thank you very much and thank you for
coming to my presentation
can you all hear me audios okay you can
hear me excellent so today I would like
to talk about something that is not so
technical usually I do technical talks
but this clearly is a non-technical talk
but rather a experience based talk quick
word about myself my name is Mario I've
come from Germany in Berlin and I run a
company that is called queue 53 and we
basically do penetration tests and
source code audits and these things it's
a rather small company and I want to
leave it as that for a variety of
reasons and some of these reasons you
might actually talk about today um I
carry a PhD in computer sciences which I
got for looking very sternly at
cross-site scripting so yes you can have
a PhD in cross-site scripting I was
surprised myself and I maintain a couple
of libraries and open source tools wrote
a couple of papers wrote a couple of
books and yeah pretty much
most of it if not all of it you can find
for free online so today we're gonna
talk about a experience that I made over
the past years because I want to talk
about how to create an information
security company what entitles me to do
so is the fact that I actually created
one myself twelve years ago and I'm
still running it and it's still going
however these are my experiences and it
might be that you have different
experiences so your mileage may vary and
it might be that certain details of this
talk simply do not apply to you I
apologize in advance but I also can't
really take all the feedback on that
because there are so many experiences
and eventually the slides would explode
so let's first see who is actually here
today who here is a penetration tester
please raise your hand all right that's
a good majority who here is a developer
or a defender of web applications yes
very nice who here is like from the
managerial area like ISO C so C SEO
these things okay thank you very much
and who here is a bug bounty hunter
almost no one said such interesting
thank you very much that gives me like a
good idea about the audience and what
kind of things to focus on during my
presentation so
let's first talk about how this talk is
actually being structured the first acts
that we're going to talk about is the
onboarding we're gonna be talking about
like why we want to create an intersect
company what the motivation might be
what early pitfalls might be and so on
then we gonna talk about building it and
getting it to run in the third act we're
going to talk about running the whole
thing and in the final act and I think
that's the most important one we're
going to talk about us about us humans
because we're going to talk about how to
do that whole thing and staying sane at
the same time because sometimes these
things can be very challenging so let's
get started and talk about the
onboarding how to get into the position
and raise enough motivation to X ability
on security company why this talk why
this motivation because why not I mean
building your own company is not
everybody's thing some people indeed
find employment more fulfilling they
want to have structure they want to go
to the office they won't off coworkers
and all these things they don't want to
build something they just want to enjoy
what other people built and that's fine
as well if you're of that kind then
probably this talk is not gonna be super
interesting for you because you have to
have a little bit of entrepreneurial
spirit to actually take benefits from
those slides in this presentation
however I also heard from a couple of
people who are employed that they don't
really love it too much they don't love
kind of reporting upwards they don't
love that they have to get up early in
the morning they don't love that they
have to wear pants when they work and
all these things seem to them like a
small jail and in addition to that they
might not even get a salary that makes
them happy so they complain it's like oh
how my job is and I'm gonna kind of
do something else but I do not know what
why complain when you can indeed kind of
press your teeth together and just
construct something build something
build something new that is exactly as
you want it to be quite honest I was
that complainer a long time ago and at
some point I decided it's enough I don't
wanna do it anymore I want to build
something myself and I did it and then I
was happy information security companies
today have changed if you look at for
example the situation 15 years ago you
would find a lot of small checks a lot
of small companies and the whole sector
was just like still growing in all words
everything was coming together and today
this is different let's look for example
just
an example I don't know ncc group I
think the response or similar condition
even bear of course and I don't want to
say anything bad I'm just want to use
them as an example of how these
companies have been developing over time
according to the internet and CC group
looks like this they have 35 offices
around the world or more meanwhile they
employ more than 2,000 people and are as
they claim a trusted adviser to 15,000
clients worldwide so it's a massive
cooperation and pretty much it's a
corporation like any other there's like
one huge template how you build like
these huge businesses and then you run
them and you make a lot of money and
there are shareholders and so on and so
now we know the deal I guess I think in
2006 they bought recall total nation
management and so on and so on they
bought source cybersecurity site
confidence escrow Europe AIESEC partners
and a lot of other companies so you can
see it's pretty much one huge business
that by smaller businesses and by that
it becomes bigger it doesn't kind of
feel like the typical information
security company with a bunch of hackers
that take apart web applications mobile
applications and the likes it's a
corporation a behemoth so to say and
that's fine so oftentimes people think
that information security companies look
like this who knows the movie very good
very good very good
but a first year that's not reality
because what information security
companies usually look like is this and
that's fine but that's not what
everybody wants I mean you see there's
like a lot of diversity and all of them
have like almost the similar hair but
anyway this is what those probably's
usually look like or what their rule
prefers like a port room and a couple of
old guys in there and they manage
everything fair enough
but this is not the kind of company we
actually want to talk about today
because that's boring and people have
been talking about this for ages and
ages and ages and we're probably not
really interested in building one of
