1
00:00:14,240 --> 00:00:17,120
around what's happened to

2
00:00:29,359 --> 00:00:31,119
probably confused but who do you work

3
00:00:31,119 --> 00:00:34,640
for and test people if they can't see

4
00:00:34,640 --> 00:00:36,079
so i think we'll start with you i think

5
00:00:36,079 --> 00:00:37,680
we'll start with you josh if you know

6
00:00:37,680 --> 00:00:39,360
quite a lot i know quite a lot of this

7
00:00:39,360 --> 00:00:41,840
story because we chat all the time

8
00:00:41,840 --> 00:00:44,559
mostly about leeds united at first

9
00:00:44,559 --> 00:00:46,480
tell us about you but tell us about you

10
00:00:46,480 --> 00:00:48,079
your journey yeah since this time last

11
00:00:48,079 --> 00:00:51,520
year so it's been a long interesting

12
00:00:51,520 --> 00:00:53,840
journey well

13
00:00:53,840 --> 00:00:55,840
obviously this time last year beercon i

14
00:00:55,840 --> 00:00:59,280
was just starting out at mcc in the sock

15
00:00:59,280 --> 00:01:00,879
if that makes sense

16
00:01:00,879 --> 00:01:03,039
um

17
00:01:03,039 --> 00:01:06,080
so at the stock uh started out there 12

18
00:01:06,080 --> 00:01:07,439
hour shifts

19
00:01:07,439 --> 00:01:08,720
that was

20
00:01:08,720 --> 00:01:10,080
what

21
00:01:10,080 --> 00:01:12,960
it's fine we're just asking

22
00:01:23,920 --> 00:01:25,600
and then

23
00:01:25,600 --> 00:01:28,560
after 11 months there and most of the

24
00:01:28,560 --> 00:01:31,920
months on chef work it was very tiring

25
00:01:31,920 --> 00:01:33,040
so

26
00:01:33,040 --> 00:01:36,079
it was time for a change and

27
00:01:36,079 --> 00:01:38,960
on i moved to the opposite room the

28
00:01:38,960 --> 00:01:40,720
opposite team of most of the beer

29
00:01:40,720 --> 00:01:43,040
farmers we've moved into the red team

30
00:01:43,040 --> 00:01:44,720
life

31
00:01:44,720 --> 00:01:45,680
and

32
00:01:45,680 --> 00:01:48,880
it's been good so far i've been enjoying

33
00:01:48,880 --> 00:01:50,720
it and

34
00:01:50,720 --> 00:01:51,759
i'm

35
00:01:51,759 --> 00:01:55,840
learning a lot i have and both

36
00:01:57,759 --> 00:01:59,920
rules

37
00:01:59,920 --> 00:02:02,880
to be honest with you

38
00:02:02,880 --> 00:02:04,479
that's sort of what i've been up to

39
00:02:04,479 --> 00:02:06,159
really i've been here about three months

40
00:02:06,159 --> 00:02:08,878
three four months now and i've spent

41
00:02:08,878 --> 00:02:11,760
most of my time on internal assessments

42
00:02:11,760 --> 00:02:14,080
and some wireless assessments

43
00:02:14,080 --> 00:02:16,239
so i'm starting to see a lot of

44
00:02:16,239 --> 00:02:17,840
interesting stuff

45
00:02:17,840 --> 00:02:20,560
and hopefully one day i can get

46
00:02:20,560 --> 00:02:22,480
get enough interest and stuff built up

47
00:02:22,480 --> 00:02:26,080
and get a proper in-person talk though

48
00:02:26,080 --> 00:02:28,000
fantastic we've got a question for you

49
00:02:28,000 --> 00:02:30,080
i've got a question for you so

50
00:02:30,080 --> 00:02:31,760
increasingly we're seeing increasingly

51
00:02:31,760 --> 00:02:34,080
we're seeing maybe not maybe it's always

52
00:02:34,080 --> 00:02:36,560
the case but we're seeing people

53
00:02:36,560 --> 00:02:37,680
that

54
00:02:37,680 --> 00:02:40,000
spend time in the blue team or in the

55
00:02:40,000 --> 00:02:41,920
defender's space

56
00:02:41,920 --> 00:02:43,519
but then

