okay so my name is brandon storytime
and the reason why i'm
doing this talk is because uh
a lot of times at conferences you only
hear about the you know the successes
the things that went
right um so for a while now
i've been teaching at marshall
university
and my students come up to me and and
they feel
you know sometimes like uh they're just
not doing as good as they can
and so i always have to explain to them
you know especially whenever
you're at conferences you're really kind
of watching a polished view
right you're watching that couple of
hours worth of
of polish in the hundreds of hours worth
of failure
so uh a few years ago in
uh hackercon i did a
non-technical presentation on prepping
and so now whenever i get the chance i
try to do some non-technical
presentations
and i usually do it uh you know
highlighting my own failures just
because
you know people typically come up to me
afterwards and they say
number one uh thanks for being honest
and number two
i can't believe you recovered from that
that was pretty dumb
uh but congratulations so here i am
and uh welcome to story time
so me i've already touched on this a
little bit but i'll go into a little
more in depth so i am a christian i
always say that up front
um uh
there are plenty of conversations we can
have about that i'll just
leave that there for you i'm also a
husband and father i've been married
more than 25 years my oldest daughter
is 20 and she was at uh moorhead state
but due to co bid she came back home and
i can't wait for morehead state to
to start back up um
i'm also you know i have three other uh
kids
uh 20 years old 17 14
and 5. and yes there's a there's a
significant gap there
um yeah pushed back my retirement a
little bit but i'm still happy
um speaking of retirement i've already
retired once which is why i'm still
happy
so i spent 20 years in the navy as a
cryptologic technician
most of that was doing maintenance um
and then
some of that was doing network analysis
in
a intelligence analyst role which is a
pretty cool
um job that i had it gave me the best of
both worlds i got to still
remain technical but also get a better
understanding of specific
targets not as technology but as
the people that use them which that was
that was pretty fun
i am a uh project starter
and rarely a project finisher so if i
was to take you downstairs in my garage
you would see half
you know completed projects everywhere
every surface of my garage
usually the only projects i finish are
some type of hardware hacking on my
motorcycle
so i'm really into that lately whether
it be
you know adding of components modding or
just building things myself that i would
add
to to my motorcycle i'm an adjunct
instructor for marshall university i
have been
for what this is my third semester
i started out teaching just a
intro to open source intelligence course
and then now i teach as well as that a
intro to linux course
um and then most importantly
i'm a storyteller i learned a long time
ago
you know attending these conferences
that people
remember the stories that you tell
rarely do they remember the details
and whenever i started doing my own
presentations
it seemed like uh everybody was asking
me for my notes
i was having to manage you know github
and and uh my own blog and things of
that nature writing up
you know like after a conference i call
them after action reports because i was
military
um and things of that nature so
i decided to start switching i slowly
switched
i don't do very many technical
presentations anymore if i do it's
usually associated with
uh hardware hacking um
[Music]
and more so
lately i've been really focusing on my
kids
so i love secure west virginia and um
hackercon because both my
uh my my 20 year old daughter who was
then 14
they welcomed her as a presenter and i
really appreciate that and it actually
got to the point where at
15 years old she spoke at schmuten so as
a dad
really hit me in the chest right um so
then i started you know i focus on my my
second daughter
she's now 17. neither one of them
want to follow in my footsteps but both
of them love to tinker and do things
like that
um but anyway and then my my 14 year old
has pretty much told me to leave him
alone so i gotta
figure out how i can get him speaking at
a conference um and once again shout out
to
uh now secure wv uh for letting my
my second child my other daughter speak
so i really appreciate that
i'm always trying to push them and
this con is one of the best environments
to nurture that thanks you know big
shout out for y'all
all right so what are we here for um
once again story time i'm gonna tell you
about my career
uh starting in high school and falling
flat on my first you know facebook
before my even career started
um and then we're gonna we're gonna go
all the way up to
i think 2017 is where i stopped um
but basically each slide is going to
give you some
some milestones so some significant
events
are significant failures in my life how
i
recovered from those lessons learned
and then i'm going to talk about
imposter syndrome because that led to a
lot of my failures
one of two things earlier in my life
it was that i'm very type a and
back then it was it just oozed from me i
mean from every core
and then as i got older a little calmer
then i started with the imposter
syndrome and that that led to some of my
later failures
uh but like i said i always like to talk
about my failures and the hopes that
um you can actually pick something up
and and learn it from me
um and i won't say so that you won't
fail um the purpose of this talk is
actually to help you
understand that failure is necessary
it is a necessity in life and what you
need to do
is like i said learn from it um
do it again i mean you know people
always say learn from it the first time
so don't make that mistake over
