#unstructured learning

1. Watch your industry

Watching your industry is a really good way to see what information is being made available and what knowledge is needed. Keeping up to date with what your industry is doing is valuable and can provide a lot of insight to yourself, what you’re most interested in, and your place in your industry of choice.

I started with reading all the news stories on Bleeping Computer, reading every new security story every day. Last year, of course, was a year rife with ransomware, so this filled a lot of the stories I read. But it was a key point of interest to me; I found the ransomware hit stories more interesting than the stories about cryptojacking. Finding that interest point was the starting step to developing some of my progress intentions with infosec.

2. Pinpoint a broad topic

Once you’ve kept an eye on your industry for a little bit, you’ll probably find that one or two topics are drawing your interest more than others; use this as a pinpoint basis to begin narrowing down your quest for knowledge.

As I said before, reading Bleeping Computer articles led me down the path of ransomware - articles about this drew my attention a lot more than other articles. From here, I started trying to understand how ransomware worked, trying to piece together how an infection might take place. With ransomware last year, there was obviously the set of malware attacks that utilised NSA tools to propagate; this gave me an opportunity to learn about how those tools worked, and why they were so effective.

3. Break it down

A broad topic is great, a finite point of exploration is better. Broad learning should accompany more focused, in-depth learning; take your broad topic and break it down into smaller concepts.

For ransomware, I thought about the key aspects of most of the more noted ransomware attacks. While ransomware originally just locked down functionality without encrypting files, file encryption became popular and more common following CryptoLocker in 2013. So of course, a smaller concept to ransomware would be encryption and cryptography. Other topics may involve cryptocurrencies and how blockchains work and can be traced (as cryptocurrency is a popular ransom demand), and the aspects of social engineering that can make a ransomware attack successful (after all, they have to convince their victims that the files or functionality will be freed once payment is made - even if they have no intention of it).

4. Do it all again