57
00:02:43,519 --> 00:02:45,599
often a quite short period of time

58
00:02:45,599 --> 00:02:47,120
decides they want to move into the

59
00:02:47,120 --> 00:02:50,879
attacker the red team sort of

60
00:02:50,879 --> 00:02:52,480
what was the thought process behind that

61
00:02:52,480 --> 00:02:53,519
for you

62
00:02:53,519 --> 00:02:56,160
uh the thought process was

63
00:02:56,160 --> 00:02:57,599
well

64
00:02:57,599 --> 00:03:00,640
i've seen one side of it

65
00:03:00,640 --> 00:03:02,879
i'm it's going to develop me a lot

66
00:03:02,879 --> 00:03:05,440
better within my career seeing the other

67
00:03:05,440 --> 00:03:07,840
side of it i could have stayed and

68
00:03:07,840 --> 00:03:10,879
developed internally within mcc

69
00:03:10,879 --> 00:03:12,879
but again

70
00:03:12,879 --> 00:03:15,599
sometimes moving to that smaller company

71
00:03:15,599 --> 00:03:17,519
and being able to

72
00:03:17,519 --> 00:03:20,239
get a few more learning closer dealing

73
00:03:20,239 --> 00:03:21,680
with more people

74
00:03:21,680 --> 00:03:22,560
is

75
00:03:22,560 --> 00:03:24,959
beneficial to certain people

76
00:03:24,959 --> 00:03:27,519
the thought process also kind of went

77
00:03:27,519 --> 00:03:28,879
around

78
00:03:28,879 --> 00:03:29,840
well

79
00:03:29,840 --> 00:03:31,120
i've seen

80
00:03:31,120 --> 00:03:33,680
i i know what a defender would say

81
00:03:33,680 --> 00:03:34,720
so

82
00:03:34,720 --> 00:03:35,760
i can

83
00:03:35,760 --> 00:03:38,319
it adds a lot more perspective when i'm

84
00:03:38,319 --> 00:03:41,680
going into an assessment and i'm able to

85
00:03:41,680 --> 00:03:43,040
recognize

86
00:03:43,040 --> 00:03:47,840
some sort of stuff a lot better

87
00:03:51,599 --> 00:03:54,319
and in terms of your new role

88
00:03:54,319 --> 00:03:55,920
you can't talk about it in a lot of

89
00:03:55,920 --> 00:03:57,840
detail

90
00:03:57,840 --> 00:04:00,080
of the things you can discuss can you

91
00:04:00,080 --> 00:04:01,280
give us a flavor of some of the more

92
00:04:01,280 --> 00:04:02,319
interesting

93
00:04:02,319 --> 00:04:03,920
assignments or engagements that you've

94
00:04:03,920 --> 00:04:06,799
experienced yeah so obviously

95
00:04:06,799 --> 00:04:10,879
as as you said their client names are

96
00:04:10,879 --> 00:04:13,840
are obviously out the window but i have

97
00:04:13,840 --> 00:04:16,478
been on wireless wireless assessments

98
00:04:16,478 --> 00:04:17,680
with

99
00:04:17,680 --> 00:04:19,440
minimal encryption

100
00:04:19,440 --> 00:04:21,120
i've seen

101
00:04:21,120 --> 00:04:23,360
uh i've just seen ian in front of the

102
00:04:23,360 --> 00:04:26,000
camera there

103
00:04:26,000 --> 00:04:27,120
sorry

104
00:04:27,120 --> 00:04:30,320
he he's looking well though uh yeah i've

105
00:04:30,320 --> 00:04:31,840
seen

106
00:04:31,840 --> 00:04:35,600
a lot of internal misconfigurations on

107
00:04:35,600 --> 00:04:38,560
both sides to be fair

108
00:04:38,560 --> 00:04:40,880
a lot of the same sort of stuff that you

109
00:04:40,880 --> 00:04:43,040
hear about day in day out use your

110
00:04:43,040 --> 00:04:46,800
passwords and service accounts and

111
00:04:46,800 --> 00:04:49,680
accounts not being managed and

112
00:04:49,680 --> 00:04:53,360
things not being set up correctly and

113
00:04:53,360 --> 00:04:56,160
backup servers being put in the corner

114