no because no failure is the same
um the lesson may be the same but what
led up to the failure is completely
different
and so
my first milestone was in 1990
i was uh 17 years old
um oh the 90s if you lived through the
90s in my opinion
it was great so we had people like green
day
right they introduced their own brand of
punk
and then you got to watch them traverse
into the
whole concept of they weren't actually
punk they became popular
so they were pop punk which they hated
and that forced them more to the punk
side but
whatever um we had the triplets
were in their second year they were
actually starting to win
right dallas cowboys go cowboys uh
aikman
emmett smith irvin um they
went seven and nine i think uh in in
1990
and then after that they started winning
and that was that was exciting for me
growing up in texas
but mostly i was a borderline genius
and i mean you know i don't have the
scores to support that
but in my mind i was one of the smartest
people i knew
i knew just about everything just just
asked me
and um you know typical teenager
at least teenagers in my household uh i
was in the top 10 percent of my class
um you know i was because i was a texas
resident top 10
i was guaranteed to see at any texas
state university
which in my mind of course right because
i'm so brilliant
uh and then um so i applied to texas a m
computer science program or actually at
that time it was computer engineering
program
and um lsu penn state purdue they all
accepted me for their
for their engineering schools and the
problem is
is my parents sat me down my my divorce
parents who were then
living together again weird and they sat
me down and explained just how poor we
were
and the fact that uh neither one of them
had paid taxes for a while and they
would greatly appreciate
if i wouldn't fill out those federal
forms
that that would actually put into
context how much they actually made
and because of that uh
financial aid just wasn't an option for
me and for someone who had their
their entire life planned out you know
that was kind of a shocker
and so i immediately uh
drove to my uncle's house told me you
were in the military take me to some
recruiters
and um he was a marine and that was the
first branch he talked to me out of was
the marine corps
um he talked me into the navy or air
force air force office was closed
so that was my first failure is the
inability to read
the opening hours of the business i was
trying to go to
and uh so i joined the navy my lesson
from this actually was
control those things that you can
control
make a plan and work the plan
so i had this this dream i was one of
those people that truly believed that
you only have a plan a because you know
if you have a plan b
you're you're inviting failure and
like i said now looking back on that
is absolutely wrong mindset if you go on
the link in
linkedin you'll see this everywhere
never have a plan b
um okay i mean it may work for you in
your one
instance uh plan b worked for me uh
granted it was a plan b on the fly um
so that brings me to my second milestone
so um the we had such
uh great movies as the last detail this
is one of my big influencers early in
life and if you've seen the movie you're
probably thinking
your parents were idiots if this was
what really uh uh set your your mood for
life
and looking back yeah that's that's a
valid statement they probably should
have never let me watch that movie
whenever it first came out
uh all right so um
but like we said i just wanted to enlist
so i went to maps i took the nuclear
power school
or the nuclear power engineering test
and as i was being presented the test
the nuke that was actually the uh giving
handing the test out cautioned me about
pursuing that rate
because and his sailor
words basically was it sucked
don't do it um so i signed up to be an
air traffic controller
why no no it was available uh
i'm a part of the top gun generation so
i know i couldn't fly planes because i
was going to be enlisted so hey air
traffic controller
uh the problem was they signed me up to
go to boot camp
in january now if you recall from my
first milestone
i was still in high school and i wasn't
going to graduate until may
so i had to get back on the bus head
back to houston
and pick a different job so my solution
was
they handed me a sheet that had all the
careers on it
and i saw two things number one was
that the school was uh eight months
in pensacola florida which i'd been to
before
and i loved uh the beach there and then
mostly worked in air-conditioned spaces
so whenever i say i fell into security i
literally just by the grace of god was
handed a piece of paper
out of a stack by the way this one just
happened to be on top um
and that's how i picked uh to be a navy
cryptologist
i knew nothing about it um yeah
so my lesson here is sometimes your your
plan just sucks
i have a backup plan um this was my you
know the second time learning this in
just a couple of months and we're
actually going to talk about that later
i'm going to come back to that
so uh i joined as a us navy
cryptologic technician and my focus was
going to be on
maintenance all i knew at that time like
i said pensacola florida
mostly works in air-conditioned spaces
and that i was going to get a security
clearance that's
that's really it that brings us
you know to the middle and yeah the
middle of 1991
all the way up through 1992 because that
was just a long string of failures in my
life
and um once again i survived so
what we had going for us that time fresh
prince of bel-air
was putting out some of the best comedy
genius on on tv at the time
we had uh the gulf war had kicked off in
1991
interesting story my brother was
actually on his way to deployment he was
a tanker
in the fourth infantry division and he
got
what was his first dui so instead they
sent him to
