Last Updated on Sunday, 25 July 2010 18:07 Written by Brian Baskin Tuesday, 29 June 2010 01:31

Last Updated on Monday, 21 June 2010 23:07 Written by Brian Baskin Friday, 18 June 2010 01:32

There's very rarely a large-scale news event that takes my two primary jobs: information security and teaching, and touts them in front of the public. So, here's a bit of the inner workings of my mind for my day job, and how amateur marketing-driven training casts a large shadow for the entire industry.

In recent weeks that has been an ongoing discussion over the marketing tactics used by a small information security firm, LIGATT Security.  More truthful details on their company can be found elsewhere, such as attrition.org and Catch 22. My focus is instead on the initial project that caused a huge surge of discussion over LIGATT: Their Learn to Hack in 15 Minutes campaign. And while this will focus on the efforts by LIGATT, it is also a note about many forms of training being given by novices.

When I saw notice of the campaign I physically cringed. I knew it was going to fail and be mocked. And, it did.

This form of training takes the form of abbreviated tweets on Twitter from the @LIGATT profile.  Examples include:

"Lesson 2: Footprinting: The next step of the information gathering process is to try to identify the range of IP addresses the target uses. Tue May 18 2010 09:18:45 (Eastern Daylight Time) via web" 

"Lesson 2: Footprinting: Nslookup is a program to query domain name servers. This information can be used to diagnose the DNS infrastructure. Mon May 17 2010 09:43:16 (Eastern Daylight Time) via web"

"Lesson 3: Scanning: The goal of the scanning phase of pretest reconnaissance is to discover open ports and find vulnerable applications. Wed May 19 2010 11:13:30 (Eastern Daylight Time) via web" 

"Lesson 4:Hacking Techniques:A pentest is more about taking the view of a hacker by seeing what can be accomplished and with what difficulty. Wed Jun 16 2010 17:25:49 (Eastern Daylight Time) via web" 

"Lesson 4:Hacking Techniques:Cross Site scripting is created by failure of Web-based app to validate user input before returning to client. about 5 hours ago via web"

There are a number of issues with this style of training, too many to list here. The ultimate result is that you receive training that is not training at all: it's just a series of one-off nuggets with no cohesion and no actionable intelligence.

And it's just the latest example in the cyber training rage that everyone seems to be undertaking. Over the last 10 years, I've seen many large corporations start up their own training divisions that focus around the products and services that they provide. And they all take the same, simple approach.  "Let's write up all this information and sell it to others. And every time we update the project, they have to be trained all over again! We'll be rich!"  The result, though, is expensive, substandard training that does not educate.

Proper education takes effort, and it takes time.  To understand this, let's talk about formal education in the cyber security industry... my favorite topic :)  For over 10 years I've worked professionally as a cyber security researcher and technical training professional teaching cyber crime and information security content. I've developed college-accredited courses on incident response, Linux intrusion analysis, undercover Internet investigations, and large-scale intrusion investigations. I'm even a Certified Technical Trainer (CTT+) :)  

What's wrong with this approach?

To sum it up, everything. This type of training takes a large volume of content, whittles it down to a small (140 char) paragraph, and sends it to a largely unknown audience. There has been no assessment to the type of audience it is intended for. There's no regular reviews of the material. There's nothing actionable in the tweets themselves. It's like learning from hacker flashcards: good if you need to memorize data quickly for a short period of time, but useless for long term cranial storage. 

Doing it right 

So, let's go through a scenario where I would develop similar training. How can security training be done properly to provide the best education for the students while remaining quick, efficient, and inexpensive.  Truth be told, I've done this. Along with Johny Long and Marcus J Carey, we developed a two-day "Hacking Stuff" course that provided hands-on, realistic intrusion training to beginners.

I develop training based upon the ISD (Instructional Systems Design) ADDIE approach. ADDIE breaks down the process into five stages: Analysis, Design, Development, Implementation, and Evaluation.

