• OSINT and Open Sources
• Pivoting
• Clustering, Naming, and Creating Groups
• Attribution

Let’s dive right in!

OSINT and Open Sources

Open source intelligence (OSINT) is a separate but complementary field to CTI. As you learned in part 1, intelligence is analyzed information to support a decision, so it’s important to remember that definition still applies. I think of OSINT as being intelligence produced using open sources, though it’s commonly used to refer to open source data or information. It’s particularly important to critically evaluate open sources before using them to produce intelligence.

Read and watch

• Read selections from this Army publication on OSINT: https://irp.fas.org/doddir/army/atp2-22-9.pdf —you can skim the whole thing, but I recommend reading just pages 21–23 (starting at Open-Source Reliability heading), page 41 (Information Reliability and Credibility heading), and page 43 (section 4–13) (hat tip to Casey Brooks for this reference)
• Read Sergio Caltagirone’s blog post about how to differentiate reports from vendors as threat intelligence or marketing using the ADEPT model.
• Skim this DNI page, focusing on the OSINT definition and the other 5 “INTs”.
• Watch this presentation from Sherman Chu on Current Intelligence.
• Skim this page that lists many available open sources: https://github.com/hslatman/awesome-threat-intelligence. Think about the major categories of sources and where you think this data comes from.

Things to do

• If you haven’t already, create a Twitter account and follow some CTI people (if you follow me @likethecoins, Twitter will automagically start recommending other accounts to follow). I also recommend creating your own RSS feed as recommended in part 1, but if you don’t want to, here is a starter RSS feed (downloads an .OPML file hosted on my Google Drive) that you can import into any RSS feed tool of your choice. (Feedly is a good starting point!) Please note this is a recommended starting point, and I’m certain I forgot some excellent blogs, so I appreciate your understanding if yours isn’t included.
• Find a blog post or report from a cybersecurity vendor via your Twitter or RSS feed. Apply Sergio’s ADEPT model and make your own assessment on whether it falls more under intelligence and marketing.

• Find a different blog post or report and evaluate its reliability and credibility based on section 4–13 of the Army PDF above — Identity, Authority, Motive, Access, Timeliness, Internal and External Consistency (note that you will likely apply the Internal and External Consistency criteria differently than the Army publication. Think of internal consistency as whether the piece contradicts itself. Think of external consistency as whether the piece has contradictory information to other external sources.).
• Find a Twitter account and apply the same criteria above to an account and tweet. Here’s an example for the following tweet: https://twitter.com/malware_traffic/status/1554552456100593665

Identity: With a little searching, I can determine this account is owned by Brad Duncan, who is a researcher at Palo Alto’s Unit 42.

Authority: I have read blog posts from Unit 42 in the past that have been well written, so that makes me more likely to trust this account if I’ve never seen it before. I look through Brad’s previous tweets and see he has a long history of tweeting about various malware and threat actors. He has over 65K followers, which is a lot, but that’s not the only point I’m using to evaluate his authority.

Motive: I see Brad has a whole website full of packet capture and malware samples: https://www.malware-traffic-analysis.net/. Combined with all his previous tweets and his replies to other researchers, I assess he is someone who shares information because he wants to help others track threats. I should remember he also works for Unit 42, but the fact his website is separate suggests he isn’t motivated by marketing for his employer.

Access: The fact that Brad showed screenshots of the packet capture suggests he did have direct access on this network traffic.

Timeliness: This is very timeline, he tweeted this information the same day the traffic occurred.

Internal and external consistency: Brad spelled everything correctly in his tweet and diagrams, and nothing in the information contradicts itself. Additionally, Brad cited another researcher, @drb_ra, who reported the same findings.

Questions to think about

• Based on the DNI webpage, how does the U.S. government think about OSINT? How does that differ from how the private sector should think about and practice OSINT?
• What are the risks and drawbacks of using open sources in cyber threat intelligence analysis? How can you mitigate those in order to use open sources in an appropriate way?
• Who produces what is available in different open sources (for example, the sources listed in Awesome Threat Intelligence)? What limitations does that result in?
• What CTI requirements (see part 1 for more on requirements) do you think can be fulfilled with open sources? How do you think open sources can be best used to produce CTI?

Pivoting

I define pivoting as the act of identifying a new piece of information based on a connection to a previously-known piece of information. CTI analysts apply pivoting in many ways, such as looking for connections between domain names and IP addresses that have hosted them. Sometimes, these connections can reveal new relationships between groups or malware that analysts weren’t previously aware of. Pivoting can be challenging to learn because it requires both an understanding of the data source an analyst wants to pivot through as well as methodology for doing so. I’ve included resources that provide explanations for common data sources used for pivoting, but note that you may need to do more research to deeply understand these sources.

Read and watch

• Watch a short clip of a CTI presentation I did (18:37–21:02).
• Read Joe Slowik’s blog post on “Analyzing Network Infrastructure as Composite Objects”, which presents three pivotable artifact types: domain names, IP addresses, and TLS certificates.
• Read Kelsey LaBelle’s blog post series on DNS, WhoIs, and passive DNS, which are all commonly-used sources for pivoting.
• Watch Mark Parsons’ presentation on TLS certificates and/or read his blog.
• Read Joe Slowik’s paper on “Formulating a Robust Pivoting Methodology” and/or watch his presentation on “Pivoting from Art to Science.”

Things to do

• Try a TLS certificate pivot by…
  1. Identifying the default SHA256 hash value shipped on Cobalt Strike servers (see here),
  2. Searching for that hash value in Censys (https://search.censys.io/), and
  3. Identifying IP addresses that result. What do those IP addresses potentially represent? What could you do to try to validate if that pivot you performed was meaningful? Go do it!
• Find a recent blog post on a threat group or malware family that contains some pivotable artifact (look at the RSS feed you hopefully set up based on Part 1 of this plan). Try searching for those artifacts in free search sources and see if you can reproduce the research from the blog post about any pivots and/or find any new artifacts from pivoting. IMPORTANT: When doing any research like this, consider using a virtual machine to ensure you do not accidentally click on a malicious link and infect your machine.

Here are some free search sources you might find useful for this: Censys (https://search.censys.io/), Shodan (https://www.shodan.io/), DomainTools WhoIs (https://whois.domaintools.com/), VirusTotal (https://www.virustotal.com/), URLhaus (https://urlhaus.abuse.ch/), and Malware Domain List (https://www.malwaredomainlist.com/). There are many others listed on Awesome Threat Intelligence that you can try as well.

If you need an example to get you started, try looking up hash values and IPs from this ESET blog post in VirusTotal.

Questions to think about

• What types of artifacts and data sources can we use for pivoting? What artifacts do you see most analysts use? What are the pros and cons of each type of artifact/data source? Can you think of data sources that could be useful for pivoting that weren’t mentioned in the above resources?
• How do we know if pivots are meaningful or not? What level of specificity or uniqueness makes for a meaningful pivot?
• What is the point of pivoting? What do analysts gain from it?
• What are potential consequences of making analytic conclusions based solely on pivots?
• What happens as you continue pivoting off of newly-found information? How does each “hop” from your initial data point affect the relationship of the newly-found information? What are the risks and limitations of pivoting? (Hint: see below. Also see the Attribution section and Sarah Jones’ presentation on attribution mistakes.)

Clustering, Creating, and Naming Groups

There are many ways to create clusters and threat groups, and this leads to confusion in the community as well as a lot of different names. While this can be frustrating for many analysts, hopefully you can reduce this frustration by gaining a better understanding of how CTI analysts create and name these groups.

Read and watch

• Watch part of this webinar I did that discusses group naming with the Diamond Model using the Rule of 2. (watch from 37:12–41:43)
• Watch this webinar I did on a deep-dive into group naming.
• Read Florian Roth’s blog post on group names.
• Read these blog posts on how various teams name groups: Mandiant (and here), Microsoft (first paragraph here and take a look at the nation state group names on page 51 here), and Unit 42.
• Watch this webinar from Van Ta and Aaron Stephens of Mandiant on UNC1878 and Spooky RYUK-y. Then read this FIN12 report (UNC1878 “graduated” to become FIN12.)
• Read this blog on UNC2452 and APT29.

Things to do

• Choose a group from the MITRE ATT&CK groups page that has multiple associated names. Read the reference(s) for that associated name overlapping with the “main” group page name. Note what details, if any, explain the reason for the overlap.
• Using the methodology of your choice (a spreadsheet might be a good option), organize data points from the following information on various IcedID campaigns: 3 August 2022, 8 August 2022, 10 August 2022, and 18 August 2022. Considering using the Diamond Model and Rule of 2 to do this (see above link for background). Based on the data you have, decide if you think you should create a group (since IcedID is malware, you could create a group for the delivery of it). If you create a group, create a definition for that group — in other words, if you saw a new IcedID intrusion, what criteria would it need to meet in order to be part of the new group you created? Think about what challenges you had in doing this and what criteria is “close enough” to create a group or not.
• Search Twitter to find a recent debate about group names in which analysts disagree (this is a debate that comes up a lot in the CTI community). Think about each party’s perspective and note reasons why they likely hold that view, even if you don’t agree. (Hint: search Twitter for APT31, APT10, or TA410.)

Questions to think about

• Do you think Rosetta Stones are useful? (A Rosetta Stone is a resource that “translates” different group names, for example, this spreadsheet.) What are the limitations of Rosetta Stones for tracking group names?
• Do you think the CTI community can agree on a consistent names and definition for groups? Why or why not? How could this happen if analysts wanted to try?
• What are the risks of using a group name that another team created? (Here’s an example.) Do you think that risk is worth it to not add another group name (and potentially more confusion)?
• What are some common attributes/observables/data points that analysts use when identifying overlaps to create groups? (The Spooky RYUK-y webinar is a great place to look for this.) Which of these attributes do you think are most and least useful for identifying meaningful overlaps? (for example, if you saw PowerShell used in two different incidents, would you create a group based solely on that technique use?)
• What do you like and not like about methodologies used by different teams to cluster? What are the benefits and drawbacks of using an uncategorized clustering methodology for initial analysis? (e.g. UNC > APT or FIN)

Attribution

Attribution is a popular topic in CTI. While it is the primary focus for some analysts, it may not be for others. It’s important to understand some of the nuances of attribution and how it’s done, as well as how it can be useful (and when it might not be). Attribution is a topic that intersects cybersecurity and international relations, as an attribution assessment can have a significant impact on the relationships between countries. There are many articles on attribution from academia, and I’ve just chosen a sampling below.