fort irwin california which if you look
is one of the hottest places in america
and he actually helped train the
mississippi national guard who never
deployed
um so he was one of two people out of
almost a
thousand in his unit that never actually
deployed
um so uh if you look at this picture
this is my graduation
picture from my my what they call a
class a school or your basic school
it was uh eight months um what you'll
notice
though is i'm actually not in this
picture and that leads me to my next
failure
so i literally almost flu flunked out of
this of this navy school
which um if when you join the navy
and you have what's called a rating or a
career
field if you flunk out of that school
they usually send you out to the fleet
undesignated
what that means is you're the lowest of
low
you do basically whatever you're told
you usually work debt division which is
painting and scraping and
you know uh doing all that kind of stuff
not saying there's anything wrong with
that but i'm just going to draw your
attention back to the
mostly works in air conditioned spaces
is
what brought me to this field so uh this
special shout out to a man named terry
chimsky um ski actually
helped me through the module that i
failed more than once called
a special circuits and if you know
anything about
jk flip-flops or logical functions um
i just couldn't do it
couldn't do it so i was 17 of 17
once i actually graduated from my from
my class
and then i went on to an advanced school
for some reason the navy decided to give
me
an advanced school right out of the gate
there
during the first half of the course i
was number five of six in the second
half of the course i was six
of six so i'll just say that my
priorities weren't necessarily in the
right place
right order uh my lesson from this is
always trudge forward um make
deliberate baby steps if i was to look
at the complete big picture during this
year of my life it would have sucked
but because i really focused day to day
you know this is what i have to do
tomorrow to stay in school
this is what i have to do tomorrow to
stay in school
that's what actually helped me get
through this time
um 1994 is my next biggest failure what
we had going here was a
tlc i mean come on if you were alive in
in 1994 tlc was where it's at
um but my problem was at this point
after my advanced school i was on
submarines
and i was doing maintenance we would
bring our equipment on
we would fabricate the materials that
would hold it in place
we would install it we would maintain it
i was really good at that
i was still an idiot who was 20 years
old
and had problems with the other parts of
my life
such as uh i was laid a lot
so i almost actually
um was arrested under use ucmj article
87
and i still remember with this ucmj is
the uniform code of military justice
and it's basically the legal or the laws
above and beyond our federal and state
laws that govern u.s military
and missing movement literally means to
jump from a vessel uh or miss
the deployment of the vessel um any
person subject to this chapter who
through the neglect
or design misses the movement of a ship
aircraft or unit which the
person is required in the course of duty
to move um shall be punished as a quartz
marshal made direct i still remember the
language of that
because of all the dumb things i'd done
before and all the failures i'd had
before this was
really the one that really had me you
know it was a wake up moment and the
reason for
that is because you could get a
dishonorable discharge
uh you could get confinement for up to
two years
and loss of pay for that whole time
you're confined
luckily i had a commanding officer who
had actually
missed ship's movement as a young sailor
he had i think at that time 26 years in
he dismissed all the charges which
everyone
uh and it was a closed-door session that
we had
meaning that it wasn't uh public
the only outcome that was made public
was
i was gonna have to deploy on that same
ship
for 90 days so
uh what i learned from this is you can
you can
pretty much survive almost anything
for 90 days because i'll tell you once i
got on that ship
i understand why you know i thought he
was lenient
but that was probably the biggest
punishment i've ever had
because i really had to grow up and
basically
uh you know i had 112 people i think on
on that submarine
who were all relying on me uh for
deployment
and i screwed that up for him so that
was a big one
so more on that later because even
though i learned a lesson
i didn't necessarily learn how to apply
the lesson
all right next milestone 1999. i mean
the highlight of this
britney spears and christina aguilera
hello
this was right before they both went
absolutely nuts
and um uh fight club was ruling the
theaters
uh one of my favorite movies um
fight club and less than zero favorite
movies
and then we have this little thing
called y2k that we had to work with
at that time i was doing long-haul
communications for the navy
i was uh stationed in suitland maryland
and we were responsible for well over
500 circuits i'm talking everything from
satellite
dial-up which was uh like none 9.6
bod um all the way up to yeah
i said broad not not like kilobits per
second was just
9.6 bonds we had several
uh t1s which at that time was a 1.544
megabits per second so we're starting to
get to some
modern day speeds and then we had a
single oc 48 pipe which were i think was
2.5 gig gigabits per second
so we had like i said well over 500
circuits
um y2k was coming there was a lot that
we had to do
if you weren't around for y2k uh
we were told anything from the lights
would flicker
to airplanes are going to fall out of
the sky was going to happen
it was really depending on who you
listened to
it was either going to be nothing or the
end of the world
um so we're making preparations for this