1. Analysis

Interviews, surveys, meetings, discussions: these all have to occur before anything is written. Who is the target audience? What is their background? Are they security laymen just entering the industry? Are they corporate leadership with no technical skills but large budgets? Are they consumers that purchase products that need to be secured?

What is the delivery platform? What are the strengths (immediate, free, vast audience) and weaknesses (140 char tweets) of it.

If you screw up this step, the course will fail.

Evidence that this stage was lacking in the LIGATT training was evidenced by one of their early tweets:

"How to be Hacker. For some of you who are experts at hacking, the beginning my be slow for some of you & to fast for others. Wed May 12 2010 22:47:21 (Eastern Daylight Time) via web"

A "one size fits all" approach to training does not work, at all, for anyone. If you shoot too high or too low, you'll lose your audience. They'll either be lost by the large amounts of technical information, or they'll be offended at how basic the material is. You need to pick your desired audience, market solely to them, then aim just slightly over their heads. Close enough that they understand the basic concepts and terminology, but just a bit out of reach so they have to exercise their synapses to connect the dots.

2. Design

In the design stage you take the information learned from Analysis and start setting up your boundaries. What are you high-level and low-level objectives that students need to learn?  High-level objectives would be based upon the stages of an attack, such as: Reconnaissance, Intrusion, Advancement, Entrenchment, Exfiltration.

These would then be broken down into low-level objectives. Reconnaissance would include Open Source Intelligence gathering (OSINT), vitality scans, and port scans, for example. Some of these can then be broken down into further objectives. OSINT would include Google Hacking, Maltego, social network scanning, etc.

All objectives are laid down into a logical order and structure (think "Table of Contents") and reviewed to ensure it is a natural progression of knowledge. Objectives should build upon each other.

3. Development

The development stage is the heavy one - all of the material is developed here. The material is all originally developed (key phrase there). Any material that is to be cited is flagged with its original source so that releases can be obtained later. Enough said.

Scenarios have to be drafted up. Fictitious business names, locations, email addresses, and accounts have to be created. Virtual servers are setup to simulate a real working environment. Custom outfitted systems for students to hack from and virtual servers to act as targets. WebGoat is a cool idea, but is an amateur cop-out for professional training. The environment should mirror your students' own environments as close as possible. A triple-boot Mac Book Pro helps :)

4. Implementation

Take the material and deliver it. The concern here is is pacing and responsiveness. If a question is asked (even over Twitter), answers should be publicly provided for all to see. This is where you see, first hand, if you performed your analysis correctly. Are people getting it? Are they getting it too quickly? Are they asking really good questions on topics that you didn't think about?

5. Evaluation 

And, the most crucial phase of all: evaluating your training. Surveys, verbal feedback, written feedback, and test scores paint a picture of the training provided. This allows for developers and instructors to improve upon their training. Was the length of training too long?  Too short?  Too complex?  Too simple?  Was the instruction professional or amateurish?  One problem I saw with LIGATT's Twitter training was that legitimate questions were being asked in response to tweets, but were left unanswered. Very bad form, indeed.

But, that's not all...

The five stages of ADDIE lay out the process by which training is developed, and it provides for a solid foundation upon which a quality course can be built. But, it requires a bit more effort to get the content just right. In the Design phase we identified all of the objectives that are covered in the training. There's an additional step here: what is the take-away from each objective. This is referred to as a Knowledge Level, of which there are generally five*: (* some groups break it down into six, or seven for greater granularity)

1. Recognize - If you see a term show up later in life, you can recognize it and vaguely remember what it is. Flash cards. "Nmap, oh that's a security tool for hacking."

2. Recall - Upon recognizing a term, you can recall what the term is used for and the basics on how it works. "Nmap can port scan other computers across a network."

3. Comprehend - You can detail exactly WHY the objective is important. "To assess a target, I need to see if it has open ports and running services. Nmap is one of the few tools that can do this automatically. I could also use Nessus, but Nmap lets me ..."