Read and watch

• Read this blog I wrote on types of attribution.
• Read this Twitter thread from Steve Miller on Detectrum.
• Read this Twitter thread from Robert M. Lee.
• Watch Sarah Jones’ presentation on “A Brief History of Attribution Mistakes.” Tying this back to an earlier section, think about the role pivoting played in these mistakes.
• Read this paper from Jason Healey that includes the ever-useful Spectrum of State Responsibility.
• Skim this article, “Attributing Cyber Attacks,” (PDF) from Thomas Rid and Ben Buchanan — if you’re short on time, just look at the detailed Q Model on page 31.
• Read this piece, “The Purposes of U.S. Government Public Cyber Attribution,” from Jon Bateman.

Things to do

• Choose an indictment from my Google Drive list. Look at the indictment itself (PDF format) and write down the key evidence/information used to associate activity to an individual or group.
• Examine the IcedID campaigns from the section on clustering. Write down what additional information you think you would need in order to try to attribute these campaigns to 1. A country, and 2. A person. You could use the information types from the indictment you analyzed above, or other sources you can think of.

Questions to think about

• How is attribution commonly thought about in the cybersecurity community? What could be different ways to look at or define attribution?
• Do you think attribution matters? Under what circumstances would certain types of attribution matter or not matter? What requirements would result in CTI analysts deciding to do different types of attribution?
• What are the differences between the public and private sectors in 1. The process of conducting attribution (available data sources), and 2. Requirements to conduct “true” attribution (to a country, military unit, or person)?
• What are the risks of performing attribution, especially attribution to a country, military unit, or person?
• What are some of the challenges of performing attribution?

That’s all I have for now! I make no promises on Part 3, but the more I hear that this helps people, the more likely it is that will happen. :)

A Cyber Threat Intelligence Self-Study Plan: Part 2 was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

When I was asked to join the Ransomware Task Force (RTF), I was excited at the opportunity to come together with a bunch of smart people to see what we could come up with. Today, the RTF put out a comprehensive 81-page report providing a framework for combating ransomware, and I’m proud I had a part in it. I wanted to share some of my reflections on ransomware, the report, and what I think we need to do next.

The ransomware ecosystem

One of my key takeaways from being part of the RTF was how complex the ransomware ecosystem is and how each of us only have a narrow view of it. I frequently discuss this surrounding cyber threat intelligence—we need to share information with other teams because none of us see all the threats. This is true for the ransomware ecosystem too. As part of the task force, I heard from experts in cryptocurrency talk about the winding path ransom payments take. I also heard from experts in cyber insurance talk about the complexities of policies. They listened to me talk about all the “ransomware precursor” malware families and how defenders share information. I came to realize that we needed each other to broaden our view of the entire ecosystem.

Think about just some of the stakeholders involved in ransomware:

• Cyber insurance companies
• Lawyers
• Law enforcement (all the way from local to global)
• Cybersecurity vendors
• Cryptocurrency exchange operators
• Elected officials
• Infrastructure providers
• Intelligence agencies

Each of these stakeholders plays some role in combating ransomware. By taking the time to learn about these different perspectives — and educating others on our own perspective — we will build a better overall perspective of the ransomware ecosystem and how we can dismantle it.

We can’t do this alone

From talking to colleagues from different companies, sectors, and parts of the world, I came to an important realization. Ransomware is not a problem cybersecurity professionals can solve alone. Nor can policymakers. Nor can law enforcement. Nor can cyber insurance companies. Nor can creators of operating systems. It’s going to take all of us.

I’ve previously said things like “well, it’s on law enforcement to arrest the actors” or “it’s on operating system developers to make sure ransomware can’t spread.” What I’ve come to realize is that each of those individual actions will only affect part of this massive, global ransomware ecosystem. It’s unfair to put the ransomware problem on any one group, so I’m getting rid of that way of thinking in my mind. It’s going to take all of us working together to try to put a dent in this problem.

So you want to help?

We all have a role to play. If you want to help, I encourage you to read through the recommendations and think about what your role in helping to combat ransomware could be.

If you’re a defender, maybe you can help with goals 3 or 4, including actions like helping highlight available resources so organizations can better respond. If you’re involved in policymaking, maybe you can encourage those who make policies to implement some of these recommendations. For those based in the U.S., you could call up your elected officials and tell them that ransomware is a priority you care about (maybe you could even offer up your cybersecurity expertise if they need advice).

Another key action we can all think about is how we can improve sharing our perspective on the ransomware ecosystem. As I noted above, there are many different stakeholders, and they don’t all understand each other. If you’re a cybersecurity professional, how could you share your knowledge with a group like law enforcement or policymakers? Maybe you could take a simple step like reaching out to your local FBI field office or joining Infragard. For good reasons, various groups of stakeholders may not trust each other. Based on what I’ve seen, though, there are a lot of good people from many different groups (including law enforcement) who are willing to work together with cybersecurity researchers. Building up trust between these different stakeholders is a great place to start, because trust is the basis for information sharing to follow. The longer we distrust others who are trying to help, the longer the adversaries are going to keep winning.

Another area where we can all take action is having difficult discussions about improving and expanding the information we share surrounding ransomware. Many of the RTF recommendations focus on voluntary or mandatory information sharing, and that’s for a good reason — if we don’t know the details of what’s happening around ransomware, it’s tougher to stop it. For any victim, there’s some level of risk in sharing details about what happened. However, there are ways to share relevant details about adversaries while still protecting privacy. It’s not easy, and it can be risky, but I think having difficult conversations about what we share with whom is an important action.

Just the beginning

One criticism of reports like this are that they aren’t taking action. That’s true. This report isn’t the end, it’s only the beginning. It’s a call to action and ideas from experts who have experienced ransomware firsthand. The recommendations aren’t perfect, and I don’t necessarily agree with all of them, but this is a starting point.

Ransomware sucks. It’s not going to get better overnight. But I have to believe that by working together and taking action, we can make it suck less. There’s too much at stake for me to believe anything else.

My Reflections on Combating Ransomware was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

Here’s the good news: if you are committed, you can learn a lot of the same concepts that paid courses teach, but on your own. It won’t be the same, but you can still learn a ton if this learning style works for you. I wanted to share a self-study plan to help out anyone who wants to take the initiative to learn about CTI. There are lots of great resources out there, but I realize as you’re starting out that someone saying “go look at all the things!” isn’t that helpful because you’re not sure where to look. My goal is to bring together free resources I’d recommend studying and provide a minimal framework and question to help tackle them.

How to use this plan

Honestly, however it helps you! :) I wrote this with the idea that someone wanting to learn about CTI could work through it section-by-section, since some concepts build on each other. Be forewarned, if you do this entire thing, it’s going to take a lot of time and effort! I’ve included resources to read and watch, things to do, and questions to think about, as well as a few optional paid resources if you want more. (Please note that some of the links directly download a PDF.) Maybe you work through this in order, but maybe you just need to learn more on specific sections. I highly recommend taking notes as you go as a way to reinforce the material and hold yourself accountable for thinking through and answering the questions—the critical thinking is key to all of this. To be a good CTI analyst, you can’t just consume something, you have to think about what you think of it and how you can apply it. Consider how you want to organize your notes before you start (a notebook, a binder with dividers, Google Docs, OneNote, or whatever else works for you). If you’re new to this industry, I recommend finding someone to help you out as you have questions.

I’ll be breaking this plan up as I have time to write each section. I haven’t completely decided on topics for future sections, but here are a couple I plan to include: tools/TIPs, pivoting, open source research, evaluating reports, clustering, indicators/TTPs, threat modeling, assessments/uncertainty, and dissemination/writing.

Part 1 topics include:

• Intelligence
• Cyber Threat Intelligence
• Requirements
• The CTI Community
• Frameworks and Models

Intelligence

CTI represents the convergence of two communities: intelligence and cybersecurity. Good CTI analysts will understand fundamentals about intelligence and bring those principles to their work. Sometimes I’ve seen analysts struggle to bring together “traditional intelligence” and cybersecurity concepts, so I recommend doing this section first, and being relentless about considering how it applies to everything that follows.

Read and watch

• Read about the 9 principles of Sherman Kent’s analytic doctrine, starting with “1. Focus on Policymaker Concerns” on page 9 (you can skim the rest). Sherman Kent is a figure you should know about, and these principles of his analytic doctrine are core to what I think an intelligence analyst should be.
• Read Richards Heuer’s Psychology of Intelligence Analysis. This is a great intro to several important principles about how we think as intel analysts — including cognitive biases and structured analytic techniques.
• Read about the Intelligence Cycle.

Things to do

• Go research Sherman Kent and Richards Heuer — why were they considered important in this field (especially in Western intelligence)? Who are other figures that are important in intelligence, especially from a non-Western perspective? (go research and find at least one)
• Scroll around this cognitive biases site and go research cognitive biases to find a few that weren’t in Heuer’s book.
• Identify your own cognitive biases in everyday life. This is HARD, but you can do it if you’re honest with yourself. Tip: anything that makes you angry is a great place to look for biases. Write down your cognitive biases when you find them.