i was told i specifically was told
because i was a team leader at that time
i had six maintenance people working for
me and
what we were supposed to do was shut
down all
non-essential equipment and then shut
down the breakers
for those uh for all of those racks in
the communication center
um it was easy we had multiple panels
they were color coded uh if it was red
it was emergency in other words those
had to operate at all costs
um if it was gray or blue
then it was uh you know not uh necessary
equipment
so my boss told me to to
you know prove to him that everything
was turned off that was non-essential
so after we had done the shutdown
closed all the breakers i'm sorry opened
all the breakers uh he said that's
whenever he came in and said i approved
me
so i walked over to the panels i mean
these were huge panels in the
communication center she had to use two
hands and blow
you know throw that main breaker so
throw the breaker pop
go to the second one throw the brick pop
go to the third one throw the breaker
pop hey what happened to our linux
servers
the voice i didn't recognize and the
reason was
is because unbeknownst to me so we were
a secure area secured from the rest of
the building
that was a secure area and then they had
carved out
space from our secure area to set up
another
communication center that communication
center
was so secure
that they whenever they installed all
their equipment they didn't want
labels on our breakers to give you know
give a clue what they did
so they removed the labels uh not only
that
our emergency panel the one that had to
stay up at all times
it was full so they went to one of our
non-essential or non-emergency panels
uh wired in their circuits took the
label off and whenever i threw that
breaker
all 100 105
uh unix and
other types of servers crashed
so what i learned from this is um
always approach your procedural
documents
as incomplete or flawed
um we're humans we're the ones tasked
with keeping up with procedure and
policy and things of those nature
um sometimes they just get
left behind not updated
so also i learned that unix servers are
really
hard to recover from a from a
shutdown and
always provide ups support for your
servers
all right on top of that i also
learned that you can do anything for 90
days because that's about how long it
took us to
completely recover from shutting down
the other communication center
that was fun all right so my next
milestone was 2002.
uh at this time i mean nickelback was
absolutely killing it
and if you're laughing about nickelback
you should know
that they are on the top five album
seller list of all time so
go look it up if you don't believe me
they rock
i i tried to say that with a straight
face some other music i do like
uh the other thing hey leo leonardo
dicaprio he could actually grow a beard
at this point in his life or
at least the makings of a beard um
and then uh this is also where i learned
my alter ego
uh it was sally mae so at this time i
actually was stationed
at a royal air force base in uh digby
england uh
lincolnshire was the county and um
so because of my role there once again
i'd gone from a
communication center with over 500
circuits
the communication center at digby for
the us
navy was two circuits and despair
so three total um so i had a lot of
you know idle time on my hands and what
the military is
really good at doing is making sure that
you have no idle time
so in addition to being the
communications guy
they actually made me the um
uh system administrator for
for our network and yeah
but the first thing i'm going to tell
you my first failure here other than my
choice of wardrobe was um
the fact that the us military uses a lot
of hardware encryption devices um
and in doing so they have to share uh
pre-shared keys
uh for this particular encryption that
we were using the pre-shared key
came in a plastic canister and
it was a paper tape that had been you
know holes punched in it
and it was an optical reader that you
would pull it through
you would load it into the reader then
you would load it into the crypto device
you would do what we call a bump
which means you simply interrupt the
circuit for a second
and then as long as the other end had
loaded theirs within a certain window it
would just come back
up and things were good the problem is
is if you're not paying attention
whenever you're pulling that paper out
you get to a perforated edge that's
supposed to be a tear edge
i was talking cutting up carrying on
like i normally do
so i'm just pulling tape and i pulled
past that mark well you can't push back
in
so if you pull past that mark where you
can read the first character of the
title of that next script
that's called a double pull and you have
to fill out a lot of paperwork
now interestingly enough because of
in in the early 90s we had a former
sailor that actually was selling a lot
of
uh uh crypto the pull tape to the
soviets at the time
um we had something called two person
integrity
and uh the fact that i pulled this tape
further
was actually more of a you know
an issue than missing ships movement
previously
so there was an investigation to that uh
you know to make sure i wasn't trying to
sell this
crypto tape to the russians
and and um once i was cleared
um they actually uh you know
it was a non-issue uh but yeah that was
uh
that was three months of my life that i
wish i could have gotten back
so what i learned from this basically is
attention to detail
it's fundamental i mean there's 99 you
know 90
of our life you don't have to be paying
attention uh your brain is gonna
you know do things on its own uh but man
that other ten percent
is truly important so make sure you
figure out
especially within security um what that
ten percent is
all right uh next milestone 2003 so the
next year
uh basically i was still in england and