4. Application - You know how to use the tool to perform a function. "I need to quickly assess a server, so I need to type `nmap -P0 -sV 10.5.7.2`".

5. Synthesis - You understand the objective and how it ties into everything around it, knowing when to best use it and when not to. "I need to assess this server but they have aggressive packet monitoring. However, their logs roll over every 8 hours. I need to slow down the Nmap scan to 9 hours between packets and netcat the results back to another machine for review."

If you would design a basic hacking course, you would end up with hundreds of objectives, each with it's own knowledge level. For keystone objectives, like an Nmap scan, or Metasploit attack, you would focus at the K4 level, at the least. For Metasploit, a K5 is virtually required as it requires an additional level of thought to understand the various exploits and payloads.

For less-used objectives, like using snmpwalk to assess SNMP servers, you would focus at the K3 or K2 level.  And items requiring rote memorization, like port number assignments, would just be K1s.

K1s have their place, such as when memorizing a large set of data before a certification exam. Sales, Marketing, and Management staff generally work in the K1-K3 range. Your first level tech support works at K4, and the gurus work at the K5 level. Generally, if you are taking training to perform a critical job function, it should be predominantly taught at the K4-K5 level.

Wow! 

When all is said and done, you'll likely have months invested in properly creating a week-long training course. And people will scoff. Management scoffs. That's too much time! That's too expensive to develop! Is it, really?  You build a strong, solid course that requires no oversight, is easy for instructors to pick up, has no ramp-up time for train the trainer, and requires bare minimum maintenance between iterations. Compare that to typical rushed courses that have major rewrites in between each iteration, and basically starts from scratch if the instructor quits and needs to be replaced.

Training is not just something you throw together. You don't just throw together a Power Point presentation to give a 16-hour course and call it done. 

And so how is the LIGATT 15 Minute Hacker course failing? Because it is purely written and delivered at the K1 (Recognize) level. Vague attempts are made to give more in-depth details, but they completely lack context. There is no hands-on experience, no practical exercises, no testing, and no review process. It's the equivalent of yelling random sentences from a book to an audience in Times Square and calling it training.

LIGATT's How to Be a Hacker in 15 Minutes will not train you to be a hacker. Ever. You do not learn how to hack. You just learn basic terminology and phrases. At best, it will train you to be a script kiddie. 

Then again, if you just want to throw together a quick, free, plagiarized training session just to try and drive your stock prices up... it may work out for you. Good luck with that. 

Last Updated on Wednesday, 03 February 2010 02:47 Written by Brian Baskin Wednesday, 03 February 2010 00:40

It is 2 February and 2010 is already shaping up pretty well. I have a feeling that this year will be one of many opportunities. I should probably give a recap of 2009, as it will quickly fade from memory (and because I'm practicing for my annual performance appraisal).

Last January at the 2009 DoD Cyber Crime Conference we taught our last Hacking Stuff course, as Johnny had just left CSC and was preparing to move on to his life mission in Uganda. It was a great course and one I was compelled to step it up a bit. A few too many "as soon as I press enter I will be committing a felony... now let's take a break!"

I was able to attend the TechnoSecurity Conference in Myrtle Beach and hopefully justified the expense with a 15 page back-brief.  Helps when you can speed type and basically transcribe entire sessions from the back.  Though, can I admit that I grew to be very ticked off by the last day by some of the attitudes of the speakers and panel experts? Wore my Hackers for Charity shirt for the week, and heard great mention of Johnny's work, but none of his charity... and one person talking behind me about how I'm just a poser wearing a hacker shirt :)  HfC is an awesome organization. Johnny is doing great work, and with the help of dozens of volunteers and sponsors there is real traction being made. I just wish people would focus on 'good will' instead of the name dropping.

