Help the Diana Initiative

We interrupt our normal shenanigans for a serious post. For those who have not heard of them, first of all do not confuse it with NATO's Defence Innovation Accelerator for the North Atlantic (DIANA), which was created (and appropriated the name) in 2021. The Real Diana Initiative is a 501(c)(3) non-profit organization was founded in 2016 and runs a security conference focused on women, diversity, and inclusion in Las Vegas (for reference, DEFCON 31 takes place on Aug 10-13 2023, BSidesLV 8-9 2023, and the Diana Initiative on August 7, 2023). So, if you play your cards right you will have a full week of nothing but security and privacy talks!

Here are some videos from last year's conference:

And now the bad news, which with your help can become but an example of the community rising to the occasion: recently all the gear they use in their event was stolen including their Weller soldering irons which are used in their workshops, and now they need help. If you can donate gear, little pieces of green paper, or become a sponsor, do contact them either through their website or Twitter account. They are already considering canning their CTF; let's see if that is that is the worst thing they will have to sacrifice.

Reason I am making this post is to ask those who read my blog to see if they can help in any way. If you can, thank you! If you cannot, just pass the word to others.

Fired from your IT/Security job? Come to the dark web! We have cookies.

Your boss just asked you for a meeting. You walk into his office and realize HR is sitting there too; this is The Meeting. The company you have been working at needs to improve its quarter earnings, and you have just joined the thousands of unemployed IT and Security/Privacy professionals. I personally know people in that group. What to do? You have to find something else and quick: you have bills to pay and need to put food on your family's table. You will look anywhere for a job.

What about the dark web?

You would not be the first or the last. The truth is APT groups also need staff like any other business. The image of the lone hacker with no social skills and skin problems sitting on a dark room wearing a hoodie while being illumintated only by the glow of the laptop screen belongs to Hollyweird. ChatGPT notwithstanding, good malware does not write itself. Someone needs to be by the phone on the better phishing campaigns. Large scale attacks need monitoring, and attack servers do need to be patched. According to Kapersky, developers are in high demand in the dark web, and that has been the trend since COVID lockdowns:

How safe are such jobs? Like everyone else, it depends. Some are scams, others are worse than that (think being kidnapped in the middle of the night either by your new employees or the FBI/NSA/Girl Scouts). After all, many of these jobs are sketchy at best; they legality depends on which nation is sponsoring the operation and which on the receiving end. But, there are organizations who treat this as a business, so they have a vested interested in having happy and productive employees who are eager to improve their software and services to levels they never thought possible. Some developers adn attack specialists are being offered $20K a month for their services; that is FAANG salary right there.

What about the company that fired you? Maybe after passing bonuses around for cuting costs, they bought the amazing cybersecurity software I mentioned in an earlier post to replace their staff. What could possibly go wrong?

Thoughts on taking the CISSP exam - 2

Plan Your Dive, Dive By Your Plan

That is the motto of the Divers Alert Network, and I think it is very appropriate here... and on job interviews.

One thing I did not add to the original post on taking the CISSP exam is that on the day before the exam, I drove to it about the same time I expected to leave. Reason is that I wanted to know where the place was and how long it would take so I would be there 30min or so before it started. In other words, I wanted to eliminate a source of pre-test stress.

Without further ado, here are the real pictures I took that day:

1. First, here is the building. After driving there on the day before, I decided to leave home 15 minutes earlier to account for the traffic I saw. Also, I am glad I did the dry run since on the exam day, when I drove into the road that leads to the parking lot the building is located, it was packed. I then realized by looking at the vehicles they were going to the construction site I noticed in the previous day, so I was able to go around them instead of sitting there and missing my appointment.
   

   If you are not driving there, it is even more important to figure out how to get to the test site well in advance. Imagine if you need to take a few trains and maybe a subway or a tram in the process? Are they schedule reliable? If you miss one of those public transports, how long will you have to wait until the next?

2. Once inside, I was very happy to find out there was a nice sign pointing to where the Pearson VUE office was. Nice touch, Pearson VUE!
   
3. The actually office where the exam took place was down the corridor. I also took the opportunity to find out where the bathroom is. Remember you can take bathroom breaks; it might be wise to find its location so you do not waste valuable exam time hunting for it when you really need to go.
   

   Incidentally, there was a water fountain across the corridor from the bathroom.

4. During exam day, I had no problem getting there ahead of time. In fact, I was so ahead of time the suit was still locked. By then a few more candidates, for other exams it turned out, had showed up. We chatted a bit until they let us in. And it was smooth sailing until the exam started.

TL;DR: Make your life easier! Eliminate as many variables before the exam as you can.