um
sorry and uh you know once i got cleared
uh then the navy allowed me to re-enlist
because i actually had re-enlistment
paper
paperwork put in um so
we made a little jaunt down to
uh london and um i was i was allowed to
reenlist
but this gets me back into my next story
so like i said i was also the system
administrator because
i knew nothing about active director i'm
sorry um
uh i was a network guy and a
communications guy but they wanted me to
maintain the
the primary domain controller and the
backup domain controller
and whenever we got back from this trip
actually
this was the people in this picture were
literally about 75 percent
of the people that that were in our
command i think
we left like four people back uh just to
stand the watch
but now whenever we got back uh
immediately i was approached and i was
told that our
primary domain controller had failed and
um as a hardware
failure and i needed to promote the
backup domain controller
then you got to remember this is
pre-active directory if you know
anything about active directory you have
some well-established peering that
happens
one goes down the other one takes the
load and you're good to go right you
just
fix the primary one or replace it or not
the primary it's pure
well back in the day you had to actually
promote
the backup domain controller everything
went well
we had checklists in place we had um
you know practiced the problem was
because we only had a primary and a
domain and a
backup nobody ever wants to do a full
function test you know they don't want
to say
yeah sure just shut down the primary
we'll stop operations
the business won't be affected too bad
and we'll go ahead and
promote that backup um even though that
was
actually in our procedures we were
supposed to do that annually
we had never done it because it always
you know the mission is too important is
what we kept saying
so what we discovered was our procedures
for
doing this uh primary uh you know
taking that offline and bringing up the
backup they were spot on
we had never properly tested our backups
we did monthly full backups weekly
backups and actually the daily
differentials
and for approximately six months leading
up to this
we didn't know that we didn't have good
tapes because we'd never test them
every one of them were either corrupted
because of where we stored them
off-site someone else's facility or
they just weren't being written to so
lesson here you'll hear it in every
military movie train like you fight
check your backups periodically if
you're doing backups and
practice practice practice but more
importantly
do a complete practice don't just go
right up to the edge and say
that's good enough we'll finish that
last mile
you know if it happens because when that
last mile when that failure happens
you're not going to have that last mile
nailed down
so yeah that was a big one
that one hurt too um
all right 2005. so if you were if you
were paying attention in 2005
you basically knew everything there was
to know about destiny's child right they
were basically ruling everything
um in england where i was stationed it
was still a little bit different
but you know they were at least on the
top ten
they had some weird spaniards singing in
english
that for some reason we're always number
two
um but anyway then we if you're into
into uh rugby like i was at the time
uh and especially being stationed in
england at the six nations tournament at
that time
and they just steamrolled everyone that
was exciting to watch i got to watch
every game in england scotland wales
um ireland watched one of the games in
ireland
and then uh obviously i watched the the
france
uh game on tv but i mean these guys it's
the first time i've ever seen the hakka
and and that that's a picture of the
hakka right there what they do their war
chant to get them hyped up before they
just kick the crap out of everybody
and then i would show you a picture of
me but hey at the same time
i actually had my hands on season
tickets to see manchester united
which never happens especially for
foreigners unless you got big bucks but
i looked into that
um so if you don't know about manchester
united at the time
they were it this is my boy uh
uh ronaldo right there you at least know
about ronaldo
the guy with his back to us and by the
way i'm on the field right here
taking this picture they wouldn't let me
get closer but they let me take the
picture
gabrielle jensey i mean the dude was
phenomenal defender
out of argentina and we had ruud van
nistelrooy at the time paul scholes
i mean it was just oops it was just they
were killing it
um at this time there were
this milestone wasn't a failure but
um my you know the navy came out and
they said
we don't need all these maintenance
people so we're going to create a new
rate and we're going to call it
in for you know ctn for networks
and that's going to be different from
like our it personnel
the ctns are actually going to be
analysts and they're not going to
analyze our networks they're going to
analyze our adversaries networks
um so they actually retrained me they
sent me back to back to pensacola
florida for a six-month course called
basic digital network analysis and um
it wasn't basic at all so this was some
very
in-depth network engineering courses and
intelligence analysis courses so it was
uh
it was hard luckily i had learned
something from my previous failures
and i did pretty well in this class uh
because i did well enough as soon as i
got to fort gordon
georgia which is my duty station um they
picked me up for a follow-on course up
at fort meade
so for 90 days i actually went to a very
intensive
uh intelligence analyst course up there
and
what you would do is they they would
give you a target
you would work this target for 90 days
and in order to graduate
um you actually had to present your