00:04:56,160 --> 00:04:58,320
and forgot about and then 10 minutes

115
00:04:58,320 --> 00:05:00,479
later after an assessment you're able to

116
00:05:00,479 --> 00:05:03,039
do a directory traversal on them and

117
00:05:03,039 --> 00:05:05,039
pull

118
00:05:05,039 --> 00:05:08,080
a password etc shadow file and that sort

119
00:05:08,080 --> 00:05:09,680
of stuff

120
00:05:09,680 --> 00:05:12,560
so i have seen really interesting stuff

121
00:05:12,560 --> 00:05:14,160
i mean

122
00:05:14,160 --> 00:05:16,160
i did see some interesting stuff in

123
00:05:16,160 --> 00:05:19,440
terms of defending at ncc with that sort

124
00:05:19,440 --> 00:05:20,560
of way

125
00:05:20,560 --> 00:05:21,520
but

126
00:05:21,520 --> 00:05:23,840
some of the groups are again and some of

127
00:05:23,840 --> 00:05:25,360
the targets

128
00:05:25,360 --> 00:05:26,720
i can't really

129
00:05:26,720 --> 00:05:30,000
disclose unfortunately

130
00:05:30,000 --> 00:05:32,400
of course yeah

131
00:05:32,400 --> 00:05:33,360
so

132
00:05:33,360 --> 00:05:36,000
i guess it's red team life for josh

133
00:05:36,000 --> 00:05:37,919
going forward well worth a better blue

134
00:05:37,919 --> 00:05:39,440
team next then

135
00:05:39,440 --> 00:05:42,560
maybe yeah we we say how having that

136
00:05:42,560 --> 00:05:44,479
appreciation of both sides of the fence

137
00:05:44,479 --> 00:05:45,520
isn't it

138
00:05:45,520 --> 00:05:47,520
you get into an almost purple team

139
00:05:47,520 --> 00:05:48,639
mentality

140
00:05:48,639 --> 00:05:52,240
yeah it definitely makes the one it

141
00:05:52,240 --> 00:05:55,759
definitely contributes to each side

142
00:05:55,759 --> 00:05:58,960
definitely i would recommend

143
00:05:58,960 --> 00:06:01,680
even though stock life is tough and

144
00:06:01,680 --> 00:06:03,440
you've got to be of a proper mindset to

145
00:06:03,440 --> 00:06:05,600
keep out of it for a good while you've

146
00:06:05,600 --> 00:06:07,520
got to look after yourself

147
00:06:07,520 --> 00:06:10,080
if you can do that and you can see

148
00:06:10,080 --> 00:06:12,000
how apts and

149
00:06:12,000 --> 00:06:15,120
actual nation states are attacking well

150
00:06:15,120 --> 00:06:18,479
then you can go and say to a client well

151
00:06:18,479 --> 00:06:21,199
if you implement the saw this splunk

152
00:06:21,199 --> 00:06:24,479
rule or this or or this rule or this

153
00:06:24,479 --> 00:06:26,960
registry key it will

154
00:06:26,960 --> 00:06:30,639
aid your defense against this

155
00:06:30,639 --> 00:06:32,240
yeah yeah 100

156
00:06:32,240 --> 00:06:34,560
it's interesting in the in the

157
00:06:34,560 --> 00:06:36,479
bus that we took down to london i

158
00:06:36,479 --> 00:06:38,400
brought down to london yesterday

159
00:06:38,400 --> 00:06:39,520
one of the passengers made an

160
00:06:39,520 --> 00:06:41,600
interesting observation that

161
00:06:41,600 --> 00:06:43,039
everyone wants in the past everyone

162
00:06:43,039 --> 00:06:44,720
wants to be a pen tester

163
00:06:44,720 --> 00:06:46,319
they go right

164
00:06:46,319 --> 00:06:49,199
that's five percent fun and 95 report

165
00:06:49,199 --> 00:06:51,280
writing okay

166
00:06:51,280 --> 00:06:53,599
but it's moving into everyone wants to

167
00:06:53,599 --> 00:06:55,599
be incident response

168
00:06:55,599 --> 00:06:58,000
i want to be doing ir

169
00:06:58,000 --> 00:06:59,280