these behemoths what we want to talk
about what we're aiming to build is a
boutique what it would take like a small
company that wants to stay small that
focuses on quality only that focuses on
having happy employees or happy team
members and doesn't really grow beyond
the size of five to twenty people maybe
twenty-five but rarely more than 50
which is team focused and transit area
instead of data driven something like a
couple of other companies that I know in
German
we work together with Ricky labs for
example that was created by FX or
enabled security or x1d SEC which is
also a tiny company but they're amazing
and they produce amazing work because
they have experts and only experts and
there's a couple of other ones out there
of course and some of them are even
though here so again why when you do
this talk why do we want to kind of talk
about how to build one of these
boutiques because while large
corporations exist and they have a
purpose because large companies can
build large things not everything is
always great with them and I had the
feeling as well when I was in the
situation and working off with one of
these or several of these oftentimes we
people say bigger is better but bigger
is not necessarily better bigger is just
bigger and that means that things take
more time you have long and
administratively heavy processes there's
lots of people involved in the business
that don't even know the field I could
well good story so like a friend of mine
asked me to kind of get like a quote for
a source code scanning of a website and
he didn't do it himself because he owns
such company and then he tasks me or
asked me if I could kind of claim that
I'm someone who has a website that was
to be scanned so if I could please just
call one of these companies I don't look
gonna say the name and get like a quote
for them because he was eager to learn
how expensive they are what they
actually doing it I did this so I did
like a fake call and called this company
I wanted to find out how much would it
cost if they scan and test against our
made-up website just to get ideas about
the pricing and I called them and I had
some guy on the phone and he asked me a
couple of questions what we're doing and
how big the website is and if you can
have a look at this thing and everything
was fine and then he asked me look what
kind of programming language is the
website written in and I said PHP and he
said like ah pap ok noting that downs
like what you have never had such call
before obviously because you don't even
know the programming languages I mean
that it's like you don't ask the
question when the answer confuses you or
you have no idea would it put to
intentionally be and Yoram bear
yourself by saying pap or is there a
programming language that is called pap
I dunno maybe maybe there is one and I'm
the idiot who knows anyway lots of
people involved who don't really know
the field there's often times very
expensive contracts like we had
situations where we were competing with
a couple of different vendors and the
larger ones oftentimes submitted a
quotation there was 20 times the money
that we asked for 20 times factor 20
that is incredible
so sometimes they get the feeling and
maybe I'm wrong probably I'm wrong but
sometimes I get the feeling that the
bigger the company is that what you get
is effectively security for the big and
for the rich but who takes care of the
smaller companies who test them or
activists and so on that also needs
security of open-source developers who
helps them the huge months maybe not
always another disadvantage might as
well be that it's unclear if the testers
that are actually testing your
application afterwards are really
skilled enough to do so because maybe
they don't really know their stuff maybe
they have been put on the wrong project
rarely do you have transparency in these
situations who is actually testing your
application in a small company that
might not be the case because this third
person might as well be there oftentimes
you get very generic reports with lots
of useless texts and pie charts and all
sorts of diagrams that no one wants to
see that don't matter at all like we've
seen sample reports and demo reports of
other companies with bugs in there that
don't even exist anymore
stuff like cross-site tracing Omega
cross the trait that doesn't matter
anymore this pack class died 15 years
ago you don't have to have a ticket in
your report that complaints about
cross-site tracing this is gone this is
over yet it's in there just to generate
more mass and it oftentimes feels that
financial growth is the most important
thing because you need to stake you need
to keep the stake in the shareholders
happy so this is the priority number one
not quality but money yet some people
just don't want to do this and at some
times they have the feeling and again I
might be wrong that with these contracts
you might not get enough bang for the
buck and that is sad because for some
people money is a scarce resource and
they want to choose wisely
and cautiously whom did she work with to
get the results that they need what use
is the penetration test that doesn't
have good coverage none at all
I'm not saying that all that all these
things must necessarily be better in a
boutique and the small company has
mentioned 5 to 20 people
not necessarily but things can be better
for all of our parties because
oftentimes there's more control for
everybody involved more transparency not
so many hierarchy layers and so on
smaller sometimes also means it's faster
it is possible to have very short and
very economic processes because there is
no long communication chains there is
just like two or three people that the
client will ever deal with and that is
fine sorry oftentimes all the involve
people both in the company and the
specific test are experts and the client
can see who they are and can check them
and learn about them and see oh this
person gave a conference talk and this
person's like really good and this and
this and that so that makes me feel
better because I know that the right
people are testing my thing given that
all those administrative processes don't
exist and you necessarily don't have a
for example huge building with flags in
front and tons of cars and whatnot you
can ask for cheaper prices the contracts
can be much cheaper don't have to be but
they can as mentioned earlier we've seen
pricing differences for the same scope
with petrol 20 we offered 60k another
company offered 1.2 million where does
all the money go i wondering oftentimes
clients want to have individualized
services they want to have
individualized reports special formats
they have special needs that come back
