#thoughts on security

In the last 5 days I have seen a lot of posts about the following: 

Infosec is hard. 

There is a skills shortage

There is a ton of fakes out there, how can we find the real pros at infosec

This line of argument is getting kind of tiresome. To answer the first part of this argument - yes we know infosec is hard, many industries are hard.

on the second point. I think the skills shortage is actually inflated because if you actually sit down and take the time to read some job ads for infosec roles for small and large companies alike you keep seeing requirements to have weird / obscure products or experience with them in excess of 5 years. This is silly, We should really be looking for aptitude or attitude for a number of security roles rather than 7 years experience with HPE Fortify or equivalent. You also have the opposite end of the spectrum where you see job descriptions so vague that it looks like somebody has done a Ctrl + F and just replaced the job name (recruitment agencies I’m looking at you).

And finally point 3 how do we seperate the gold from the gold plated? Easy look at their street cred.

Do they have infosec projects they are passionate about? If so give them some points.

Are they continuing to invest in education and professional development? If so more points.

Can they pass a technical interview? Hold up. I have seen many guys pass technical interviews with flying colours, however basic skills like being able to communicate with people or chase up dependencies are severely lacking. I think we need to move to a new style of technical interview I.e. we give them a small project to do before or after the main interview - if they can do it awesome, if not it’s probably an early warning sign.

Look at their experience if they have it and reference check, this didn’t happen as much as you would think.

Until next time, 

The video below is one of my favourite DEFCON talks of all time - please watch it before reading the remainder of this post:

Its been a while since I posted a thought piece, however one thing that has continually come up in discussions about ransomware is somebody going "haha [insert ransomware name here], only made $[insert arbitrary value here]". While sometimes it doesn't look like some of these huge ransomware campaigns have paid off I believe what is making ransomware so prevalent is the fact that to people ransomware provides clear incentive to its victims unlike other malware outbreaks of yesteryear.

In the DEFCON video Garry states that the software basically made no money from abusing affiliate links. This prompted his bosses to come up with a novel way to earn money so they started charging other companies to install their software. Essentially widespread ransomware is the next stage almost 2 decades on.

If you bombard users with advertising and products theres a chance some of them will buy what you are selling. However if you take away something they already have thats important to them your chances of making money significantly increase.

Also with selling / advertising products you make a tiny fraction of what the user actually pays for it with ransomware you essentially get the whole lump sum. so if you sell a $99 product through affiliate marketing you may get anywhere from a few cents to a couple dollars with ransomware you would get the whole $99.

So its simple really - why is ransomware so prevalent right now? Because its a better way to get paid for developing malware.

As always I hope you enjoyed reading this or found it useful!

Until next time,

Hi All,

Its been a while since I have posted a new tutorial or thought piece on here due to a number of reasons however I'll give you an update on how things are tracking:

Passta App - Its all done! Im having some trouble with signing it through Xcode (This process is really bad), So I aim to add an in app web browser for an extra bit of functionality and do a final round of testing before attempting to use iReSign to submit it to the app store.

Original posts - The plan is to have something out later this week on creating your own VPN over AWS (watch this space).

Though pieces - I haven't posted one of these in a long time (at least a year) I want to start pushing these out at least bi-weekly.

Book - Once all of the above has a handle on I'm going to write an ebook theres a poll on twitter on the topics otherwise feel free to send me a message with what you would like to see in the book.

Otherwise please be safe and careful and try not to get your windows machines infected with WannaCry.