that's great

170
00:06:59,280 --> 00:07:03,199
so that's five percent action and 95

171
00:07:03,199 --> 00:07:06,080
report right yeah at 3am

172
00:07:06,080 --> 00:07:07,039
yeah

173
00:07:07,039 --> 00:07:07,919
so it's

174
00:07:07,919 --> 00:07:08,560
i think there are a lot of

175
00:07:08,560 --> 00:07:10,800
misconceptions about how cool

176
00:07:10,800 --> 00:07:13,440
professional cyber security roles are in

177
00:07:13,440 --> 00:07:15,599
general and i talk about a lot of work

178
00:07:15,599 --> 00:07:17,520
that we do a little bit of chasing the

179
00:07:17,520 --> 00:07:19,360
bad guy around the internet but the rest

180
00:07:19,360 --> 00:07:21,360
of it is operational security and all

181
00:07:21,360 --> 00:07:23,840
that kind of stuff damn

182
00:07:23,840 --> 00:07:24,639
so

183
00:07:24,639 --> 00:07:26,080
hi mate

184
00:07:26,080 --> 00:07:28,240
so when we last spoke to you or at least

185
00:07:28,240 --> 00:07:31,199
when you last spoke to us

186
00:07:31,199 --> 00:07:33,520
you were talking about an analogous

187
00:07:33,520 --> 00:07:34,560
world

188
00:07:34,560 --> 00:07:37,520
around the links between cyber security

189
00:07:37,520 --> 00:07:38,400
and

190
00:07:38,400 --> 00:07:39,720
underaged

191
00:07:39,720 --> 00:07:43,199
clandestine live music performance

192
00:07:43,199 --> 00:07:46,080
and that was a brilliant thought

193
00:07:46,080 --> 00:07:49,280
tell us about your last year

194
00:07:50,800 --> 00:07:53,360
well and um

195
00:07:53,360 --> 00:07:54,400
yeah

196
00:07:54,400 --> 00:07:56,720
we have no control over

197
00:07:56,720 --> 00:07:58,160
that that one's not me i've been

198
00:07:58,160 --> 00:08:02,000
silenced um by myself uh yeah i know um

199
00:08:02,000 --> 00:08:03,759
kind of yeah it's been a huge year to be

200
00:08:03,759 --> 00:08:05,520
honest it's like kind of like going

201
00:08:05,520 --> 00:08:07,039
through and thinking but the main thing

202
00:08:07,039 --> 00:08:09,039
was you know i think i was studying for

203
00:08:09,039 --> 00:08:11,360
my masters that didn't quite work out

204
00:08:11,360 --> 00:08:13,840
um still finished with an ap with a

205
00:08:13,840 --> 00:08:15,280
postgraduate certificate that's all

206
00:08:15,280 --> 00:08:17,599
right um i actually moved to

207
00:08:17,599 --> 00:08:20,240
a different job in minecast so i was

208
00:08:20,240 --> 00:08:22,160
working kind of not really in

209
00:08:22,160 --> 00:08:23,360
cyber security at all where i was

210
00:08:23,360 --> 00:08:25,280
working with the search team i now

211
00:08:25,280 --> 00:08:27,120
working the secrets team which you can't

212
00:08:27,120 --> 00:08:28,080
really say a lot about because it's a

213
00:08:28,080 --> 00:08:31,120
secret other than it's kind of working

214
00:08:31,120 --> 00:08:32,880
you know still in a dev role but uh

215
00:08:32,880 --> 00:08:34,880
working with cryptography and you know

216
00:08:34,880 --> 00:08:36,559
some pretty cool kind of security-based

217
00:08:36,559 --> 00:08:38,719
stuff and it's actually kind of a lot

218
00:08:38,719 --> 00:08:40,640
more interesting for me i think

219
00:08:40,640 --> 00:08:43,360
um yeah obviously did a talk at

220
00:08:43,360 --> 00:08:45,600
isolation continue where i

221
00:08:45,600 --> 00:08:47,920
had to try and eat some marmite

222
00:08:47,920 --> 00:08:50,000