after the test one something again and
that is in my opinion also often times
easier to handle with a small company
because otherwise huge behemoth must be
turned on again and the whole process
needs to be rolling again and I'm not
even sure if that's possible in a large
company to do this maybe it is but maybe
not and I often feel that those small
companies have different focus they not
necessarily have the focus of making
more money because money is not
everything but they rather seem to have
the focus of valuing ethics and
sustainability over growth and financial
gain I would go as far and say that in
the information security business it's
very unlikely that you end up poor
because the services that we charge for
are usually quite expensive often times
too expensive but if financial growth is
not your goal that's not a problem
because you're gonna get rich anyway as
stupid as that may sound and often times
they have the feeling that we'll smaller
companies you will
much more bang for the buck and that's a
good thing for everybody you feel better
about your services the client feels
better about what they get they
recommend you there's word-of-mouth and
so on if done right I mean of course you
can still screw it up or someone else
whom you partner with and build the
company with can screw that up so the
question is how to do that right and as
mentioned this is just like my account
on things and it might be terrifyingly
wrong but let's see maybe there is
something in there that you can actually
use and that benefits you and your own
endeavors because that's the purpose of
this presentation building it act number
two the bootstrapping phase is pretty
much the first thing that needs to be
there you need to kind of have the
motivation to build your own security
company you have to really want to build
it and you need to know why you want to
do that what your goal is maybe you want
to sell exploits maybe you indeed want
to grow a company and sell it later on
or maybe it's just gonna be your brain
site or your baby and you're gonna kind
of maintain it as long as you can and
run with it because it's actually tons
of fun I'm going with a ladder like my
company I really like because it's
really fun and we have just 20 people
and I want to keep it like that and I
don't wanna sell it never why would i
for how you build it then afterwards I
think it's of secondary importance most
important is that you know what you want
and that your heart is in the right
place and that you're acting with the
right people for this and then just like
pull it off in my opinion you need to
make a decision about the posture of
your company so you want to wear a suit
or do you wanna wear wellies do you want
to create a template company or do you
want to create a michelin-star
restaurant with actual fine dining pen
tests that are so good that people will
definitely always come to you because
they know what they get do you been an
exit or do we need keeper and run with a
company for as long as you can because
you love it
where interests and ethically what is
the goal of the whole operation
once you're clear on that you're pretty
much equipped already in hand start
we're gonna talk
needless to say about the keeper this is
the goal this is what I want to show in
this particular presentation I don't
want to tell you how to build a company
that you sell in two years I don't want
to tell you I do want to tell you how to
build a company that you keep for as
long as you can
the first thing
when building the whole thing up it
sounds easy but probably the hardest
part is to grow a name people need to
recognize you people need to see you
people need to learn that you're now on
the market that you're good that you
have expertise and that you are the
right one for them to work with it's
actually not that super hard because
right now we have the situation where
everybody can submit conference talks
submit research work with bug bounty
programs get in touch with other people
network use Twitter your social networks
and all these things to kind of make
sure that they get recognized that they
get seen and getting seen is the most
important thing publish posts partake in
discussions if for example Gareth
follows you and Twitter Gareth face from
the UK then you know already that you
came quite far because he follows you
people oh these those that are relevant
so that's already kind of pointing you
in the direction that something is being
done right but you doesn't have to be
just Gareth but you know if industry
leaders that you know and that you
respect kind of look at you and see you
then you have made the first step in the
right direction which is good
write a lot of papers if you have the
chance publish find new box back classes
win hacking challenges get seen engage
with others partner as much as you can
speak start small don't grow too fast or
do this too quickly
don't let this go over your head but
slowly build your way up until you're at
the point of people actually knowing you
and then you're already half done like
this is pretty much half the battle then
go and reduce your business maybe you do
this before maybe you do this afterwards
but basically you need to go and
register it somewhere I don't really
know how it works here in India I do
know how it works in Germany and it's
not that hard maybe here it's harder
maybe it's not I can't really tell
because I'm not an expert for that but
I'm pretty sure that most of the people
here most of you know where at least to
go to and to ask these questions and
then Ramon learn more about how to do
the registration process and then
oftentimes the question is like what
kind of company do you want to create is
it like for example a huge one with
shares and stocks or is a big small one
or you want to be a freelancer first or
a team of freelancers that's your choice
and I always recommend to take the lean
approach and always start small and then
grow organically grow slowly but grow
steadily and that's the most important
thing so now we are already a tag 3
running the whole thing because once you
did all
once you are successful and once you
have the first clients in the extra like
you um then you get a good feeling you
know you did go into the right direction
so the first client is pretty much the
most important thing that you can have I
was very lucky with my first client
because it was a very large company from
the US who tends to build operating
systems and create amazing browsers and
you can kind of guess who that was but
that was amazing because we had a client
that actually supported us to the first
hard weeks and months and basically says
like we're always gonna have work for