Questions to think about

• Why do intelligence analysts consider Sherman Kent’s analytic doctrine to be so important? What would happen in situations where analysts did not follow these principles? Think of examples for each principle. Can you think of situations you’ve seen — whether in intelligence or elsewhere — where people have not followed these principles? What happened?
• As you go through the rest of this self-study, when do you see analysts adhering to Kent’s analytic doctrine? When do you see them NOT adhering to it? What is the result?
• Why does the intelligence cycle exist? What makes intelligence different from raw data?

Optional paid resource

• If you’re looking to learn more about the US Intelligence Community, I recommend Mark Lowenthal’s “Intelligence: From Secrets to Policy”. Older editions are almost as good and are much cheaper. This is the book I was assigned in my intelligence class in grad school and it’s widely used in higher education.

Cyber Threat Intelligence

This section is meant to introduce you to some fundamental concepts in CTI and learn a little about its history.

Read and watch

• Watch this webinar I did.
• Read this paper from Sergio Caltagirone. Don’t get hung up on the ICS-specific terms (you can skim those parts if you want); think of them as examples of CTI…the point of you reading this isn’t to become an ICS expert, it’s to learn some fundamental principles of CTI.
• Watch Week 6 of Chris Sanders’ free Cuckoo’s Egg course. (At some point, I recommend working through the whole thing because it’s an amazing free resource from Chris, but for CTI, week 6 is key.) This course covers a lot of the topics below too.
• If you’re setting up a team/CTI program, watch this webinar I did with Jackie Abrams of DomainTools. You need a (free) SANS account to log in, then register so you can view the recording. I also recommend reading this INSA paper, especially if you’re setting up a team.
• Read a key report in CTI history: the Mandiant APT1 report from 2013.

Things to do

• Go find a few different definitions of CTI. How are the definitions different? Which one resonates most with you? What is the earliest date you can find the term “cyber threat intelligence” used?
• Research where the term “Advanced Persistent Threat” came from. Go research news around the APT1 report — why was that so important?
• Research and take a few notes on at least one major CTI event or intrusion you can find prior to 2013 (when the APT1 report came out). (If you need a place to get started check out this site.) What was noteworthy about the event/intrusion you chose? Can you find any similar events/intrusions (for example, involving similar actors or TTPs) that occurred after it?

Questions to think about

• What principles do you see from the intelligence section that you see also apply to CTI? How do you think CTI is the same or different from traditional intelligence?
• How long has CTI been around as a discipline? As you go through this curriculum, think about who you see as key people and organizations who have driven the development of CTI.
• How does the traditional intelligence cycle translate to CTI?

Optional paid resources

• If you’re looking for a good book on CTI, I highly recommend Rebekah Brown and Scott Roberts’ Intelligence-Driven Incident Response.
• If you’re looking for paid CTI courses, I recommend SANS FOR578 (full disclosure: I teach it!), Joe Slowik’s Operational Threat Intelligence course, or any of Sergio Caltagirone’s courses. Chris Sanders’ Investigation Theory course is more forensics-based, but the principles he teaches are key to those you should develop as a CTI analyst.

Requirements

These are so important that they get their own section, though some of this content is covered in the above CTI section.

Read and watch

• Read Scott Roberts’ blog post on requirements.
• Watch Andreas Sfakianakis’ 2020 CTI Summit presentation.
• Read Pasquale Stirparo’s blog post.

Things to do

• Choose a CTI team at an organization— you can imagine one or use a real one you know of (if you’re trying to get a CTI job at a company, choosing that org would be great for this exercise). Write down strategic, operational, and tactical intelligence requirements you think that they might have based on your research (or made-up information) about that company.

Questions to think about

• Why are requirements so important in CTI? What do you think would happen if a team did not have requirements?

The CTI Community

If you want to get involved in CTI, it’s important to get to know the community, including key people and stakeholders. Like anything in life, everyone has different perspectives, backgrounds, and motivations. You should get to know people in the community, while also realizing that we all have our own cognitive biases (see how this builds on earlier material?), so you should always think critically about the perspectives someone presents — and whether you agree or disagree (always doing so respectfully without resorting to ad hominem attacks).

Things to do

• Create a Twitter account (it doesn’t have to be in your real name) and go find people to find in CTI to follow. If you’re not sure who to follow, check out me (@likethecoins) and see who I re-tweet and interact with, or follow some people I mention in this post. From your Twitter research, figure out what hash tags the CTI community uses. Follow these hash tags — you might find it easier to use TweetDeck to do this.
• Create an RSS feed of some resources you see those Twitter accounts share. You could use Feedly’s free offerings to do this, or many other free RSS feed options. Building a good RSS feed is essential for many CTI roles, as it will allow you to stay up to date with new blog posts and reports. Remember that your RSS feed will grow and change over time based on new sources you find and your needs (requirements!!!), so don’t worry about getting it “perfect” to start.

Questions to think about

• What people and companies make up the “CTI community”? (For example, vendors are one group— what are others?) How does the “CTI community” overlap with other parts of the cybersecurity community like DFIR?
• What roles do CTI analysts and CTI companies play in the community? What are their backgrounds and what do they do? Do they have a specific angle or agenda? What role does media play in the CTI community?
• What are analysts discussing about CTI on Twitter? Who seems to represent what perspectives? What in their background might lead them to have those perspectives?
• What are key events and conferences that happen in the CTI community? Which are free and how much do they cost? What approach/angle do different events take?

Frameworks and Models

The “big three” frameworks and models I recommend you know about are the Cyber Kill Chain, the Diamond Model, and MITRE ATT&CK(R), though there are several others as well. It’s important for CTI analysts to understand what these are and how they can be applied, as well as what to be cautious of when applying them. Concepts from these frameworks and models will also be sprinkled throughout this self-study plan.

Read and watch

• Read Chris Sanders’ blog on mental models.
• Read the Lockheed Martin Cyber Kill Chain(R) paper.
• If you’re a Star Wars fan, read this ThreatConnect blog on applying Star Wars to the Diamond Model. (If you’re not a fan, you can obviously still read it, it just might not make as much sense to you!)
• Read the Diamond Model paper. It’s dense, but it’s awesome, so break it up into parts if you need to.
• Click around the VERIS website and skim various sections — maybe the “Quick Start” section or whatever section helps you learn what VERIS is and why you might use it.

Things to do

• Take the ATT&CK for CTI training I created with my former teammate Adam Pennington, designed to take about four hours. (Note that it’s based on a previous version of ATT&CK, but you’ll still get the key points.)
• Find at least one example of a team (perhaps a cybersecurity vendor) applying each of the frameworks or models you learned about above. Think about your opinion of the pros and cons of how they applied it.
• Go look for examples of combining two or more of these frameworks. (Hint: Palo Alto’s Unit 42 team has a good one, though there are others!)

Questions to think about

• Why do CTI analysts use frameworks and models? When would each of these frameworks or models be useful?
• What are the limitations of frameworks and models? What are the risks of using them?

The end

I hope you found this first part of the self-study plan useful! If you have requests for topics you’d like to see most, let me know and I can use that to help prioritize what I work on next.

A Cyber Threat Intelligence Self-Study Plan: Part 1 was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

How did you get started in CTI?

This is a good question and I understand why people ask it, but how I got started in CTI may not be the right way for someone else. I got into CTI somewhat unintentionally over a decade ago. In high school and college, I wanted to go into journalism. After I graduated college, I couldn’t get a job in journalism, so I took what I could get — an entry-level job as a researcher for a private investigative firm. During that time, I was fortunate enough to meet my now-husband, who had worked in government and the Intelligence Community. He suggested to me that because I liked to research, write, and analyze information, maybe I would like working as intelligence analyst. With his help and a lot of research and hard work, I applied to a bunch of government jobs, and sure enough, the Department of Defense called me in for an interview for a cyber intelligence position. At that point, I had zero experience in cyber or intelligence! But I carefully prepared for the interview anyway, and they gave me a chance and offered me the job. I actually hesitated before accepting the job — I remember telling my now-husband (in a very disgusted voice) “I don’t want to look at lines of code all day…” 😆 Once I got started, I found that I enjoyed the work because it focused on the human behind the keyboard, not just on the code itself. I was fortunate enough that I got lots of technical training early on. That training, combined with asking a ton of questions of supportive coworkers, was key in helping me learn.

One important part of my story that I want to emphasize for all you hiring managers out there: I had no cybersecurity experience. All I needed was a chance, and I ran with it once I had it. If you’re in a position to hire someone who is truly entry-level without experience, give them a shot — you never know what might happen.

How do I get into the field of CTI?

There are many ways to get CTI jobs and get started in this field, and there is no single “best” way. Here are a couple pathways I’ve seen from CTI professionals I respect and admire:

• Technology Reporter > CTI Analyst: My friend Selena Larson was a technology reporter at CNN, where she reported on privacy and security issues within the technology industry including ICS threats. Dragos was impressed with her work, so hired her as an intelligence analyst, where she has done amazing work. I believe a strong background in writing is a critical skill for CTI teams, and Selena is a great example of this.
• System Administrator > Detection Engineer > CTI Analyst: My teammate Tony Lambert started out as a system administrator at a college, where he learned how systems should and shouldn’t be configured in a very hands-on way. Tony worked hard and got involved with the cybersecurity community by learning more about DFIR. That work led him to be hired at Red Canary as a Detection Engineer. He was excellent at identifying adversaries and showed curiosity in pulling apart detections and figuring out details of what adversaries did, so he was a natural fit to be one of the founding members of the Red Canary Intelligence Team. (Here’s an awesome blog post he wrote on a new group he identified!) I’ve seen other analysts take a similar path to Tony’s by starting out as a Tier 1 Security Operations Center (SOC) analyst, a network administrator, or a similar entry-level position, and then shown an interest and curiosity in CTI. Depending on the type of organization, you might be able to move within your own organization if there is an existing CTI team.
• Military > Consultant, et al. > Threat Intel and Ops Lead > Director of Security Engineering: I first met Chris Cochran at the SANS CTI Summit almost two years ago, and I was so impressed with his background and how he carried himself. Chris started his cyber career in the US Marine Corps — many CTI analysts got started in the military, and this is a great pathway to CTI. From there, he worked in different roles, including as a Consultant at Mandiant and a Lead Associate at Booz Allen Hamilton, where he added to his threat intelligence experience. Chris worked his way up and became the Threat Intelligence at Operations Lead at Netflix before moving on this year to be the Director of Security Engineering at Marqeta. Chris is a great example of how hard work and constant self-improvement helps you move up to leadership roles. He also is active in the community (especially on LinkedIn!) and hosts a podcast called Hacker Valley Studio.