i don't know how you did it

223
00:08:50,000 --> 00:08:52,080
and yeah

224
00:08:52,080 --> 00:08:54,800
wonderful stuff it's very disgusting um

225
00:08:54,800 --> 00:08:56,880
cyber house cup party did that the

226
00:08:56,880 --> 00:08:59,279
overcome dj'd there as well and yeah the

227
00:08:59,279 --> 00:09:01,600
infrastep thing i've been doing for well

228
00:09:01,600 --> 00:09:03,680
nearly six months now just raising money

229
00:09:03,680 --> 00:09:05,920
for innocent knights foundation

230
00:09:05,920 --> 00:09:08,240
and the cyber helpline and yeah just

231
00:09:08,240 --> 00:09:11,279
doing not really actual work

232
00:09:11,279 --> 00:09:13,680
but kind of stuff around stuff and just

233
00:09:13,680 --> 00:09:14,720
like

234
00:09:14,720 --> 00:09:16,640
raising money and just partying really

235
00:09:16,640 --> 00:09:19,120
it's not a bad life

236
00:09:19,120 --> 00:09:21,519
dan it's ian here i got a question for

237
00:09:21,519 --> 00:09:23,360
you

238
00:09:23,360 --> 00:09:24,959
so

239
00:09:24,959 --> 00:09:27,680
featuring prominently on your instagram

240
00:09:27,680 --> 00:09:29,839
is a set of

241
00:09:29,839 --> 00:09:31,440
pure

242
00:09:31,440 --> 00:09:33,600
ruins i guess

243
00:09:33,600 --> 00:09:35,440
like it used to be a peer or something

244
00:09:35,440 --> 00:09:36,399
like that

245
00:09:36,399 --> 00:09:37,519
have you

246
00:09:37,519 --> 00:09:39,920
researched the history of that

247
00:09:39,920 --> 00:09:42,480
thing that features so prominently in

248
00:09:42,480 --> 00:09:45,680
your instagram what the west pier yeah

249
00:09:45,680 --> 00:09:47,440
yeah what's that about it's my favorite

250
00:09:47,440 --> 00:09:49,120
landmark don't say it's c-mark it's a

251
00:09:49,120 --> 00:09:50,800
landmark right anyway

252
00:09:50,800 --> 00:09:53,279
it's um it's basically the west here is

253
00:09:53,279 --> 00:09:54,959
like it used to be around before the

254
00:09:54,959 --> 00:09:56,800
tri-spear and then it got basically

255
00:09:56,800 --> 00:09:58,240
blown up well not blown out we got

256
00:09:58,240 --> 00:09:59,839
firebombs in like

257
00:09:59,839 --> 00:10:01,680
the late 90s when it was kind of falling

258
00:10:01,680 --> 00:10:02,720
apart

259
00:10:02,720 --> 00:10:04,800
no one really knows how but

260
00:10:04,800 --> 00:10:07,040
it was uh mysteriously firebombed when

261
00:10:07,040 --> 00:10:08,240
somebody couldn't get planning

262
00:10:08,240 --> 00:10:09,440
permission because they realized it was

263
00:10:09,440 --> 00:10:12,320
a listed building and

264
00:10:12,800 --> 00:10:14,000
that's all

265
00:10:14,000 --> 00:10:16,240
none of it's related um

266
00:10:16,240 --> 00:10:17,360
but that's that's what happened so it

267
00:10:17,360 --> 00:10:19,839
wasn't like the germans or something

268
00:10:19,839 --> 00:10:21,920
during the war no no no no no we're

269
00:10:21,920 --> 00:10:23,279
talking about the 70s i mean it could be

270
00:10:23,279 --> 00:10:24,480
like it could be like the russians

271
00:10:24,480 --> 00:10:25,519
really no

272
00:10:25,519 --> 00:10:27,920
it's not the russians don't worry

273
00:10:27,920 --> 00:10:31,200
um but yeah apt 25 and a half yeah i

274
00:10:31,200 --> 00:10:32,880
love it as a landmark it's like

275
00:10:32,880 --> 00:10:34,399
absolutely falling apart like you look

276
00:10:34,399 --> 00:10:35,839