That was also the time that I started to become more impressed with the members of Twitter, a service I basically ignored for the longest time.  So, I dove in head-first... and only partially regret the decision ;) I've met some great people along the way. After hearing CharmSec being announced at every single DojoSec I finally decided to show up, and loved it.

The summer saw my employer, CSC, facing a recompete on our existing contract with the Department of Defense Cyber Investigations Training Academy, a contract we've held since before its inception in the late 90's, and my work-home since 2000. I drew the short straw and became the technical volume lead. Not that that held much sway, as it was a large group effort with our brightest minds locked into a windowless secure facility for 12 hours a day, 7 days a week, for 6 weeks. Then the anxiety of the government issuing postponements, one after another, until we graciously received the award. The new contract also placed me into a double duty position. While holding my position as the Deputy Lead Technical Engineer, I was also to become the Distance Education Webmaster.  While maintaining our technical edge for in-house courses I would also be developing our web-based training infrastructure and given a team to do so. My first official, full time duty as a manager and a great team of two bright guys that literally drive me nuts: Timothy Dye and Gregg Presbury :)

With the new job comes new ... skill requirements. Adobe Premiere and Photoshop, Camtasia, and a few that I don't want our competition to know about ;)  We setup a film studio with a chromakey green screen, white muslin, nearly 2000watts of lighting, and HD cameras. We established a new Portal environment for students and alumni at our Academy where we post news, articles, whitepapers, recorded brown bags, and conference talks.

During this time, Marcus Carey and I were talking on the phone and he mentioned how he needed to get someone lined up for a DojoSec in October. I had an idea I've been tossing around for awhile, based on my experiences with some severely hard-line black&whiter's in the career: Casual Cyber Crime. Basically why innocent people commit cyber crimes on a regular basis for completely innocent and benign reasons. As an avid hardware hacker, I've run across a few people out there that think that I should be locked up for jailbreaking my iPhone and gaming consoles. It was a response to them. I spent a week throwing the talk together and delivered it at DojoSec and went long, as usual. I was then invited to give the same talk at TechnoForensics later in the month, which went pretty well (and I only went 5 mins over :))

Then there was Dissecting the Hack: The F0rb1dd3n Network. Well, that's a long story. I volunteered to do technical editing on the new technical reference for the book. That is still under way with a finale coming very, very, very soon. But, that's not a story for me to tell. That duty falls on Jayson Street.

I have just returned from the 2010 DoD Cyber Crime Conference where I was able to assist my friend "Ranta, Don (pg 151)" the RegEx Guru with a custom two-day course on Command Line Log Analysis and Graphical Reporting.  Later in the week I also gave another briefing of my two-hour BitTorrent Analysis talk. I've given this talk for three years now and am fully waiting for interest to die off, but it hasn't.  It's grown.  Now I feel like a one-trick pony :) There were a lot of great training given this year at DoD Cyber Crime and I am honored to work with many bright and passionate individuals in the Information Security industry.

I'm preparing to attend ShmooCon for the first time. I've been trying for four years to attend and it just never worked out. ShmooCon runs right along the same schedule as DoD Cyber Crime so they were usually in competition or too close together. Then years where I just couldn't get a ticket :) I will also be attending DEFCON for the first time, after nearly 15 years of trying to attend.  That's what I get for getting married young :)  Too much guilt about leaving for Vegas for a weekend and blowing money on a social event. I've finally gotten over that and have my wife's insistence that I need to go after all these years. And I'm willing to put up with expected "Oh, you're a n00b since you've never been" comments from aspiring script kiddies that work as grocery store check-out clerks.

2010 should be a very busy year. Between learning all of the videography, pushing our DoD Portal site, expanding our infrastructure, and pushing more course work that will benefit thousands outside of the DoD as we are finally allowed to launch into the realm of the Defense Industrial Base.  I'm looking forward to the challenge!