target package
uh to a lot of the the like the
directors of
of are the associate directors there's
only one director of nsa
for the associate directors you had to
do it with your
cryptologic components so i actually had
a flag
um and admiral come in for some of our
presentations
and what they did was they gave you an
honest assessment either a thumbs up or
a thumbs down
whether they would hire you for their
organization based off of that 90 days
of material
and we had probably a 20 failure rate
um i was well on my way oh and by the
way
they would teach you a new concept a new
tool a new technique
and then you would spend a couple of
days applying that to your target so
we're talking
really advanced material here some
really good coursework
um 45 days in
uh i'll say that we had some
geopolitical forces at work and
that led to my target being changed
so i had to then create a target package
to graduate that i was going to brief in
front of all these people
with 45 days left
so that is uh that was something that
that i didn't think i was going to make
it through
um but my lesson there is uh
teamwork i mean the military is always
on always about teamwork
except in training environments usually
so
whenever you you're an intel analyst
they don't
want you talking to other intel analysts
until you graduate
and then all of a sudden they want to
incorporate all this teamwork right
different than ground units
they typically want you to uh to work
right off the bat
but so the other thing that i learned is
work life balance
can get skewed and it can
suck but once again pulling back from
that
missing ship's movement many years
earlier
i realized that you know you can do
almost anything for 90 days and in this
case
45 days so that was one of the first
times i truly
started to understand my lessons and
were able to apply them
all right so next is uh 2006.
this was a big milestone as a personal
setback for me
very little to do with the military i
actually had a motorcycle wreck
so i woke up
literally at the medical college of
georgia about seven days later
and they transferred me to the va
hospital i was there for four months
i learned that morphine withdrawal is a
real thing
it does make you itch and i learned how
to walk again
so so that was a that was a positive it
but it sucked
now about 30 days after i got out of the
va hospital
i got this nice little breach
notification from the federal
federal government and then i got one
right after that from the va
saying hey sorry uh your your stuff was
on the laptop
and it was stolen from the person that
that
you know was put in charge of it uh on a
train
so um my lesson there is
uh others have the keys to the kingdom
your kingdom there's very little you can
do about it
right uh especially after the fact so
that sucked uh but uh once again
uh i'm gonna do a time frame here from
2011 to 2014.
had a lot of little mini failures i had
retired from the navy which which was
good
i decided because of that whole va
incident that i would go to work in
healthcare whenever i got out
landed a great job in healthcare and
really the only thing i had
during this time period was just a lot
of really bad decisions about facial
hair
so everything from beards to lamb chops
to
flu man shoes and goatees and handlebar
mustaches
but the biggest thing here is uh
at the healthcare organization i was
with i was a senior security analyst
and one of the things my boss said was
uh you seem to be comfortable in front
of people
you're now in charge of training so that
was uh basically a collateral duty that
i was given
uh it wasn't part of my primary duties
um but i really took it to heart right i
i really like the guys one of my one of
my best
friends one of the best guys i've ever
worked for and uh
i came up with this concept of called
ask the geek
so think um you know uh the the genius
bar
right only i was gonna be the security
genius within our healthcare
organization
so i got a budget i did presentations in
the hospital
i did this booth called ask the geek
and i think the most number of people
that i touched in
from 2011 to 2014 was like seven
i think i literally had conversations
with seven
people other than people in passing
picking up stuff and walking away
i tried to pass out gift cards all kinds
of stuff just they weren't having it
so my lesson here is a passion does not
necessarily translate into success
it can it's a lot of time what motivates
success
but it's not necessary a couple of more
milestones
uh 2015 i was a managing consultant for
mssp
um i did a lot of charity work i
actually went over to
uh to kenya did some charity work there
i actually went over to uganda
by where hackers for charity was and i
worked with an organization called soul
hope
and then of course i went to jinja
uganda
and myself and my family actually uh
went and taught
at the hackers for charity uh facility
there
which is really uh inspiring
the problem was just the week i got back
i was met with
a hey here's a new hire someone we hired
while you were gone
and he's in charge of two uh payment
card
uh assessments and they're going on
concurrently
and um not a big deal i mean the guy had
five years of experience have been doing
this on his own
because i didn't know him i would check
in often right show him the ropes i sat
in some of his interview sessions
whenever it came down to the end i kept
telling the whole time
make sure you're writing your reports as
you go
we have a very strict time frame that we
work with
and i didn't check all of his artifacts
nor did i
monitor his reporting and basically his
work
was absolute trash uh the reports
were turned into the client two weeks
late we ended up losing that client
and uh my lesson there was an oldie but
goodie ronald reagan
trust but verify if you've never seen