at it from one angle you can see there's

277
00:10:35,839 --> 00:10:38,320
like no base structure whatsoever it's

278
00:10:38,320 --> 00:10:40,800
kind of just falling into the sea bit by

279
00:10:40,800 --> 00:10:42,320
bit but i quite like that it stayed on

280
00:10:42,320 --> 00:10:43,760
for like

281
00:10:43,760 --> 00:10:46,240
you know decades or tens of decades and

282
00:10:46,240 --> 00:10:47,680
still kind of stands there and it was

283
00:10:47,680 --> 00:10:49,040
actually quite nice

284
00:10:49,040 --> 00:10:50,880
going past it especially when i broke

285
00:10:50,880 --> 00:10:52,720
you know i mean before i even met you

286
00:10:52,720 --> 00:10:53,760
guys

287
00:10:53,760 --> 00:10:55,279
i've broken my foot like every bone in

288
00:10:55,279 --> 00:10:56,880
my foot at one point and but it's

289
00:10:56,880 --> 00:10:58,560
actually quite good to see

290
00:10:58,560 --> 00:11:00,160
you know if that can still stand yeah

291
00:11:00,160 --> 00:11:02,000
you can kind of get over that kind of

292
00:11:02,000 --> 00:11:03,200
thing

293
00:11:03,200 --> 00:11:05,279
during lockdown as well i had a bit of a

294
00:11:05,279 --> 00:11:07,279
bit of a kind of nice message around

295
00:11:07,279 --> 00:11:08,720
like yeah you know you can still you

296
00:11:08,720 --> 00:11:10,640
know that still goes you can keep going

297
00:11:10,640 --> 00:11:11,360
just

298
00:11:11,360 --> 00:11:13,120
you know i think i think like things

299
00:11:13,120 --> 00:11:14,720
like that you find things like it helps

300
00:11:14,720 --> 00:11:16,720
with your mental health and

301
00:11:16,720 --> 00:11:18,399
you know really help you through some

302
00:11:18,399 --> 00:11:22,000
really horrible stuff really

303
00:11:22,000 --> 00:11:23,680
yeah absolutely

304
00:11:23,680 --> 00:11:24,480
yeah

305
00:11:24,480 --> 00:11:26,560
all right so we're about

306
00:11:26,560 --> 00:11:28,399
not just running over slightly but

307
00:11:28,399 --> 00:11:31,200
it's not your fault it's on us this one

308
00:11:31,200 --> 00:11:32,880
but we just want to thank you for

309
00:11:32,880 --> 00:11:34,880
sharing your your stories from the past

310
00:11:34,880 --> 00:11:37,760
12 months and um cheers guys thanks for

311
00:11:37,760 --> 00:11:39,760
having us it's amazing to see you guys

312
00:11:39,760 --> 00:11:41,600
looking so great thanks a lot see you

313
00:11:41,600 --> 00:11:42,560
tomorrow

314
00:11:42,560 --> 00:11:44,880
see you all the best oh and finally

315
00:11:44,880 --> 00:11:46,800
before we go just a quick shout out to

316
00:11:46,800 --> 00:11:49,519
pen test people again for this is a huge

317
00:11:49,519 --> 00:11:51,440
sponsorship for giving us that massive

318
00:11:51,440 --> 00:11:52,320
check

319
00:11:52,320 --> 00:11:54,000
wonderful you're very kind we love you

320
00:11:54,000 --> 00:11:55,600
very much i think down should drop his

321
00:11:55,600 --> 00:11:57,440
instagram now and everyone should go

322
00:11:57,440 --> 00:12:00,160
look at the pier

323
00:12:00,720 --> 00:12:01,519
yeah

324
00:12:01,519 --> 00:12:03,920
dan drop your instagram into the twitch

325
00:12:03,920 --> 00:12:06,160
chat so everyone can follow you

326
00:12:06,160 --> 00:12:07,120
and josh

327
00:12:07,120 --> 00:12:08,880
drop your twitter

328
00:12:08,880 --> 00:12:10,480
cheers

329
00:12:10,480 --> 00:12:13,800
thanks guys