you in some way and this is the client
that you want be friends with the client
be nice with the client make sure that
they don't drop you because the first
client is the most important thing and
you don't wanna get rid of them
ideally find someone that you already
know from like earlier experience from
your old job or something like this
maybe from back bounty programs or
someone that you already are in touch
with so they know who you are and you
know how they are because then the
communications and the whole process and
the whole flow is much much easier
sometimes there's weird ways of finding
your first client or finding clients in
general sometimes it's just like binge
drinking with them in the evening at a
conference in the next morning you have
a contract or a meeting or a briefing
call or something like this who knows
everything is possible don't exclude the
possibility of a weird approach just
because it's weird because it might
become your best client whatsoever
sometimes you receive an email that
email really sounds weird at first and
you read it once and twice is like I
shouldn't really respond to that but
then you do that and it turns out it's
the best client after all that happens
don't slam those doors be open as open
as you can then the boring stuff comes
because then you need to kind of get
organized and getting organized is the
most important thing you need to be able
to organize yourself and that is
sometimes so so hard when we started
with quite early on what we do what
really were great for us was that we
made a decision for like an online
office solution you could go with office
365 or with Google Docs or Google Drive
or whatever is out there but you need to
have something that is actually
supporting you a tool that helps you and
a tool that you can use for the next
years because migrating from one
solution to the other that sucks a lot
you never want to do that there's
definitely gonna be it for me
so choose wisely what tool you're gonna
use and then stick with it go with what
you hate the least I looked at a couple
of one and one of them I hated the least
so I went with it and we're quite happy
with it better don't go with a niche
product because the company might could
just go bankrupt and then what so better
go is something that is like big that is
on the market already that is here to
stay for the next years and also have an
eye on what your clients are likely to
use the majority of our clients use
Google Drive and they use slack so we
use Google Drive and we use slack
because then we have a shared interface
we can share documents with them quite
easily and they can share stuff with us
we can invite them into our slack or
they can invite us into their slack and
we can chat all the time during the pen
test which is amazing experience I
always chat with them obviously as close
as possible during the assessment what
is mentioned you manage my very maybe
here or somewhere else people use
different software and then you need to
decide go with the one that you hate the
least and ideally find something that
your clients use as well because then
you're already on the same paper on the
safe side tools there's a lot of tools
you can use and there is actually more
tools that you can use that should be
there because most of them are too
specific and the company might go
bankrupt as mentioned and they are not
really useful in the long run so find
the tools that you use that you need
should be productive but don't overdo it
don't have like three different calendar
applications at the same time go with
one what I use for myself and I'm kind
of trying to use the minimal approaches
I use a calendar
I mean I'm using the hell out of that
calendar and everything is done by the
scheduler this is my my anchor my most
important tool the calendar I can share
with others but it's very very simple
just one through the pretty much does
all the heavy lifting
then another tool that I have is like
this little to-do list next to the
calendar very very minimal this thing
tells me what to do today and the rest
of the calendar tells me what to do this
week next week and in the coming months
manage your documents will make sure
that processes that are repetitious that
are being templated by you create
document templates manage your documents
be sure that you find what is needed to
be found and do link kind of organize
your file system in a way that it helps
you so basically the tools are there to
help you and you to force them into a
state that they actually do the
and that they ease your life and don't
force you to do things all the time
updates here and updates there and so on
and the most important thing with
getting organized and that's the very
much most important thing is everything
that you do and everything that you
learn and everything that you talk about
with your clients over the over the
phone or over a Skype session and these
things always write it down always put
it into writing and then confirm it with
a client that this is indeed what you
talked about we had so many situations
where we had a call with the client and
we agreed on something via voice and
then we didn't confirm with them that
indeed that was the thing we talked
about that was the amount of person days
that was the daily rates and so on and
then the abuse sentences like no and the
call you said something different this
was three weeks ago it's like no I
didn't I didn't say anything different
oh we heard it exactly so they kind of
altered the truth afterwards and that is
something that you need to avoid at all
cost that's part of getting organized
write down what you agreed on in the
phone call send them an email have them
confirm that this is accurate and then
you have it in writing and nothing can
happen and you're in the safe so this
often takes time and practice like one
doesn't get organized quickly if one
wasn't organized before believe me it
took me some time years actually but at
some point you'll notice that you are in
this particular state page and then you
actually can work fluently and don't
have any road bumps and hiccups anymore
because everything comes together
automatically and that's the state you
want to reach start as early as possible
my baby brother once said oh I'm a
student no but I don't need a calendar I
keep all that stuff in my hands like
dude absolutely not you will lead the
calendar start early
olav uses the calendar so there was
actually it's absolutely impossible to
keep all the things in your head
sometimes people pride themselves with
having everything in their head but that
is not a viable solution believe me at
some point it's gonna overflow you will
