Community on Be The Adversary

How can we let the business feel like an adversary?

Mon, 31 Oct 2022 00:00:00 +0000

Background#

Recently, we had a “Cyber Roadshow” at the organization I work for. Our Cyber RoadShow is an internal event where various security teams get the chance to present and educate other employees from multiple teams about various cybersecurity topics - sharing knowledge about trends, projects, tools, methodology, and more. We even bring industry leaders and business partners to share their views and ideas about other cybersecurity-related topics.

100 days into a career in cyber: first steps into the industry

Tue, 16 Aug 2022 00:00:00 +0000

In the last few months, Gadi Evron, wrote (with other professionals like Ophir Harpaz and Ohad Zaidenberg a paper to help women enter the world of cyber security. Gadi is a very senior and experienced in the field of cyber security and fulfilled multiple roles in it, and he is also a very good friend of mine.

This paper is meant to provide information about various roles and positions in the industry. But, at the same time, it also demolishes some myths like specific scores required in your degree or service in any specific military unit.

Welcome to my blog

Wed, 23 Oct 2019 00:00:00 +0000

For some time now I’ve played around with the idea of setting this up so I would have a place to place some of my thoughts, ideas and maybe tips.

I’m still not sure exactly what stuff I will post, but I know that they we be around information security, red teaming and the like.

For now, feel free to check out the favorites section for links for some of my favorite content creators.

Favorites

Mon, 01 Jan 0001 00:00:00 +0000

Things I like and recommend. No affiliations, no kickbacks, nothing sponsored.

Dead entries stay on the list, struck through, with a note on what happened. A lot of this thinking came from them.

Blogs#

~~Red Team Journal~~ (site offline, returns 404). The closest thing the field had to a journal of record on red teaming as an idea. Most of what I argue about definitions traces back here.
~~Red Team Journal-Plus~~ (domain no longer resolves). The paid companion, gone with it.
~~Redteams.net~~ (domain lapsed and was re-registered by someone else, deliberately not linked). Was a genuinely good red teaming blog and podcast. The domain belongs to someone else now, so treat anything on it as unrelated.
Adversarial Mindset (still up, last post 2022). Treats adversarial thinking as a habit you build, not a toolkit you buy.
Modern Adversary. Offensive tradecraft written by someone who does the work, without the vendor voice.
0xmoose
Embrace The Red. Attacks and red team strategy, and some of the sharpest AI-attack work happening right now.

Podcasts#

~~Redteams.net~~ (same lapsed domain as above, deliberately not linked). The Red Team Podcast. Worth digging out of an archive if you can find it.
~~Adversarial Conversations~~ (offline, last episode 2019). Only ever two episodes, but the premise was right.
Darknet Diaries. The storytelling standard for this industry. Hand it to anyone who asks what you do for a living.
Malicious Life. The history of the field, told properly. Context you don’t get from a threat report.

Books#

Red Team by Micah Zenko. The case for institutional devil’s advocacy across the military, intelligence and business. The book that names what I keep arguing about.
Left of Bang. How to read a baseline and catch the anomaly before anything happens. Makes “trust your gut” into something teachable.
Ender’s Game. Thinking from the opponent’s side, long before it was a job title.
The Applied Critical Thinking Handbook. The Army’s own red teaming manual. Free, practical, and full of techniques that survive contact with a meeting room.
Red Teams and Counterterrorism Training. The academic treatment, and useful for exactly that reason.
Surveillance Zone by Ami Toben. What corporate surveillance and surveillance detection actually look like day to day, from someone doing it.
Rinsed by Geoff White. Where the money goes after the breach. The part of cybercrime most security people never follow all the way through.
Never Split the Difference by Chris Voss. Negotiation as applied empathy. Half of security work is convincing people, and this is the best book on that.
Warbreaker by Brandon Sanderson. Not security at all. Sanderson gives it away from his own site, which is its own kind of statement.

Equipment#

Sparrows Lock Picks. Where most people should start, and where a lot of us still buy.
Serepick. The serious end of the same shelf.
Goruck. Gear built to be abused. Mine has been.
Never Fucking Quit. Does what it says.
Zero Foxtrot. Apparel from people who have clearly been there.
Cerberus Strength. Strongman equipment. Nothing to do with security, everything to do with staying sane.