote WorkSpending time in New Hampshire and MaineLess Flexibility/FreedomBoth more time as I’m not traveling and less time as I have 3 teenagers at home

This is me – what about you?

Your life and work pre COVID

Your life and work TODAY


Copyright © Ted Demopoulos

Teaching primarily my own classes

Heavy emphasis on consulting and entrepreneurial classes

Because I feel I am providing the most value doing this

Definitely continuing security consulting/other classes however


Alternate Future 3

Big Picture Goal

This is me – what about you?

Redesigning Website and a new one going up for videos (happening now)

Running full Consulting Class soon

Working on Consulting Book(s)◦ Worked on it during the past 24 hours

Conference (virtual) on consulting this fall◦ Free to attend, small fee for recordings of sessions


Running Consulting Classes with The SANS Institute◦ Once things settle down

Submitting Consulting Classes to Conferences◦ Brucon, Blackhat, WWHF, ISC2 Security Congress, etc.

Lots of free resources to help people (and me with marketing)◦ Webinars etc.

Possible Coaching/Mentoring/Mastermind groups◦ Not in the immediate future


Spend more time with family◦ Especially my kids and mother

◦ Supporting goals include:

Getting my kids involved in my consulting business

Taking classes with kids

Teaching my son to fly fish

Running with my two daughters

Doing the shopping for my mother

Cooking with my middle daughter


◦ (this one is perhaps a bit weird to you?)

Have a More “Peaceful” Life◦ I seem to thrive in chaos but have tired of it!

◦ Supporting goals include:

I’ve started (trying to meditate)

Getting work done ahead of time instead of last minute

Not trying to do too much

Reading “Peaceful” books

Having my youngest primarily live with me instead of her mother


1)

2)

3)

Add potential supporting goals remembering you can’t do everything


Get in Shape

Learn Digital Forensics

Prepare to become an infosec consultant

“Consolidate Life”

(remember you need a plan not just goals & metrics are good!)


Have a SMALL number of Big Picture Goals and write them down ◦ 3 to 5 absolute max

◦ Review and possibly change regularly (quarterly for me)

◦ Look at them regularly!

Have smaller picture supporting goals◦ They are important mainly as support to the Big

Picture Goals

◦ Partial success or even failure here doesn’t matter


Expect some failures/difficulties along the way◦ It’s normal, don’t give up

Expect most significant Big Picture Goals to be harder and/or take longer to achieve!◦ And success can possibly take a different form than

expected (“Cone of Plausibility”)

Fall in love with the F-word


Not a business life and personal life◦ I strongly believe this

Your long term goals can (should?) be both personal and business◦ Not in our example for the sake of time

We often greatly overestimate what we can get done in the short term and greatly underestimate what we can get done in the long term

What would you do if you thought you couldn’t fail??


how infosec professionals can come out of this mess better

Documents