Last Updated on Friday, 18 December 2009 04:50 Written by Administrator Monday, 16 November 2009 14:09

There's often times in our lives where we spend extended time reflecting on our choices and decisions.  I had the opportunity to do just that recently, and wanted to jot some of my thoughts down. What I concluded was: even if you take the road more traveled, you can still find appreciation in the work you've completed. And, most of all, the Information Security field may be the best field to make your own job and write your own rules.

What got my head churning was remembering a recruitment message, sent to me over IRC in the late 90s, to join a very well known security company that did exploit research. It was a solid job offer and everything checked out. However, here I was, 18 and just graduating high school. The company was in Atlanta, GA, 800 miles away. The pay seemed great for someone just out of school. At the time, I was a member of a number of scene groups, had dabbled in software cracking, bots, and malware. But, the fear of possible legal trouble really turned me off from the scene. And so, I turned it down. As I did with a number of other offers that came down the road.

I loved the security world, and shared the secret joy when SATAN (later SAINT) was released, along with the other toys of the trade. But, there was no InfoSec community during this time. Hackers were evil people that were pillaging the elderly. And I wanted to do good things. The concept of white-hats was unknown at this time. And, yet, at one point I visited at 2600 gathering in Philly and was pretty depressed by the people who considered themselves to be 31337 hackers. And there was the crux. Your career options in the field at that time were extremely limited at the time. You were red or blue. I wanted to do the work, but I didn't want to be a "hacker". I turned down the job offer and not long after retired from the scene. I hung it all up and started my life as a basic network admin.

However, I eventually found myself in a position teaching digital forensics to federal/military law enforcement. I guess it could be called fate. Mentally, I started from scratch, and tried to bring a n00b perspective to the field. That changed when I had the chance ability to work alongside Johnny Long. He instilled in me that I shouldn't be afraid of my background, and should exploit it for good.  At the time, we were teaching network intrusion responses, with a 100% focus on forensics. With help from other passionate instructors, we started integrating a bit of hacking into the course.  We showed buffer overflows on vulnerable Solaris machines.  We let the students telnet in and do it themselves, then look for the forensic traces of the actions. But, it wasn't enough.

Johnny had the great idea of developing a two-day hacking class for the 2006 DoD Cyber Crime Conference. We designed the curriculum to be fairly high-level, yet modular to experience. We broke the class up four groups based upon their experience level, then started showing them scans and exploits. The advanced group in the back literally fried a 3com hub, and everyone loved it. We brought back the class each year thereafter, and there was a continual waiting list of people wanting to attend.

After a few successful runs, and numerous positive feedback from the conference, we broached the idea of a full, official hacking course to be taught to military investigators... and we got the green light. Thus was born the Network Exploitation Techniques (NET) course, for which I was happy to help design and develop. Early this year Johnny went to follow his passion and become committed to his charity work. We all decided to retire the 'Hacking Stuff' class that had been an annual staple.

Ultimately, there was a hidden lesson in the whole mix. I've taught hundreds of security individuals from all walks of life and from many corporations and government entities. And as every year went by, I noticed a greater range in the job titles and descriptions being used. And I had the chance to sit and talk to people at conferences and meetings, I found a lot of people with the same story as myself. They wanted in, but didn't want the label of 'hacker'. Through sheer determination and logical thinking, they were able to create their own jobs.  Having been through that, there is no better feeling that your boss sitting you down and saying "We need an XYZ and you're it. Write up a job description for yourself and give it to me by COB Friday." 

I wonder sometimes where things may have changed had I taken a different road in life, and then I realized that it didn't matter. If you have a passion and drive for what you do, it will all come full-circle. You will eventually find yourself happy in your work and life. If you have a passion for security, you will subconsciously find yourself implementing security into your current work. The same trials you face today will happen in other life streams, just in different weather and locations. So, find what it is that you enjoy and just do it.  And while it's been 10 years since I've sat down with a dissassembler (except for a few, simple small projects for fun), I know that there will be another day ahead of me where I will take up my old passions and put them to use again.