now have no chance to remember all these
things well as mentioned don't overdo it
with the tools there's like so many
shitty to us that nobody needs so make a
wise decision check what you actually
need keep it minimal use like three or
four or maybe five tools to get yourself
organized because that's usually enough
maybe you need a plugin or an extension
or something like this but may
sure that the whole thing is lean
because otherwise the tools are gonna
pretty much drown you in their features
and then you don't take any benefits
from them at all keep it lean that's
like the most important approach here
one thing that is like a personal tool
for myself and I started doing that
round about six to seven years ago Liz
working with mailbox zero who here works
with mailbox zero or knows what I mean
with that few people it's good good
mailbox zero means that at the end of
the day you pretty much have zero mails
and your inbox everything that had to be
done was done you receive an email you
check what's in that email you'll
respond and then you archive it so it's
gone and if something then happens or
someone responds back to you then it
will pop pop pop up again and you will
be seeing it again and you will be in
the position again of making like an
actionable tasks out of that but the
worst mistake that people are doing is
having like this huge overflowing
mailboxes and they have no clue what is
going on and I can identify meanwhile
people who do that because that's the
people that you write an email and
nothing comes back and then you remind
them and nothing comes back and then
remind them again for example via a
signal or with a call it's like dude
where's the scope information it's like
oh yeah over so that email sorry I know
already okay this person does not use
mailbox zero and that is problematic
because then important information gets
overseen so doing this following this
pattern or following this approach in my
opinion is a massive game-changer in
terms of getting organized you responded
your task is done the ball is in the
corner of the client or wherever you
talk to archive it make sure it's
invisible that you can't see it anymore
so doesn't distract you no time to
respond which is another small trick
respond with the question so like I'm
not really sure what you meant you could
you elaborate please archive it be done
have it soft because then they will take
some time and get back to you and maybe
when they do then you will have time
again to actually work on this
particular task make sure that there is
nothing in your view in your mailbox
that distracts you too much keep it
organized keep the volume low make sure
you have mailbox zero I can really just
encourage you to do this because it's an
amazing helper and once you're there
once you actually reach that stage
that's the top feeling
my approach is you Ravidas when it goes
towards six o'clock in the evening I
work towards everything inbox empty and
I know that this is usually not
successful because we have lots of
clients of different time zones so when
I start working they just get up and
then I get tempted like it's seven
o'clock or an ale o'clock nothing like
hmm I could maybe have another look at
my mailbox that see or no there's like
five new mails and then you're back in
work mode don't do that because in the
end if you do this and if you keep doing
this if you don't respect the fact that
people will write you at all times
during the day a because of time zones
be because they're crazy then you will
go crazy as well and you might indeed
fall prone to the risk of burning out
because you will never really stop
working and you shouldn't do this you
should set like a line you look pretty
much set like a threshold and then from
this moment on I'm not checking emails
anymore I know that there's like ten
more but I don't care because my workday
is over check out the next morning with
a fresh eye and it's better for you and
it's even better for the client because
you delivered better quality and you
don't hastily respond and give them the
feeling that they're not important once
you mastered mailbox zero and once you
mastered getting organized and have a
good feeling about the things that you
do that you don't really you know you
kind of noticed in the situation when it
actually takes place that you are there
then you can take on bigger dragons and
take on bigger projects and it's
mentioned this might take years to get
there but it's worth the work and I can
only but recommend to go there another
thing that you definitely need to tackle
which is a bit harder is your own
security you're a security company so
you need to be secure as well your
website needs to be secure and your
document store needs to be secure and
your co-workers and your team needs to
be properly secured and for that I think
it's important that you know your own
threat model and I often talk to people
who select yeah I have like cubes or as
running on my laptop and I spend like
five days of setting it up and now I'm
like safe from the NSA it's like man and
you're not part of the groups of people
that the NSA would monitor they don't
care about you you find web backs or
server parts and these things stuff with
like a small or low half left they don't
care about you the NSA or whatever
agency shouldn't be in your threat model
because they attack other people like
you don't have enough candy for them to
even notice you so don't have a threat
model that forces you to be overly
paranoid and spent your entire T of time
with hardening your posture because if
you go to that point you will eventually
realize the perfect security will kill
productivity because then you start
thinking about this and that in taking
and paranoid approach and this will
consume so much time that you can't use
for doing a Shi useful things so try to
find like a good balance my good balance
for example is I know that I'm running
and I'm running limits and I know that
it's not optimal I'm running Ubuntu as
an operating system I know that it's not
great like there is definitely security
shortcomings in this operating system
I could also run Windows 10 and it would
also be security shortcomings or privacy
shortcomings here and there but I don't
care too much because in my threat model
and actually quite fine because lastly
the information that we sit on is box
that are about to get fixed and I rather
want to be a bit more productive and
overly paranoid one thing however that
you need to consider is not an external
attacker but the chaos monkey something
that kind of precious in your computer
ruins your hard disk or anything like
that or your cloud storage is being
deleted for whatever reason mirror