What degrees, training, or certifications do I need to work in CTI?

In my opinion? None. If you have the drive to learn CTI, you can teach yourself many of the fundamental concepts and skillsets. (Check out my previous blog post on some recommended reading.) But that’s tough to do, and let’s be honest, a lot of hiring managers might not buy that, so some kind of formal training or education might help you. Also, it’s important to acknowledge that for under-represented minorities in cybersecurity, especially BIPOC and women, having a degree or certification may help demonstrate your skills when people (sometimes unfairly) question your qualifications.

• Degrees: My undergraduate degree was in American Studies. Yes, you read that correctly — American Studies. I believe the type of degree you have, especially for undergrad, doesn’t matter all that much. Some excellent analysts I know have no degrees. If you do want a degree that will help you in CTI, though, computer science might provide a good foundation, as will cybersecurity programs. Degrees in intelligence studies might also be helpful. (I got my Master’s at Georgetown University’s Security Studies Program, for example.)
• Training Courses and Certifications: I teach SANS FOR578, so it’s natural that I recommend it as a training course along with the associated GCTI certification. This course is expensive, and I realize it’s most accessible to those who have employers who will pay for it. If you want to take a SANS course at lower cost, check out the Work Study program or CyberTalent programs. You can also check out a webcast I did with selected content from FOR578.
  However, SANS is not the only CTI training option! I firmly believe it benefits the community to have many CTI training choices. Some other great, lower-cost CTI training options include courses from Chris Sanders, Joe Slowik, and Sergio Caltagirone. Some of these courses provide certifications as well. There are other options out there like EC-Council’s Certified Threat Intelligence Analyst, but I’m not familiar with those so can’t recommend them either way.

What types of organizations hire CTI analysts?

I divide the CTI space into three major types of organizations, all of which have pros and cons that I’ll generalize about. As always, generalizations are inherently inaccurate, so there are exceptions to everything I’m discussing here. (Check out my previous post on choosing jobs for more on thinking through decisions on the type of organization you might want to work for.)

• Government, military, government contracting, and consulting: Yes, I realize there is a lot of diversity in this category, so take this with a grain of salt. 😃 This category includes federal/state/local governments, contractors like MITRE, ManTech, and Raytheon (where I’ve worked), and consulting organizations like Deloitte. Some positions in these organizations might require clearances, and these organizations are often large bureaucracies, which is both good because they are often more stable and bad because it’s sometimes slow to get things done. Some people find it rewarding to work in public service jobs like government because of the mission — I know when I worked for government, I felt a sense of pride in protecting my country’s security. When I got started in this field over a decade ago, many CTI analysts had a government/military background, but I’ve found that’s changed quite a bit and many CTI analysts start their careers in the private sector and stay there.
• Cybersecurity vendors: This category includes organizations that sell cybersecurity products or services, like Red Canary, FireEye, CrowdStrike, Proofpoint, and Digital Shadows, just to name a few. While I used to think vendors were just out to make money, with maturity, I’ve realized we are a fundamental part of the cybersecurity community and drive a lot of research — plus, we help customers, which makes me feel good. One benefit of vendors is that you can get visibility into many customer environments, which can be fun for CTI analysts to see different threat models. Depending on the type of vendor, though, you might be limited in the type of collection or data you look at — some vendors focus more on endpoints versus networks, or some focus on Dark Web collection. For vendors in particular, you should ask questions about their business practices and make sure you feel good about them,
• Private non-vendor corporations: This category includes organizations like banks, retailers, or technology companies. Large corporations can be a great place to get started in CTI because they tend to have large security teams (which often means they have a CTI team). These corporations can also be a good place to start as a Tier 1 SOC analyst or another entry-level position and grow into a CTI team. One consideration for working at a private corporation like this is that you often will have deep visibility into a single organization — you can see many types of systems and logs, but just for your organization.

What do CTI analysts do?

The field of CTI is surprisingly broad, and what a normal day looks like depends a lot on what the CTI team’s requirements are. Some analysts might focus at the strategic level where they read reports about what countries are doing and write assessments for their consumers. Other analysts might be more tactically-focused (like I am) and look at logs and detections every day. Here are a couple common tasks many CTI analysts do:

• Read open and closed source reports like blog posts, government reports, and social media posts.
• Analyze logs and artifacts to try to identify malicious activity or patterns, especially in intrusions.
• Pivot on strings, indicators, and artifacts in internal and external data sources to try to identify additional infrastructure or malware. Use Microsoft Excel, the best CTI tool of all time, to organize findings.
• Create signatures (like YARA signatures or behavioral analytics) and identify useful indicators of compromise to help defenders identify malicious activity.
• Share information with other analysts in the community about threat activity.
• Talk to consumers in their organizations about what they need and share information to help them better do their jobs.
• Present on their findings to their organization or other community members. (In other words — be PowerPoint ninjas!)
• Write reports to provide assessments or information to consumers.

How can I get a CTI job?

Apply to ALL THE JOBS!!!! There are lots of places to look for job listings, and a good place to start is to ask people in the industry about any open jobs or websites they like. When I first got out of college, I must have applied to over a hundred jobs. It’s not easy, but keep at it! Get a friend or colleague to help you with your resume, and take advantage of resume clinics that occur at security conferences. If you don’t have CTI experience, think about what aspects of experience you have could apply to CTI — for example, do you research security alerts or write reports? Do you have experience doing investigations, even though a field like journalism? Try to write about your experience in a way that emphasizes CTI skillsets. I like this breakdown of CTI traits skillsets from Carnegie Mellon University’s Software Engineering Institute (as published by INSA), so I recommend thinking about how you could emphasize each of these in your resume:

Educate yourself as much as you can about key CTI terms, topics, and frameworks (many of which I discuss here). Try downloading and using tools like MISP. Read a blog post and then look up domains, IPs, and hashes in tools like AlienVault OTX, RiskIQ Community or VirusTotal. (There are many other free tools and resources listed here.) Watch presentations from events like the SANS CTI Summit and think critically about the content — what do you agree or disagree with? Be active on social media and ask questions when you don’t understand. (If people are jerks, ignore then and move on to nicer people.)

Here are a couple CTI interview questions I’ve asked and heard of from others — think about how you’d answer these, and think of your own interview questions as well:

• What is the Diamond Model (or MITRE ATT&CK or the Cyber Kill Chain) and how would you use it?
• Tell me about a recent report you read on a cyber threat.
• What is attribution and does it matter?
• What are key differences between Russian, Chinese, and Iranian adversaries?
• What are indicators, and when are they useful or not useful?

Lastly, you’ve heard this before, but networking is key whether you’re trying to get a CTI job or any other position. Social media is a great way to do this. Virtual conferences are another great way to network, as they often have Slacks or Discords where you can interact with attendees. If someone blows you off or is a gatekeeper that tries to keep you out of this field, ignore them and feel bad for them because they’re insecure. Please keep in mind that people are busy and this is a tough time for all of us, so be patient and understanding if someone doesn’t reply to you. (*Raises hand*…sometimes I don’t have the energy to reply to everyone, though I wish I did!)

Thanks for reading!

If you’ve made it this far, wow! 😆 I hope you’ve found some of this content helpful. CTI is a field I love, and I hope you’ll consider joining us— we need new ideas and perspectives to improve!

FAQs on Getting Started in Cyber Threat Intelligence was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

I’ve gotten questions about why I made the switch, and since I put a lot of thought into this, I thought I would share how I tackled this huge decision in case it’s helpful to others. Deciding to leave a job isn’t easy, so in this post, I wanted to share key things I considered that I’d encourage you to consider if you’re thinking of switching jobs. My guidance is aimed at mid-career professionals like me, but if you’re in other parts of your career, you might find some of this guidance helpful as well.

Think about why you want to leave

Stop and carefully think about why you want to switch jobs. In many cases, people leave jobs because they have a bad boss, are unhappy with the work, don’t like the culture, or don’t see advancement opportunities. We all have bad days or parts of our jobs we don’t like — no job is perfect. Did you just have a bad day, or is there something more persistent that’s happening? I encourage you to check in with yourself regularly about how thing are going to make sure your desire to leave is a persistent one, not just a fleeting case of temporary frustration.

In my case, over the past year, I got the itch for access to raw data about what adversaries were doing beyond what I curated as part of the ATT&CK team. I also found myself wanting to work for a different kind of organization to try something new. I had worked for large bureaucracies for my entire career, and I felt a pull to venture into a smaller organization. Over a series of months as well as both good and bad days at work, I kept feeling like I was ready for a change.

Talk to people you trust

Everyone needs mentors for their career, especially when you’re making big decisions. At the point I felt like I was ready for a change, I started talking to people I consider mentors (all of them informal). I made the decision to start seriously looking for a new job while drinking wine with a friend who advised me that often people are ready to leave a job before they realize they are — and I realized that was true for me. (Drinking wine can be a helpful part of this decision process, though not required. 🍷)

Your mentors can also help you throughout the rest of your transition, particularly with suggesting what you should look for in a new job, researching companies, and negotiating salary (more on those below). Multiple people I trust all recommended that Red Canary seemed like a good fit for me.