that speech he gave
about the soviet union i recommend it
the other thing i learned is
i already had the knowledge skills and
abilities to manage
and lead the us navy instilled that in
me
we used a model a leadership model
called the situational leadership model
basically four quadrants um how much
monitoring
should occur based on someone new to
their job
new to the area you know new to the
to the commander or in this case the
business and um
i just i didn't employ that so make sure
um reach back do those things you've
been
taught to do but are sometimes hard
right uh next big milestone
uh 2017 so a couple of years after this
incident we had actually got bought out
by
what i would call globo core it was
competitor to att
very large organization we were like the
30th security company in the world that
they had purchased
and um things weren't going so well
ended up my new boss was very
authoritarian type hostile working
environment that kind of thing
so i jumped ship and i spent more time
in tampa than any human person
should i like tampa
but not that much when i wasn't in tampa
by the way i live in lexington kentucky
so this was all travel
i was with clients in argentina and
clients in india
and salt lake city uh so
what went wrong here is it's a very
small company
uh had a startup feel uh it was very
exciting at first uh but that was for
about a month
and then that's whenever i realized that
the you know 50
travel they told me about was actually
about 80 travel
there were unrealistic expectations
placed on the employees
especially the consultants and it's the
only
job that i ever actually feel that i
just quit
um i quit before
my first year so it was bad enough
it was the highest paying job i've ever
had in my life
and it was bad enough that i turned down
the 20
bonus that i was supposed to get in
january but i just said
enough's enough and my lesson here is
it's easier to find a job when you have
a job
and always perform exhaustive research
before you accept an offer so this was
the only time i ever actually looked at
money and it was definitely a mistake
so uh but it did speaking of mistakes it
did allow me to buy a lot of steak
whenever i was in argentina
and make some good friends in uh in
india
all right so that's kind of it about my
um
my failures i've only got a couple of
more slides left
but what i wanted to leave you with was
was two more concepts number one is
what i call the four pillars of a career
so in order to have career success these
are kind of the
the my wife calls them irreducible
truths
these are the the root cause for a good
career um number one and i'm not saying
you have to have all of them
i know some very successful people that
were installing
car stereos and are now very influential
people in information security
as pen testers are running organizations
so i'm not saying these are all a
necessity just from
my experience the more of these you have
the easier it is or or the better
jobs you can get i've never had a gap
in in my in my um my career
i've always had um at least
one job if not two that overlapped uh
even
even the day i quit but the first one is
education and training
uh it helps to have a degree um
a lot of especially corporate america
they want to see a degree and that's
usually one of the limiting
factors for not giving an interview the
second one
is experience u.s
government is really good in that if
they require a master's degree but you
have 15 years of experience then they
can
you can come down to an associates in
some positions
and your your experience is counted you
know as a part of the
positive field but yeah experience
even without a degree or certifications
which is the next one can get your foot
in the door and give you a lot of
opportunities
um that brings us to the next one
certifications
so uh just like education
you don't have to have a certification
but it really helps
once again hr will block you
from even getting an interview a lot of
times just the way the job interview or
the job
requirements are written and then the
most important one probably is
timing so i've had some opportunities
i was going to get back into pen testing
and
i hadn't done i think the last time i
did an actual
paid pen test i was using uh backtrack
so that'll tell you how how long ago
that was
um but anyway all that to say you know
there were times where i had everything
i needed for a position
but i was too late in applying for the
position and then there were times where
i didn't have everything these other
three pillars
uh but i was at the right place at the
right time and
have the answers they were looking for
so so that's key
uh next to last slide so we have um
uh and this is uh kind of my my be all
endo
uh beware those who are perfection
um whenever it comes to imposter
syndrome
the thing that always hit me hard
was usually the time period after coming
back from a conference
and the reason why i say that is because
i see these
legends on uh you know uh
on a platform uh talking about their
conquests
and what you never hear are rarely here
because there are some people out there
that are true rock stars that actually
are going to give you the nitty-gritty
and all the failures uh dave kennedy is
one of one of the examples
for every success he talks about he
usually talks about a failure that he's
had
um or or delays or you know inability to
get something to work
uh which is which is great um but yeah
that feeling that whatever we do is just
not
good enough like i said it it can hit us
hard
and um i've actually turned down
jobs uh not because of the risk involved
because like i said i'm a husband i'm a
father
that's my primary i'm gonna take care of
my family first
but i've turned down jobs not because it
was a threat to
or a risk to that but because i
just felt like i was going to let
