Becoming part of the community
I'm working my way through the new Metasploit for Penetration testers book by David Kennedy, Jim O’Gorman, Devon Kearns, and Mati Aharoni and I have to say it's pretty awesome. It's not just about how to launch ms08-067, it's also about the thought processes behind pen testing and compromising systems. I will write a full review once I have finished it and had a play with the labs.
Also, the social engineering tool kit is evil and I'm never going on the internet again ;)
When I discovered this book it got me thinking. I've come across many great resources that have helped my grow my knowledge and skills in the past 2 years or so. Because my day job is mostly blue team oriented I get no exposure at work to the offensive side of the industry and we all know that to defend yourself properly you have to know your enemy. So how do I get exposure to that side of the industry when I don't work in it, and my company does not do that function? My answer to this has been twofold.
Firstly, if you have never been to a security con, GO TO ONE. Seriously. And by security con I mean a *real* security con like BSidesLondon or security community meeting like 2600 or DC4420, The annual InfoSec event at Earls Court is a trade show and does not count. Get to know the people in the industry, they are awesome people and I've never met a bunch of people who love to talk about their job as much as they do. I was extremely lucky in that my first con was SANS London 2007, only a few weeks after I started green into my first real security job. I met some awesome people there, including @TomaszMiklas . Soon after that I started following Tomasz on twitter and my horizons were opened to the vast infosec community that is out there doing research and talking passionately about a job that they really care about. Look out for my #FF on twitter for more infosec luminaries. In the spirit of becoming more engaged in the community I shall be going to next months brum2600 meeting in Birmingham, and after that it's off to BruCON.
Secondly, and for me this followed from the above, there are some great community produced podcasts out there that really help you in getting up to speed with the current state of the art. If you want to know what's happening now then you need to start listening to the great programs that are being produced. Now a small word of warning, if you are offended by colourful language then some of these might not be for you, however you should try to put that aside as you will not get a better source of ongoing up to date information.
Here are my current subscriptions. If I have missed anything good then feel free to add them in the comments below or hit me up on twitter.
Podcast: http://socialengineer.podbean.com/feed
Disaster protocol: http://www.disasterprotocol.com/?feed=rss2
Podcast: http://www.eurotrashsecurity.eu/episodes/eurotrash.xml | F1nux Tech Weekly Podcast: http://www.finux.co.uk/FTW-Podcast.xml | Risky Business: http://risky.biz/feeds/risky-business
PaulDotCom Security Weekly: http://pauldotcom.com/podcast/psw.xml
Exotic Liability: http://exoticliability.libsyn.com/rss
So that's it. Become part of the community, as everything you need is right there. And you never know, you might find you have something to say that others would like to hear.