Make a list of what you want in your next job

Brainstorm all the things you could possibly want in your next job, including items like salary, location, culture, role, career advancement, and whatever else matters to you. Write them all down. It should come as no surprise that as a CTI analyst, I am a fan of structured analytic techniques, and I consider this to be one. Having a list lets you structure all the things floating around in your mind so you can carefully consider them, rather than being completely overwhelmed and confused by all your thoughts and emotions. This was absolutely crucial to my decision-making process, so I highly recommend you do it too.

Here is a peek at part of my initial list:

• Good people. Teammates who work hard but have fun too…regular gif posting required. Strong company culture of being good humans.
• Mission. Company that cares about helping the community, and evidence that they’ve done this.
• Hands-on CTI work and access to raw data.
• Support to keep speaking and sharing knowledge publicly.
• Remote or DC area.
• Small organization with minimal bureaucracy.

Once you draft a list, think about how your prioritize each of the items — what is non-negotiable and what are you flexible on? I also recommend comparing your current job to this list, because you might realize your current role a better fit than you previously thought. This can help protect you against a common issue when looking for a new job: feeling like “the grass is always greener.”

I found that most of my job at MITRE covered my list, which made me carefully consider why I really wanted a new job and reprioritize my list several times. In total, my list was over 20 items long — I’m kind of picky. 😉

Research companies

Now that you have a list of what you’re looking for, start figuring out what companies meet those requirements. While open source research helps (for example, sites like Glassdoor, which you should always take with a grain of salt), the way I went about this was to talk to people in the community I know and trust. I encourage you to do the same. This is a good chance to build up your network by attending conferences or reaching out on social media if you don’t already have a network in place. I encourage you to seek out “informational interviews” from current and former employees of a company, which might be as simple as asking a couple questions about what it’s like to work somewhere. In particular, if you’re part of a underrepresented group, find folks with a similar background to get their perspective.

As part of your research, consider your own interactions with different companies. Have you met their employees in the past? Do you feel like their culture is a fit for you? This was a key part of how I made my decision. Real talk: there were several companies I knew I didn’t want to work for because of how their leadership has previously treated me or what they did to market themselves. If you’re trying to recruit experienced people in this community, remember that your employees and your marketing are a key part of that. A great interaction you have with someone could help them decide to come to your company.

As I did this research, again and again, I kept coming back to Red Canary. Culture fit was extremely important to me (which I knew from making my list), and over the past several years that I’ve watched Red Canary, I’ve seen their commitment not only to helping their customers but also to helping the community. One example: when I asked them to team up on a workshop for the Women’s Society of Cyberjutsu over a year ago, they were happy to do it without hesitation. Words matter, but actions speak louder!

Apply, interview, get the job, and negotiate

Now that you’ve decided where you want to work, go get the job!

I know, I know, this is a lot. There are many existing resources on these topics, so I wanted to focus more on making the decision to leave and choosing a new company rather than the rest of the process. Of course, your first choice might not work out, so it’s good to have a “short list” of possible companies in mind and apply to all of them.

• On applying: If you found someone who works at the company during your research, ask them about the best way to apply. They may be willing to refer you or get your resume moved to the top of the pile so you don’t get lost in a sea of applicants. I’ve consistently found that this is the best way to make sure you get hired. If you don’t have a connection, apply however the website tells you to, and be sure to politely follow up…be the squeaky wheel!
• On interviewing: Check out Lesley Carhart’s sage guidance. Remember that you’re interviewing the company as much as they’re interviewing you. It shouldn’t surprise anyone by now that I had a longgggg list of questions that I asked as I interviewed, and I didn’t hesitate to ask all of them. Listening to how a company answers your questions is another great way to tell if you’d be a fit.
• On negotiating: Remember that negotiation is expected, so you don’t need to feel bad about it. I’m not great with salary negotiation, so just go read Keirsten Braeger’s advice on this. It’s also helpful to realize that every company is a little different in what they can negotiate on.

Take a deep breath and go for it

I was pretty darn nervous when I made this change, so it’s okay if you are too. Whenever I switch jobs, impostor syndrome rears its ugly head… “what if they figure out I don’t know everything? What if my new teammates don’t like me? What if this was the wrong choice?” As I’ve so often told those I’ve mentored…

When you’re a little scared, that’s when you grow the most because you know it’s a challenge.

I felt in my gut that this is the right choice for me at this point in my career, so I went for it.

I encourage you to try to leave your current job gracefully. Be honest about why you’re leaving and make sure you transition your work so you don’t leave your team in a tough spot— remember it’s a small community, and you might work with them again someday. I was fortunate that my MITRE teammates were very supportive, though we were all sad we wouldn’t work together anymore.

In closing

Choosing to switch jobs isn’t easy for anyone. To make sure it’s a good choice for you, I encourage you to be thoughtful about any change and not rush into it. While this was a difficult decision for me to make, by carefully thinking through it as I outlined above, I felt more confident that it was the right choice. So far, I’m happy in my new role and excited for what’s next!

***
This blog reflects my personal views only and does not reflect the opinions of my current or past employers.

The Difficult Decision to Switch Jobs was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

Make Everything Bigger

Your fonts are probably too small. Your images are probably too small. I know, you want people to see your full command-line output, but 90% of your audience won’t be able to read it, so please make it bigger. For font sizes, I recommend a minimum of 20-point, but ideally fonts are even larger than that. For images with a lot of detail, consider including the full image on one slide, and then a zoomed in version of just the part that’s important. Ryan Kovar is a master of this (he uses a tool called Snagit to create the cool torn edges), as you can see from our Black Hat presentation slides:

Create for Presenting, not Reading

Slides are a challenge to create because they serve two purposes: 1.) They help our audience understand our content while we’re speaking, and 2.) They’re something for people to read later. These two purposes are sometimes at odds with each other. When you have to choose, I recommend focusing on the first: the goal of your slides should be to help the audience understand your presentation (it’s a presentation, after all). As my speaking sherpa Ryan suggests, you can write a blog post later that is intended solely for the purpose of reading. Of course, depending on your venue and audience, they may EXPECT slides they can read later, so consider your audience above all else.

What does this mean in practice? Minimize text on your slides. If you’ve made everything in your presentation bigger as I previously suggested, you’ll soon realize that you simply don’t have room for a ton of text, and certainly not for full sentences. That’s a good thing! I recommend using brief bullet points for newer presenters, since this will help you remember what you say, but you won’t be able to read your slides since you don’t have full sentences. (Reading slides is a huge pet peeve of mine — please avoid it.) In addition to not reading your slides, please don’t read your notes. If you practice your presentation, you shouldn’t need to. I often practice new presentations 5+ times before I feel comfortable with them.

As you gain experience as a presenter, I suggest challenging yourself to reduce the amount of text on yours slides (when it makes sense to do that) — it’s tough to brief to an image-only slide, so I recommend easing yourself into that.

Ian Coldwater does an excellent job of creating slides with powerful images and little text, an example of which is below from their talk, “Ship of Fools: Shoring Up Kubernetes Security,” at the SANS Secure DevOps Summit.

If the single image approach feels too scary and you want more text, here’s an example of a slide I like from my teammate Tim Schulz’s recent presentation, “Adaptive Adversary Emulation with MITRE ATT&CK”, at the SANS Purple Team Summit. You’ll note he doesn’t use full sentences, but rather short phrases.

Think About Flow

You can have amazing content in your presentation, but if the audience doesn’t understand it, your presentation won’t be effective. Think carefully about how you communicate your points to the audience. A huge part of this is the presentation flow. Like a good story, a good presentation has a beginning, middle, and end. I go back to the classic approach that Scott Roberts also recommends:

1. Tell ’em what you’ll tell ’em
2. Tell ’em
3. Tell ’em what you’ve told ’em

Remember that your audience is hearing the content for the first time, so they need help following what you’re saying. I highly recommend having an Agenda/Overview slide for longer presentations, or at least voice-tracking an overview of what the audience should expect for shorter presentations. You should carefully consider what the major parts of your presentation are and how you will transition between them. “Transition” slides can help with this. You should also have a Conclusion/Takeaways slide to help the audience remember your key points.

Here’s an example from my teammate Jamie Williams’ presentation, “To Blue with ATT&CK-Flavored Love,” at the SANS Blue Team Summit. He started with an Agenda slide so the audience knew what the plan was:

Now that the audience knew that plan, he then used transition slides between each section. I am a huge fan of this approach because it signals to the audience you’re going to shift to the next topic, which helps them mentally keep up.

