around what's happened to
probably confused but who do you work
for and test people if they can't see
so i think we'll start with you i think
we'll start with you josh if you know
quite a lot i know quite a lot of this
story because we chat all the time
mostly about leeds united at first
tell us about you but tell us about you
your journey yeah since this time last
year so it's been a long interesting
journey well
obviously this time last year beercon i
was just starting out at mcc in the sock
if that makes sense
um
so at the stock uh started out there 12
hour shifts
that was
what
it's fine we're just asking
and then
after 11 months there and most of the
months on chef work it was very tiring
so
it was time for a change and
on i moved to the opposite room the
opposite team of most of the beer
farmers we've moved into the red team
life
and
it's been good so far i've been enjoying
it and
i'm
learning a lot i have and both
rules
to be honest with you
that's sort of what i've been up to
really i've been here about three months
three four months now and i've spent
most of my time on internal assessments
and some wireless assessments
so i'm starting to see a lot of
interesting stuff
and hopefully one day i can get
get enough interest and stuff built up
and get a proper in-person talk though
fantastic we've got a question for you
i've got a question for you so
increasingly we're seeing increasingly
we're seeing maybe not maybe it's always
the case but we're seeing people
that
spend time in the blue team or in the
defender's space
but then
often a quite short period of time
decides they want to move into the
attacker the red team sort of
what was the thought process behind that
for you
uh the thought process was
well
i've seen one side of it
i'm it's going to develop me a lot
better within my career seeing the other
side of it i could have stayed and
developed internally within mcc
but again
sometimes moving to that smaller company
and being able to
get a few more learning closer dealing
with more people
is
beneficial to certain people
the thought process also kind of went
around
well
i've seen
i i know what a defender would say
so
i can
it adds a lot more perspective when i'm
going into an assessment and i'm able to
recognize
some sort of stuff a lot better
and in terms of your new role
you can't talk about it in a lot of
detail
of the things you can discuss can you
give us a flavor of some of the more
interesting
assignments or engagements that you've
experienced yeah so obviously
as as you said their client names are
are obviously out the window but i have
been on wireless wireless assessments
with
minimal encryption
i've seen
uh i've just seen ian in front of the
camera there
sorry
he he's looking well though uh yeah i've
seen
a lot of internal misconfigurations on
both sides to be fair
a lot of the same sort of stuff that you
hear about day in day out use your
passwords and service accounts and
accounts not being managed and
things not being set up correctly and
backup servers being put in the corner
and forgot about and then 10 minutes
later after an assessment you're able to
do a directory traversal on them and
pull
a password etc shadow file and that sort
of stuff
so i have seen really interesting stuff
i mean
i did see some interesting stuff in
terms of defending at ncc with that sort
of way
but
some of the groups are again and some of
the targets
i can't really
disclose unfortunately
of course yeah
so
i guess it's red team life for josh
going forward well worth a better blue
team next then
maybe yeah we we say how having that
appreciation of both sides of the fence
isn't it
you get into an almost purple team
mentality
yeah it definitely makes the one it
definitely contributes to each side
definitely i would recommend
even though stock life is tough and
you've got to be of a proper mindset to
keep out of it for a good while you've
got to look after yourself
if you can do that and you can see
how apts and
actual nation states are attacking well
then you can go and say to a client well
if you implement the saw this splunk
rule or this or or this rule or this
registry key it will
aid your defense against this
yeah yeah 100
it's interesting in the in the
bus that we took down to london i
brought down to london yesterday
one of the passengers made an
interesting observation that
everyone wants in the past everyone
wants to be a pen tester
they go right
that's five percent fun and 95 report
writing okay
but it's moving into everyone wants to
be incident response
i want to be doing ir
that's great
so that's five percent action and 95
report right yeah at 3am
yeah
so it's
i think there are a lot of
misconceptions about how cool
professional cyber security roles are in
general and i talk about a lot of work
that we do a little bit of chasing the
bad guy around the internet but the rest
of it is operational security and all
that kind of stuff damn
so
hi mate
so when we last spoke to you or at least
when you last spoke to us
you were talking about an analogous
world
around the links between cyber security
and
underaged
clandestine live music performance
and that was a brilliant thought
tell us about your last year
well and um
yeah
we have no control over
that that one's not me i've been
silenced um by myself uh yeah i know um
kind of yeah it's been a huge year to be
honest it's like kind of like going
through and thinking but the main thing
was you know i think i was studying for
my masters that didn't quite work out
um still finished with an ap with a
postgraduate certificate that's all
right um i actually moved to
a different job in minecast so i was
working kind of not really in
cyber security at all where i was
working with the search team i now
working the secrets team which you can't
really say a lot about because it's a
secret other than it's kind of working
you know still in a dev role but uh
working with cryptography and you know
some pretty cool kind of security-based
stuff and it's actually kind of a lot
more interesting for me i think
um yeah obviously did a talk at
isolation continue where i
had to try and eat some marmite
i don't know how you did it
and yeah
wonderful stuff it's very disgusting um
cyber house cup party did that the
overcome dj'd there as well and yeah the
infrastep thing i've been doing for well
nearly six months now just raising money
for innocent knights foundation
and the cyber helpline and yeah just
doing not really actual work
but kind of stuff around stuff and just
like
raising money and just partying really
it's not a bad life
dan it's ian here i got a question for
you
so
featuring prominently on your instagram
is a set of
pure
ruins i guess
like it used to be a peer or something
like that
have you
researched the history of that
thing that features so prominently in
your instagram what the west pier yeah
yeah what's that about it's my favorite
landmark don't say it's c-mark it's a
landmark right anyway
it's um it's basically the west here is
like it used to be around before the
tri-spear and then it got basically
blown up well not blown out we got
firebombs in like
the late 90s when it was kind of falling
apart
no one really knows how but
it was uh mysteriously firebombed when
somebody couldn't get planning
permission because they realized it was
a listed building and
that's all
none of it's related um
but that's that's what happened so it
wasn't like the germans or something
during the war no no no no no we're
talking about the 70s i mean it could be
like it could be like the russians
really no
it's not the russians don't worry
um but yeah apt 25 and a half yeah i
love it as a landmark it's like
absolutely falling apart like you look
at it from one angle you can see there's
like no base structure whatsoever it's
kind of just falling into the sea bit by
bit but i quite like that it stayed on
for like
you know decades or tens of decades and
still kind of stands there and it was
actually quite nice
going past it especially when i broke
you know i mean before i even met you
guys
i've broken my foot like every bone in
my foot at one point and but it's
actually quite good to see
you know if that can still stand yeah
you can kind of get over that kind of
thing
during lockdown as well i had a bit of a
bit of a kind of nice message around
like yeah you know you can still you
know that still goes you can keep going
just
you know i think i think like things
like that you find things like it helps
with your mental health and
you know really help you through some
really horrible stuff really
yeah absolutely
yeah
all right so we're about
not just running over slightly but
it's not your fault it's on us this one
but we just want to thank you for
sharing your your stories from the past
12 months and um cheers guys thanks for
having us it's amazing to see you guys
looking so great thanks a lot see you
tomorrow
see you all the best oh and finally
before we go just a quick shout out to
pen test people again for this is a huge
sponsorship for giving us that massive
check
wonderful you're very kind we love you
very much i think down should drop his
instagram now and everyone should go
look at the pier
yeah
dan drop your instagram into the twitch
chat so everyone can follow you
and josh
drop your twitter
cheers
thanks guys