everything back everything up in
different locations I for example have
three different locations where are two
automated backups and I don't think that
I can't really lose stuff because
they're completely isolated from each
other has nothing to do with each other
so I'm feeling fairly ok if I lose my
laptop today doesn't matter could happen
I mean I don't want to lose it but it's
not gonna throw me back too much
exercise that practice advanced what we
for example do or what I do once a year
is pretty much play the chaos monkey and
just like delete my partition and test
how long it takes me to be fully
productive again
meanwhile I'm around about six hours and
after six hours I'm up and running again
I have everything that I need my backup
is plated
and I can start working again of course
there's details here and details there
but if you practice this a little bit
you will be pretty much safe against the
chaos monkey that is attempting to kind
of destroy your work and you won't lose
data anymore and you're gonna be back on
track as quickly as possible you can use
for example SVN or gate that is external
and a couple of other tools that
basically allow you to do backup I use
SVN as a backup tool is that smart maybe
not but it works for me and so far it
has saved me multiple times so I'm doing
this now about the final egg and this is
like the most important act because it's
mentioned we're gonna talk about
ourselves are gonna talk about people
about staying sane because we're all
just humans and a lot of pressure might
actually drag us down real hard and we
don't want that it doesn't make sense to
first build something awesome and run it
and then realize that one was too much
and you're burned out you can't do it
anymore and then watch we don't want to
have that so let's talk about how to
actually stay sane and deal with all the
pressures and all the challenges that
are actually existing in our field and
in other fields as well sorry surviving
all the it's one of the most
hardest parts in this job I feel because
clients will give you so much idiotic
feedback really oh my god this can't be
true the ideas that they sometimes have
the expectations that they sometimes
have are absolutely crazy and if you let
these things go under your skin this
might be really bad so you shouldn't do
this you should grow a tougher skin and
make sure that they can't drag you down
with their nonsense not all clients of
course only a small portion of clients
will do this but this is oftentimes
enough to ruin your day and then ruin it
for other clients as well of course
usually or from my experience like the
first clients you have are the nice
clients because this mention is probably
the people that you already know or had
contact with so they're not gonna be
nasty to you but then word goes around
and people start to learn about your
company and recommend your company and
eventually you will have your first
client like the first client that is
like really annoying and can't be
appreciated in any way of course they
gives you money and you give them
services but in the end at some point
you might realize
I actually don't want your money because
no this is not do not not pleasant
mention the first ones are usually quite
nice and quite fair
but the bad ones will come and the
question is what did you do with them
that's a bit hard to say and a thing is
like important to kind of first classify
them to classify and categorize the bad
clients that you're gonna have at some
point because there's a variety of bad
clients that you can have I call them
asterisk holes will not be too graphic
so there is the first category of Esther
is Kol that basically says your rates
are too high you should be much cheaper
this is such a douche move because
effectively the client tells you that
your work is bad how can they even dare
doing that how can they dare telling you
that you should be cheaper you don't go
to the to the to the car dealership and
says like this is a very nice
mercedes-benz here but I just want to
pay half because I think that's
appropriate and the car dealer would say
off go away you can do that too you
can be that car dealer it's just like
ridiculous they exist and they will come
they will even lie at you they will say
like well we have a couple of other
vendors on the line as well and they're
much cheaper then go with them then
don't come to us go with the other
vendors if that's better if cheap is
important let go with them you don't
have to deal with that there's so many
clients in the world how many people is
the world moment on inhabit six seven
billion so many clients you don't need
this one then there's another asterisk
all category and that is your report was
so bad we're so disappointed I'm not
gonna pay you I'm gonna pay you less we
had that usually you have a contract
that kind of makes you think sure but we
often had clients that kind of stalled
us our report was excellent it was
really really good
the team spent a lot of energy and then
the client tries to kind of push the
price a little bit by making us feel bad
the first one the first Esther iskills
is like you're too expensive the second
one says like oh your work is bad kick
them out fire them don't work with them
you don't need them the world is big
enough another category that that I'm
pretty much confronted with at least
once a month
often times even more often is the Shuar
next week's test is definitely gonna
happen you reserve the slots for us we
prefer we prepared everything perfectly
okay we're gonna start fresh on a Monday
and on Monday morning you heard nothing
from them and on Tuesday morning you
heard nothing from them and on Wednesday
their righteousness like yeah we had a
little bit of a delay it's like Bentham
is sitting here and waiting and idling
we're not making money right now we just
like sitting here and waiting so yeah
I'm so sorry
can we start next week no we can't
because next week we have a different
project we don't have time next week oh
can you not move things around like no
we can't we move things are out already
for you but giving you a slot and
planning and reaching out to you for the
preparations and you didn't answer we're
not going to do this again it's very
very annoying but it's another situation
where you need to discipline the client
and tell them no this doesn't fly we're
not gonna do it next week we hit this
week plant and no other week at some
point they learn but it's painful it's
like once most of the one of the most
painful test results in my opinion and
then the most important one that we just
had this we just had this case it was
ridiculous I'm gonna tell the story
about this the client that basically