He then had a Conclusion slide that reiterated his key points:

Other tips

Here are a couple of other miscellaneous slide tips, many of which come from my teammate Adam Pennington:

• Don’t put anything important on the bottom third of your slide. In many rooms, this part of your slide will be blocked by the audience.
• Use high contrast colors. Remember a lot of conference screens get washed out. This means no pastels on white/light backgrounds. High contrast can be very tough on black backgrounds — think about the fact that to get high contrast, you’ll have to use pastel colors, so decide if that’s REALLY what you want before committing to a black background. I’ve found black backgrounds to be tougher than white backgrounds.
• Avoid non-standard fonts. Realize that if you use non-standard/paid/proprietary fonts, there’s a chance they may get screwed up if your slides are being presented from the conference’s computer. You can reduce the chance of fonts getting messed up by embedding your fonts in your PowerPoint slide — instructions here: https://support.office.com/en-us/article/embed-fonts-in-word-or-powerpoint-cb3982aa-ea76-4323-b008-86670f222dbc. Again, I recommend asking the conference organizers to review your slides on the conference screen to check your fonts.
• Use a unique file name for your slide deck. Just like you wouldn’t name your resume “Resume.pdf,” don’t name your slides “Conference_name.pptx.” Make sure to use the conference name, your name, and your talk title in your file name. This is big help to conference organizers and they will be grateful!
• Be consistent in your format. Ideally choose 2–3 fonts and stick with those. If you can, use consistent font sizes. Try to use the same colors as well — themes in PowerPoint can help with this. (I’ve driven myself crazy on a LOT of slide decks trying to make sure I only use one shade of red…) Also watch out for “jumps” — slight movements in text or graphics from one slide to another that make your presentation look less polished. This is common in slide titles, since sometimes you might accidentally move the text box.
• Put your Twitter/social media handle on the first and last slides. Having your handle on the first slide increases the likelihood that the audience will tweet with your handle during your talk. I also recommend having your handle, name, and (optionally) contact info and photo on the last slide — this helps the audience remember who you are and lets them know how to contact you. A great way to get Twitter followers is to let them know you’ll tweet a link to your slides! :)
• Be careful with animations. Animations can be awesome to add drama and emphasize your points, but they’re also risky — I’ve seen many presentations go wrong when the animations didn’t work as the presenter expected. Only use animations if you’re sure of them and have practiced!
• Avoid live demos. I know, they’re dramatic, but they rarely work. If you INSIST on a live demo, practice it a ton in advance, and always have a backup video. Videos embedded in slides are a much better option, and as you record them, use a zoom tool (like Magnifier on Windows) so your audience can see what you’re doing.
• Spell out acronyms. Especially if you’re at a “general” infosec con, remember not everyone in your audience has the same background that you do. Be sure to spell out acronyms on your slide when you first use them, and explain them verbally too.
• Cite your sources. If you use someone else’s work, cite it. It is not okay to plagiarize from others in this community. (It IS okay to use someone else’s work, with credit, and build on their idea.) Ideally include the source link on the slide, but if you don’t have room, you can include all your sources at the end of your presentation.
• Test your slides on the conference screen. As I’ve mentioned, you can spot a lot of font and color issues in advance if you can look at your slides on the conference screen before your presentation. Many cons will let you do this before your presentation if you politely ask organizers.

Slide Checklist

In case it’s helpful, here are those tips in handy checklist form that you can use as you finalize your slides.

☐ Fonts are over 20 point
☐ Images are large and add value to the presentation
☐ No full sentences (unless you have a good reason)
☐ Agenda slide included (or plan to voice-track)
☐ “About me” slide included (or plan to voice-track)
☐ Closing/takeaways slide included
☐ There is a beginning, middle, and end (transition slides if appropriate)
☐ High contrast colors
☐ Nothing critical on the bottom third of your slide (depends on room)
☐ No format jumps (check slide titles in particular)
☐ Non-standard fonts embedded in your file
☐ File named with the conference name, your name, and presentation title
☐ Consistent colors (don’t use 5 different reds)
☐ Consistent fonts (recommend no more than 2–3; consistent font sizes when possible)
☐ Twitter/social media handle on first/last slides (if that’s your thing)
☐ Animations work as expected and your voice track is timed to them
☐ Slides spell-checked
☐ Slides peer-reviewed
☐ Acronyms spelled out on first use
☐ Demo videos embedded (using zoom tools)
☐ Sources cited
☐ Slides tested on conference screen if possible (with the slide clicker you’ll use if you can…and if not, at least on your laptop screen)

Does this seem like a lot? Yeah, it is — making great slides is quite a time commitment, so plan ahead. Good luck on making excellent slides and giving an awesome presentation!

***

The author’s affiliation with The MITRE Corporation is provided for identification purposes only and is not intended to convey or imply MITRE’s concurrence with, or support for, the positions, opinions, or viewpoints expressed by the author.

How to Make Better Infosec Presentation Slides was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

1. Drink water and eat food. I know this sounds ridiculous — you’re an adult — but it’s amazing how quickly you forget to do this. You eat breakfast around 9 a.m., have a great conversation with someone, start doing a CTF (you don’t want to leave because you’re having so much fun), then there’s a talk you want to catch, then you make a new friend who invites you to a party that just has drinks and some cheese and crackers. You can see how this is a recipe for feeling pretty crappy. So, keep a water bottle with you and fill it up whenever you see a water fountain/cooler, and keep snacks in your bag for those times when you don’t want to leave the con. You can also suggest grabbing a meal with people you want to hang out with so you don’t have to feel like you’re missing out on the fun by stopping to eat.

2. Hand out business cards. A couple people make fun of me for handing out business cards because it’s “old school,” but I think they’re a great way to help people remember you. I meet hundreds of people in Vegas, and having a card helps trigger my memory at the end of the week. I’ve noticed quite a few people (yes, mostly men) who hand out their card to almost everyone they meet, which has made me more assertive in handing mine out. I often do this as a conversation is wrapping up with a simple “Please feel free to reach out in the future if I can help with anything” — this makes it more about you helping them, which feels natural to me. I also ask people for business cards, keep them in my bag, and then…this is key…after the con ends, I connect with everyone on LinkedIn with a short note of where I met them and what we talked about. This has been useful to me in the past when people lose my card but message me on LinkedIn later.

If someone doesn’t have a business card, ask if they’re on Twitter or LinkedIn and if you can connect with them. Also, be aware that BSidesLV, Black Hat, DEF CON, the Diana Initiative, Queercon, and other events all have very different cultures. People at some events may be more privacy-conscious and not want to share their names. Try to gauge the person before you ask for a name/other info — you’re likely not going to want to ask someone at DEF CON who has only referred to themselves by their hacker handle for a card (though maybe they have a cool one!). As long as you’re polite and not overly intrusive when you ask someone about themselves, you should be fine.

If you don’t have business cards, no worries, you can get them for next time. Sites like VistaPrint often have deals where you can get a bunch of cards very cheaply.

3. Pack your bag smartly. Here’s my usual con stuff I carry around with me: phones/iPad/laptop (with Wifi and Bluetooth turned off, using a VPN), water bottle, Lara bar/protein bar/nuts/snacks (extras for your colleagues if you’re nice), business cards (more than you think you need), hand sanitizer (avoid con crud!), mints/gum, ATT&CK stickers (or $CoolStickersOfChoice), sweater/sweatshirt, cell battery pack (I like this one), small notebook/pen, painkillers/meds, “lean” wallet (just ID and minimal credit cards cards/cash in the unlikely event your bag gets lost/stolen…it’s also wise to keep backup funds in my hotel room), and umbrella. Extra cash is always a good idea, especially if you have to buy a DEF CON ticket. Most people avoid using the ATMs at the cons (though I’d argue hotel security is probably going to have issues if someone tries to hack an ATM and would take care of that quickly).

When I’m traveling, I pack a travel backpack/daypack like this one in my suitcase. I grab my con swag bag the first day, then ditch it in my hotel room. I prefer my own bag so I can tell it apart from the thousands of other identical con bags, but do what works for you.

4. Take time to recharge. I enjoy talking to people, but it tires me out quite a bit. What I’ve learned to do is to spend daytime at the con, then go back to my room around 4–6 p.m. for a recharge (of both myself and my phone) and a power nap if I need it. By doing this I feel a lot better heading into evening events. If I skip my “me time,” I tend to be disinterested in the evening and just want to go to bed at 8 p.m. (which is okay too). Take time for yourself throughout the week so you don’t burn out the first day from “too much con.” I also try to limit my time on the expo floor because it’s sensory overload for me. It’s easy to get FOMO, but make sure you take care of yourself — this includes getting some sleep!

5. Connect with people. I recently attended a women’s leadership event that encouraged us to think about connecting, not networking. Networking seems so stressful and forced, but connecting is just about chatting with someone to form a relationship that’s mutually beneficial. Remember that you have something to offer other people. It can be nerve-wracking to talk to people you don’t know, but it’s worth it. One thing that can help is to have a few “con buddies” you hang around with — it’s much easier to meet new people when you have a “wingman” to chat with if you aren’t feeling brave.

I like to connect with people in ways that feel natural to me — like chatting while waiting in line, commenting on the beer selection at the bar, or asking if I can stand at their table so I don’t have to balance my plate o’ cheese and crackers. Last year, I even met an awesome woman in the bathroom at Black Hat!

If you’re newer, feel free to ask questions, especially at Villages and places like soldering stations. Many people, especially organizers, will be happy to explain how to do something. While you do this, though, be conscious of the situation and if it’s polite to ask questions at that time — for example, if someone is intently focusing on a CTF in the final minutes, maybe don’t ask them, but if organizers are walking around and talking to people, you could talk to them instead.

6. Take a risk to reach out to someone. A lot of people in the industry attend these cons. If there’s someone you’ve always wanted to meet or have interacted with on social media, take a chance and reach out! Many people post on social media that they’ll be at a con. Politely say that you’d like to meet for X reason and if they might be free for a few minutes at some point. You never know what the response will be. If they can’t meet, no worries, but at least you’ve tried. I’ve met some great people by doing this. For example, last year at RSA Nick Carr tweeted that he was happy to chat with people so I sent him a DM asking if he wanted to meet up — I wasn’t sure if he would reply, but he did and we ended up having a great conversation. Infosec people you know from social media are just normal people, so don’t be afraid to reach out (while not getting upset if the meet-up doesn’t happen…it’s a busy week).

7. Be security-conscious, but not overly paranoid. Yes, there are hackers at these cons. Yes, you should be careful. No, you don’t need to let it ruin your week. Use a VPN (like Algo) on all your devices and consider using Signal on your phone for text messages. Turn off your Bluetooth and WiFi. There’s always a lot of debate and discussion on whether you need a burner phone or laptop, but I personally don’t feel most people do (and most people don’t have $$$ to burn on burners). Some people use them, though.

Think about your physical security as well. There were reports of hotel employees entering rooms last year, so if you hear a knock, check who it is and call the front desk to verify if it is indeed hotel security. Also, use common sense and take steps to make sure you’re safe. Get your drinks directly from bartenders, have friends watch your drink (or take it to the bathroom if you need to), and make sure people know where you are. If you don’t feel safe, contact the con organizers and they can help you.