someone down and they're taking a chance
on me
why would they do that i still suffer
from that today
but what i discovered is is like social
networking apps
conferences they give a false picture of
what reality is
so as you're listening to some of these
presenters just realize that
they're they're giving you 10 hours
worth of work
that summarizes hundreds of hours of
failures
at times so so keep that in mind and
then
my takeaways for this are always
reevaluate your plans
uh look inward self-actualization right
nothing you see is reality so if you
if you go into it as a skeptic
but with eyes wide open you'll learn a
lot and you'll be able to overcome some
of your own fears
and set your own standards i mean i
could have submitted a technical
presentation to this conference
you know um but i didn't and it's
because i wasn't ready to do everything
involved in in presenting a technical
uh topic this time so i presented this
and they sell value in it and i hope you
saw value in it
and and here i am so i i got to talk at
a
technical conference on a non-technical
uh topic and and i hope it's done you
know
done something for you um i practice
this phrase
often in my mind whenever i meet someone
i simply say your opinion doesn't matter
and i say that over and over and over
until i feel comfortable
talking to that person and just make
sure you don't say it out loud i've done
that you know i've slipped up our time
with you
that that's not a way to start a
relationship
so um so that act actually is all i have
i know there's like five minutes left
hopefully i didn't bore you to tears and
i'm gonna open it up for uh questions if
anybody has
questions your opinion doesn't matter
that's funny
and you're right don't ever say that out
loud
yeah i've done there's a time or two by
accident
and it really puts a damper on things
well i'll tell you i suffer from
imposter syndrome
uh you know i that that just especially
now that i'm
you know i've kind of started doing a
little job search on the side myself and
you know you it's it's really scary um
you know you you start applying for
these jobs and you think oh man there's
no way i can do this but uh
you know you just have to power through
it and and you know
what do you what do you find helps you
the most with that
so matt i i'll tell you that i have
not applied the positions that i was
fully qualified for
uh because it's a new environment
and and that scared me um but like i
said i
actually go through these mental
exercises now um
the whole thing of your opinion doesn't
matter that's just one of the many
things that i say
to get myself prepared for for new
situations
and it's hilarious because as a as a
youth as a younger person i didn't care
i mean if you told me no okay law of
percentages i'm gonna get a yes at some
point right
um for some reason now that i'm older
and i have
i don't want to say responsibilities but
you know i feel like i feel this need to
provide
um i run into this a lot now and it's
it's actually been bad enough where i've
had epic friends come to me and say
hey i want to hire you can you start in
30 days and my first response is
no because i'm going to fail you and it
takes them back sometimes
and and it's just you know it's one of
those things where
i haven't had to do it a lot but like i
said i actually go
it's almost like doing a little chant to
yourself um
i've actually had to go into another
environment and and just
do some positive reinforcement to myself
and that really helps
um and the more you do that the easier
it becomes unless you have to go away
you can do that in the moment so that
that's that's nice
who would you consider to be a one of
your
i don't say role model but maybe a
mentor that has really helped you along
in your
in your career path yeah that's that's a
good one so
uh doug fee uh worked he was
he was my boss uh whenever i got out of
the navy he's the one that hired me
and that was one of those things where i
look back now at the interview that i
had with him and i think
how did this guy ever hire me right this
was
years after i did the job right so i'm
still dealing with with some of that
those confidence issues
um but yeah doug one of the best things
he told me
is we got a new ceo that was a arms area
a cto
that was a former nurse practitioner
and had come up through that and took a
couple of classes in i.t
and she became the cto and what he said
was
he came to me and he said i'm concerned
that
you won't be able to grow here anymore
and so here's a list of people that i
trust that i think you should call
and so i was like doug why would you
you know why would you do this for me
and his response was
it wasn't about me what he said was
i've taught you what i can so that you
can apply it to
information security here if you take
that knowledge and do good somewhere
else i'm happy
and i thought wow that's the first time
i've ever heard that right
in the military especially i had dealt
with for years
people that that had rice bowls and all
they wanted to do was get rice out of
your bowl and put it in theirs right
they wanted to build
kingdoms and uh this was the first time
i had met anyone
so i still i applied for a ciso position
about
six years ago ended up turning down
because of
imposter syndrome and uh he he counseled
me through that whole process
he was the one that actually got me to
apply so doug fee
that's great that's great yeah
well uh i didn't i don't see any
questions in the
in discord so uh you know brandon we
really appreciate you
uh in your support of secure wb over the
years i know this is
probably your uh seventh or eighth time
present
and uh hopefully next year we will see
you in person
hey someday i'm gonna do another proper
one maybe next year if y'all accept it
absolutely that's still absolutely the
best one i've ever done i loved it
all right