says we're gonna pay you for the work
that you did that was defined in the
contract and then we're gonna keep
sending you emails with questions over
and over again and ask for more more
more more and more another report
another editing another version here's
another question how do we fix this back
what is going on here can you have a
look at this particular thing can you do
retest and they expect this to happen
for free we had one client recently that
are fired with a high level of enjoyment
that asked for eight reports we had one
in the contract they wanted eight eight
reports and different versions and then
they didn't like what we sent them
because we were still friendly to some
point and then they took the PDF and
they cracked it open and they modified
it as they liked it and then their CEO
reached out and asked like do you can
kind of publish this instead I wrote it
how I like it much better it's like
you what are you thinking this is the
document with our names on you can't do
this
this is ridiculous there's like Oh
apologies I've heard resolved this was
okay this is not okay so we fired them
we told them that this should just
please leave and never come back because
we don't need them they need us we don't
need them and I think this is a good
methodology at some point when you're
strong
as a company to just like fire the
clients that you don't need some clients
are really nice the majority of clients
are really nice we have a lot of client
that we really really love because
they're amazing and they're supportive
and their respect that we work with them
on pretty much the same height like
pretty much without this condescending
relationship of vendor client and so on
this is amazing you're gonna have a lot
of them as well if you're really good
and you should keep them but the ones
that act like enraged five-year-olds you
need to get rid of them because they
give you no value at all and they're
annoying they take your time and they
stress you so much that at some point
you don't enjoy your job anymore you
don't enjoy your work anymore and that's
the last thing that should happen so if
you have a client that is really
unpleasant fire them you can fire
clients and at some point you might
actually enjoy that feeling when you if
you do this like its said enough is
enough get the out so that's good
and you should really do this if it's
necessary at some point and that is
something that you need to train as
early on as possible is tell apart the
good flying through our client from the
bad plans sometimes in the initial phase
it might be a bit bumpy don't fire them
then wait a little bit give them some
chance gives them some time because
maybe you first need to tell them how
you function and you need to learn how
they function and after some weeks or
after some projects together you will
realize that they're actually quite
great so give him some time but also as
mentioned hire them if needs be if you
realize after some weeks that everything
is like a mess and everything is like
bumpy and the test is not well planned
from them they are unprepared and they
give you a couple of these asterisk old
categories if that already goes bad then
how can you expect that the invoicing
process is gonna be smooth because there
is going to be the next problems and
more pain for you and zero pain for them
because they're just desperate calls so
another thing that helps you with these
things and that is something that I
rarely experience from other security
companies at least not as often as I
would hope to partner up a lot partner
with other small firms make sure that
you build up a network of small firms
that are similar to you work
them because you're not competitors as
mentioned the market is huge there is no
need to kind of steal each other's
projects rather the contrary invite them
to join your project if the contract
allows tell the client that you partner
up with someone else to kind of handle
the project and build up a network of
friendly other companies around you I
know a couple of companies in Berlin who
for a long time didn't partner at all
they were just like pretty much like a
fortress and then there was a managerial
change and they opened up and ever since
then they've been doing much much better
we're a partner with them we work
together we have a fantastic time and we
oftentimes do it in a way that when a
client reaches out to us and says like
well we won't have a penetration test
okay I'm probably gonna be fifteen
person days okay and it should happen
next week that's not gonna fly we don't
have time next week oh that's too bad
but we have to do this next week still
not gonna fly but we have a couple of
partner companies that are really good I
can recommend them and then you just
send the client there and everybody's
happy you're happy because you don't
have to kind of over plan things the
partner is happy because they get a cool
job from you and the client is happy
because they get their stuff done on
time and they have the feeling that
you're not there to kind of squeeze
money out of them and kind of pressure
something that is that it's not even
necessary I won't give good results but
you have their security in your best
interest so just like passing them on to
the next best partner and everybody wins
partnering is also a thing that will I
be helping you to survive q4 who knows
what I mean with that surviving q4 like
the fourth quarter of the year
that's the diarist of all times because
in q4 there is so much budget left and
it needs to be poured out on some people
so in q4 at some point once you like
more well-known as a company everybody
will come and want their pen test people
come six months in advance just to make
sure that they get a slot in September
or October or something like this and
you will definitely be close to Bernard
in this quarter because the workload is
insane everything always seems to happen
in q4 q1 is then usually very very calm
you can relax again but q4 is darkness
light tons of work tons of money most
probably tons of challenges but I would
close I would be close to say that in
this particular quarter and this is what
we
it's just too much but if you have
partners where you can share the
workload with it's much easier just
gives em pom products and they do
something with you and so on you pretty
much you share the pressure with others
and again that makes everybody happy
makes you happy makes your partner's
happy makes your clients I mean
everybody wins in the end I mean of
course partnering might fail and your
partner might be letter asterisk oh and
you might get burnt but quite honestly
that never happened to us and I think
it's worth the risk of that happening