8. Dress for success. Above all, wear what makes you happy, whether it’s ripped-up jeans, a ball gown, a black T-shirt, or a tinfoil hat. (You’ll likely see all of these at some point!) Personally, during the day at all the cons I wear jeans, sneakers, and T-shirts, and most people wear the same. Black T-shirts are all the rage, but you don’t have to wear just black. :) I highly recommend wearing comfortable, broken-in shoes wherever you go — unless you’re an expert at walking in heels, it’s probably going to go badly for you because there is a LOT of walking (the Mandalay Bay Convention Center is about a 10 minute walk from the rest of the hotel/casino). For Black Hat receptions in the evenings, I’ve found something a little nicer than jeans/sneakers makes me feel more comfortable (whatever that means to you…black pants, khakis, a sundress, sandals, etc.), but you’ll always see people in jeans and sneakers. For women, you don’t need to do full “Vegas club” attire at night, but you can if you want, especially for parties like Rapid 7.

9. Plan your approach. There are lots of options for what to do in Vegas! You can attend talks, hang out on the Strip, talk to people, go to parties, do CTFs, gamble, go to a show…everyone has different ideas of what they enjoy, so find what makes you happy and do that! (Of course, sometimes your employer will have ideas on what you should do that may limit this. :)) One piece of advice I’ve found useful is to prioritize talking to people over going to talks — many talks are recorded and you can watch them later, but you won’t always have the chance to have a great conversation.

Weeks ago, I started creating a calendar of all the parties, meetings, and events I have going on for the week, and it’s a life-saver for me. If you do a little research to make a list of talks you want to attend, booths you want to visit, and people you want to connect with, it helps you stay organized and prioritize during a very busy couple days. Reading the con websites will help you get a sense of what you might want to do during your precious time there — but at the same time, be flexible and realize that your plans might change. Leave room for some spontaneous fun!

10. Ignore the haters. Most people at these cons are great — they’re interesting, passionate about infosec, helpful to newbies — but obviously, not everyone is that way. If you encounter someone who is rude or dismissive, don’t let it get you down — move on to someone else! There are plenty of people who want to talk to you, so ignore those who don’t.

***11. Get vaccinated and wear a mask!!!!! This is a special 2021 update. Please, please be safe. I won’t be there this year, and I hope those of you who attend will stay safe while enjoying yourself.***

If you’re looking for more tips, check out this post from Rick Holland and this one from Kathleen Smith. There are tons of other posts out there with DEF CON-specific guidance as well. If you’ll be in Vegas, I hope you have a great week! If you see me in passing, please stop me to say hi. In closing…if you do nothing else, just don’t forget to drink water.

***

The author’s affiliation with The MITRE Corporation is provided for identification purposes only and is not intended to convey or imply MITRE’s concurrence with, or support for, the positions, opinions, or viewpoints expressed by the author.

Ten Tips for Thriving at Infosec Cons was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

1. Industrial Control Threat Intelligence by Sergio Caltagirone
This isn’t just about Industrial Control Systems (ICS). This is a beautifully-written, concise paper that provides the fundamentals of what you need to know about CTI: a definition of it (which I use in my CTI presentations), indicators vs. analytics, tactical/operational/strategic levels, and the “CART” approach to measuring threat intelligence quality. If you’re not familiar with ICS, no worries — consider the ICS parts as examples of the points he makes in the paper. I try not to fangirl too much, but I fully embrace being a Sergio fangirl, and I feel that this paper justifies my feelings. I also recommend reading Sergio’s blog, including posts that are a couple years old —good CTI blog posts are like fine wine, they get better with age.

2. Psychology of Intelligence Analysis by Richards Heuer
This book breaks down how to think about how we think. Very meta, I know, but being aware of your own cognitive limitations and biases is key if you want to be a good CTI analyst. Richards Heuer is the OG when it comes to cognitive biases, and this is an excellent, approachable read that’s full of examples, fun diagrams, and clear explanations. Use caution, though…if you read this, you might start hyper-analyzing biases you see in yourself and others! (And you’ll be a breath of fresh air, especially if you’re on Twitter!)

3. Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains by Eric Hutchins, Michael Cloppert, and Rohan Amin
Also known as “the Kill Chain paper,” this represents the first in the “CTI framework triumvirate” that I consider required reading for any analyst. Even if you feel like the Kill Chain is old news, I encourage you to take some time to thoughtfully read this paper. Check out the different definitions of indicators (since this is a topic of hot debate in this community) as well as the courses of action, which are often overlooked. The intrusion attempt examples in the paper can also be helpful to new analysts who have never worked an intrusion themselves.

4. The Diamond Model of Intrusion Analysis by Sergio Caltagirone, Andrew Pendergast, and Chris Betz
The Diamond Model is a simple but powerful model every analyst should understand, and it’s the second of the “big three” CTI frameworks. Even if you don’t use it on your team, it’s helpful to understand the parts of an intrusion. This paper also has a lot of useful CTI fundamentals that we need to understand about adversaries — check out the axioms for many of those (like Axiom 7, which gives a nice definition of Advanced Persistent Threat). Yes, this is a long, academic paper, so I recommend breaking it up into a few sittings, but I promise that the time you devote to reading it will pay off in the end.

5. MITRE ATT&CK™: Design and Philosophy by Blake Strom, et al
I was a co-author of this paper, so I’m biased (how could I mention Heuer in this post and not call out my own biases??!?), but I think the community has bought into the idea that this whole ATT&CK thing can be pretty useful. I consider ATT&CK to be the third framework that all CTI analysts should be familiar with, and this paper explains the philosophy behind ATT&CK and how it’s structured. After reading this paper, I suggest heading over to the Groups page and skimming some examples of techniques to give you a feel for ATT&CK. You also might find the Getting Started page or my recent Sp4rkcon presentation to be helpful in learning more.

6. A Brief History of Attribution Mistakes by Sarah Jones
This is an important presentation for newer analysts to read and heed. True attribution back to a person is extremely difficult, and even attribution to a group can be tough. Sarah explains some common mistakes to watch out for when you’re trying to do attribution. After you check out Sarah’s presentation (you can also watch the video here), I highly recommend scrolling through more CTI Summit presentations. I was a fan of the CTI Summit long before I joined the advisory board because it’s one of the few non-CTI-vendor-specific conferences that focuses solely on this field (the FIRST CTI Symposium is another), and there are many excellent presentations from it.

7. CTI SquadGoals — Setting Requirements by Scott J. Roberts
A common issue among CTI teams is that they completely miss the point of it — CTI is supposed to help someone outside the CTI team itself. One way you can ensure your CTI team is trying to help support decision-making is by creating requirements. I love this blog post by Scott because it not only explains what requirements are but also provides practical examples of them to help get you started. Requirements don’t have to be scary! (Of course, you should then read more of Scott’s blog posts, because he has many great ones.)

8. Threat Intelligence Naming Conventions: Threat Actors, & Other Ways of Tracking Threats by Robert M. Lee
Like struggling with attribution, the issue of naming actors is almost a rite of passage for analysts to figure out. I went through this mental struggle myself a couple years ago and came out of it with an understanding of why we can’t say that different names from different companies are “the same” actors. I’m cheating because this is a video, but I think Rob does an awesome job of clearly explaining why naming is so challenging and why we’ll never be able to “just agree on one name.” If you can understand this early on in your CTI career, you’ll be ahead of the game and save yourself a lot of torment.

9. Does a BEAR Leak in the Woods? by Toni Gidwani
There are so many blog posts, reports, and presentations on adversary activity out there, but I like this one because it covers many key things a CTI analyst should know — who Fancy Bear and Cozy Bear are, what happened in the DNC breach, how to apply the Diamond Model, how to pivot, and how to wade through a lot of conflicting information to try to make sense of what adversaries did. You can also view the video of Toni’s Shmoocon 2017 presentation here. This was the first time I saw Toni speak (she’s awesome, so go see her if you get a chance), and it remains one of my all-time favorite conference presentations (along with No Easy Breach by Nick Carr and Matt Dunwoody, which you should also watch).

10. Cyber Intelligence Tradecraft Report — The State of Cyber Intelligence Practices in the United States by Jared Ettinger
This is a carefully-written and well-researched report by Jared and the team at the Carnegie Mellon Software Engineering Institute. Though it has a US focus, I think it’s a good primer for best practices to look for on a CTI team. Yes, it’s a long read, but if you take the time to dive into it (or even just skim the headings and read parts that interest you), you can learn a lot about common issues to avoid on a CTI team and best practices to strive for.

In addition to those resources, I also wanted to mention two repos you can check out for much more reading:

• APTNotes hasn’t been updated in a bit, but it’s a nice repo of a lot of reports on APT actors. I suggest skimming through some of them to get a sense of historical reporting, then making your own RSS feed so you can read current reports that come out. I use Feedly and suggest searching around for key terms to find sources you like, then making your own feed and tailoring it as you go. Twitter is also a great way to learn about new reports. Here’s a massive sampling of sources I follow on Feedly and/or Twitter that you could use to start from for CTI and cybersecurity content (with my apologies because I’m sure I’m forgetting many great ones — I don’t endorse any particular company): ESET, AlienVault, Anomali, Ars Technica, bellingcat, Bitdefender Labs, Cybereason, Carbon Black, DHS CISA, Dark Reading, Forcepoint, Intezer, Krebs on Security, Dragos, Malwarebytes Labs, McAfee, Microsoft Security, The Citizen Lab, SpecterOps, Proofpoint, SANS Internet Storm Center, Schneier on Security, Securelist, Dell Secureworks, Sophos, Symantec, Cisco Talos, TaoSecurity, TrendLabs Security Intelligence Blog, WeLiveSecurity, CrowdStrike, F-Secure, Endgame, FireEye, Fortinet, Fidelis, LookingGlass, Morphisec, Threatpost, CyberScoop, Unit 42, Project Zero, RiskIQ, Recorded Future.
• Awesome Threat Intelligence pulls together a wealth of CTI resources.