because the benefits are just like so
big so q4 as mentioned be prepared for
this it's a really tough quarter and the
more well-known you are and the more
clients you get the more work will come
at you in q4 we meanwhile have like a
meeting in the team where we basically
select okay everybody brace yourselves
q4 is coming and it's gonna be bad and
we have like mechanisms how I can make
sure that people don't get too much work
they can kind of opt-out says like hey I
need a week off I can't do it anymore
because it's too much and so on and so
on you will find your tools you will
find your mechanisms that allows you to
do this but make sure that in this
quarter you don't burn out because it
ever goes so quickly I myself at the
problem last year last year I was close
to a burnout like full-on like the the
non funny parts was like getting panic
attacks and crying all of a sudden like
all these things just being completely
done make sure that this doesn't happen
to you because it's all about the fun of
the work that you will have and it's not
worth to burnout and there is always
tools and mechanisms that can prevent
that from happening don't value the
money and the work too much also value
yourself because that's in the end the
most important part don't underestimate
it
because burnout is a DIYer of thinking
it's hard to recover from that it takes
a lot of time once you're really in that
particular zone it might take months
maybe even years for you to get back I
know a couple of people who had burnout
and they were gone they were like
disappearing from the field for an
entire year you don't want this to
happen to you so be very respectful of
your own boundaries and your own
pressure levels that you can take and
make sure that this doesn't happen to
you and if it means that you can't do a
certain project and you have to delay it
then so be it you are more important in
the project your health is more
important than the projects
you need to however learn that your
pressure levels and the amount of
pressure that you can take will grow
over time like you will get used to
things as mentioned you will grow a
thicker skin and eventually you will be
like strong enough to kind of take a
workload that you couldn't take two
years ago but you can take it now and
maybe in the future you will be able to
take even more but don't overdo it
don't test yourself too hard it's not
worth it effectively the only thing that
you need or that you can do here is like
look at yourself observe yourself and
ask your peers how am i doing kind of
give you the impression that I'm close
to a burnout is everything still okay
and they will likely help you and tell
you well you are quite erratic recently
so you should be taking care of little
but if they say something like that to
you or if they show you concern respect
that and actually follow their advice
and step down a little bit from the
extreme pressure that you're giving
yourself don't burn out because you're
the most important part in this company
at your building and your team is the
most important part in this indistinct
your building so also watch out for
others help others by telling them if
you have the feeling that it's the time
that they should kind of step back a
little bit so we're almost at the end of
the presentation and let's sum it up be
organized organize yourself that's the
most important thing be more organized
than your clients because they will come
at you and they won't be organized
perchance
be open be open for new things to come
in don't kind of lock everything down be
open for partnering sometimes for
interesting or for weird clients just
accept them and see what happens because
what could go wrong be strict make sure
that the client follows your rules as
well you follow the clients rules they
have to follow your rules be stubborn if
something doesn't go the way you want it
try to make that this happens kind of
tell the client that it doesn't fly if
they want this and this and it and that
and then change directions tell them
what the track is on which you and the
client can actually navigate together
and last but not least
needless to say be brilliant we always
as good as you can and what you do and
don't lose the fun because the fun is
pretty much the fuel for brilliance
so make sure that you have fun in your
job then the brilliance will come
organize yourself be strong stand for
yourself watch out for your team don't
burn out and then you're gonna have a
good time
so that's but at least be mindful it
still just jabs it she'll just work it
still just project it's not life and
death you're still the most important
part is the human and please never
forget that if you burn out if you can't
deliver what you like to deliver any
more than no one wins and no one wants
that so I think we've reached the end of
the presentation and I hope that now you
have some pointers that might help you
building your own thing and staying sane
in the process as mentioned you managed
my very and there was probably a lot of
things that were specific to us or
specific to others but I think that
least there's a couple of common ground
that we can see in this presentation
that might help you to actually kind of
do your thing and end up as being very
very happy and that's the most important
things so just know if you're unhappy as
an employee or unhappy with what you're
doing right now it doesn't have to be
like this you have the power to create
your own thing it can be fun doesn't
have to be it can also fail but usually
it goes quite well and it's likely going
to be cool and one thing that is most
important to say right now right now in
InfoSec we're leaving in the fat years
where like there's projects and clients
all over the place we never had that
much work as we have right now because
of regulations and the general situation
and the news reporting on hacker attacks
and whatnot these are the fad yours now
is the time to if you get started and
why not try not to be a whale
try not to kind of grow too much stay
like a wasp or a Hornet say agile and
small and dangerous and edgy stay or
become the team that you want to be
build what you want to have and pretty
much then there's nothing in the way
between you and a successful project and
a successful company and your being
happy in the end don't be too dried out
therefrom be value driven help your
clients help your team help yourself and
have a good time so maybe it's time
right now maybe this inspires people
here to create their own companies just
like see whether it works or not
I think now is a good time so why not
right right now and
I wish you the best of luck and that's
all that I have thank you very much
[Applause]