Scott covers books very well in his post, but I’d like to highlight three books that I find particularly worthwhile:

• Intelligence-Driven Incident Response by Scott Roberts, Kyle Maxwell, and Rebekah Brown — I think this is as close to a CTI textbook as there is right now. If you buy one CTI book, I suggest it be this. I constantly loan mine out to people who are looking to get started in this field.
• Structured Analytic Techniques for Intelligence Analysis by Richards Heuer and Randolph Pherson — It’s not cheap, but if you like Psychology of Intelligence Analysis and structured analytic techniques, this is a worthy investment for your bookshelf. It’s divided by types of techniques, so you can easily flip through to choose a technique depending on the challenge you have.
• The Cuckoo’s Egg by Cliff Stoll — Cliff is considered one of the earliest CTI analysts, and this is a fun read that also helps you learn about the process of investigating an incident and thinking through what you see. You can probably find this at a local library, and in the meantime, you can watch his extremely entertaining CTI Summit keynote from a few years ago.

There are many, many more CTI resources out there if you look, but those are some of my recommendations to get you started. Happy reading!

***

The author’s affiliation with The MITRE Corporation is provided for identification purposes only and is not intended to convey or imply MITRE’s concurrence with, or support for, the positions, opinions, or viewpoints expressed by the author.

A Top 10 Reading List if You’re Getting Started in Cyber Threat Intelligence was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

I’ve heard many people say “well, I’m not an expert, so I shouldn’t give a talk” — throw that thinking out the door right now! Sometimes newbies have the most valuable perspectives because they give a fresh take on a topic. Even if a topic has been presented before, you might have a new way of thinking about it or presenting it.

In particular, I want to encourage women and under-represented minorities to submit proposals to conferences. When I’ve been on conference review boards, I know I and many other board members have desperately wanted to accept more diverse speakers (in every sense of the word “diverse”) who submitted great proposals — but if you don’t submit, we can’t accept you to speak!

It’s easy to say “submit to a conference,” but it’s tougher to actually do it. I wanted to share a rough process I’d recommend following as you craft a proposal. Many others have shared proposal-writing tips, so please check out those resources, which I’ve linked at the end. Since I found mostly tips out there, I wanted to write this about a soup-to-nuts process because I know doing this can be intimidating for someone starting out. Of course, your mileage may vary, and you might find a different process works for you.

0. & 1. Find an event and think of a topic.

You can find out about conferences to submit to from social media, from your friends or coworkers, or from a site like CFPtime.org. If it’s your first time speaking, you could choose a smaller conference like BSides, but if you want to submit to a larger conference like Black Hat or DEF CON, go for it!!! Some conferences have tracks for new speakers and offer coaching/mentoring. Take a look at location and what benefits the conference offers — many offer a free ticket for accepted speakers, and a few pay for travel as well.

You might think of a topic before you choose an event, and if so, be sure your topic is appropriate for the event (which you’ll confirm when you do your research in step 2). Good conference topics often come from your struggles, experience, or debates. If you’re just starting out in the field, you might consider a talk about your experiences getting started/learning a new topic. You could also discuss a problem you’ve seen and suggest a solution, or examine a widely-held belief you think is wrong and propose an alternate way of thinking. Another way to think of a topic can be to look at last year’s conference agenda or existing research and ask yourself what’s missing — what do you think should be part of the conversation that no one has presented?

As you decide you want to submit a proposal, this is also a good time to let your employer or school know of your plans so you can check on any policies they have. You should also let your team and leadership know so you can get their support.

2. Do your homework.

This is a fundamental step that I think many people miss, but if you skip it, I believe your odds of getting accepted are lower. You need to thoroughly research both the event you’re submitting to and the topic. Here are some questions to consider as you do this research.

• Who is the target audience for this event? Who has attended in the past? This is key to make sure your proposal will resonate. I’ve been on review boards where we’ve loved a proposal, but it wasn’t right for the conference. If it’s a red team conference, don’t submit a defense talk unless there’s a red team aspect to it. Sources might include the conference website, social media from the previous year, and talking to organizers/community members who have attended. This leads directly into the second question…
• What topics are the organizers interested in having at the event this year? What topics have previously been presented at the event? These are also key questions to answer to make sure your talk will resonate. The organizers often tell you what topics they’re interested in directly in the Call for Papers/Call for Proposals (CFP). However, don’t take this as gospel — if you have a topic that is in line with the general theme but not listed, it still may be a good fit! You can try reaching out to the organizers to ask if you’re not sure. You should also look at the conference website from previous years to give you a sense of what’s been previously presented, since this will give you a clue about whether yours might fit. Looking at past abstracts also tells you the level of detail and type of language the review board is looking for. (Is it formal/academic or is it more informal/conversational?) If you find someone has talked about your planned topic in a previous year, don’t sweat it, but be sure to have a different take— you can even propose a talk that will build on it! (For an example of this, check out Mark Parsons’ 2017 SANS CTI Summit talk and then Dave Herrald and Ryan Kovar’s 2018 SANS CTI Summit talk.)
• What other talks, papers, and blogs have been put out on your topic? Do your research about what else has been written and said on your topic beyond the conference you’re submitting to. You can’t read everything, but spend a few minutes Googling and taking a look at other conference pages and YouTube. Again, just because someone else has discussed it doesn’t mean you can’t, but you need to be aware of what’s out there so you can provide your take. You should think about the unique perspective you have, and be sure to express that as you start thinking and writing. Be sure to reference others’ work if you use it! Many review boards love when you take another researcher’s work and build upon it — it’s a great demonstration of the power of sharing our thoughts as a community.

3. Start writing some words…any words.

The thought of writing a proposal can be so daunting that you get writer’s block and psych yourself out before you even start. My advice is to just start writing something. Don’t worry about the language you use or if it makes sense. Just write, however it’s easiest for you to do this — a bulleted list, free text, on a whiteboard, in Notepad — whatever. If you struggle to write anything at all, try finding a friend or colleague to talk things out with first, then write down what you discussed. You could also try the “rubber ducky method” and talk it out with your four-legged friend or a rubber ducky…whatever floats your boat. (#FUZZYSNUGGLYDUCK)

4. Organize your thoughts into an outline.

Now you have a mess of written stuff. Start to organize it into a coherent outline and flesh out your ideas. Take a look at what format the CFP asks for — some even provide a sample submission, and if they do, use that to start organizing! Many conferences ask for a title, abstract (usually a paragraph or two), and outline (usually a page or two), but some are different, so be sure to check. I recommend copying the specified format into a Word/text/Google doc and editing there so you don’t lose your precious work due to a buggy proposal system. Even if your CFP doesn’t require an outline, I recommend creating one since it will help you organize what you want to say. Plus, if you’re accepted, Future You will be eternally grateful to Past You for getting a jump start on the work.

As Scott J Roberts writes, a good presentation will generally have three parts: an introduction, body, and conclusion. You could start with those three headings on your blank document to help you. Your outline can be phrases, sentences, or bullet points, but be sure to mimic any example outline the organizers provide.

Introduction: From your brainstormed mess of words, think about your key theme or thesis. If you had to describe the point of your talk (what you want someone to walk away knowing), what would it be? Once you have that down, consider what kind of introduction, definitions, or “stage-setting” you might need — this is where your research into the audience comes into play. If it’s a general infosec conference and you’re talking about reverse engineering (RE) malware, maybe you need a quick slide or two to define terms. But if you’re at an RE conference, you should probably skip that. You should almost always state the problem you’re trying to address with your presentation to help your audience understand why they should listen to you.

Body: After you’ve figured out your introduction, consider what supporting examples, information, or evidence you have for that main thesis. Think about a logical way to divide the presentation — do you have three different examples you’ll cover in depth? Do you have 10 pieces of evidence you’ll cover more quickly? Each presentation is different, but having a clear structure for the “body” of your presentation will help you create your presentation and the audience follow it more easily. For each of your “parts,” consider how you can create a parallel construction. (For example, if I’m talking about three threat groups, maybe I cover the four vertices of the Diamond Model for each of them.)

Conclusion: You’ll want to re-state your key point from your introduction as well as list the takeaways for the audience. You may also want to include future research or “what’s next” in this section.

If you have the time, it’s a good idea to start drafting up some slides of your actual content. (Scott’s blog post might help you there as well. Yes, I’m a huge fan of that post and Scott in general!) What might happen is that you find what you thought your presentation would be about is all wrong and you want to submit something else. (This has happened to me after I’ve submitted a proposal…oops…)

You can have the best technical content ever, but if you don’t organize it and communicate it in a way that the review committee (and audience) understands, it’s tough to have a successful presentation. Take some time to think through your talk flow as you craft a proposal, and it will pay off for you later.

5. Write a title and abstract.

Now that you have an outline, write the title and abstract. This may seem backward, but I’ve found if I start with the title or abstract, I realize as I’m writing the outline that I actually want to talk about something different. If you’re short on time and the conference doesn’t require an outline, you can skip that step, but I think your results will be best if you put in the extra work to create an outline.

Writing clever titles is the toughest part of this process for me, and I lean on my friends who are awesome at this for help (take a wild guess who came up with the title for my joint talk with Ryan Kovar at Black Hat). You may want to avoid cliches like “For Fun and Profit” since committees have seen them a ton. I personally like multi-part titles with “Something Clever: Something Straightforward,” but everyone is different. Remember you don’t need a clever title…you can just write what you’ll talk about. Lean heavily on your thesis/key point to help you craft an appropriate title.

Abstracts can also be tough to write. They should briefly summarize your talk while clearly communicating your key points. You might consider starting out with a “hook” that draws the reader’s attention or provides a statement of the problem (e.g. “You might have heard about FUZZYSNUGGLYDUCK, but what is it, really?” or “Ducks are everywhere, but are they always fuzzy and snuggly? This talk will reveal the answer.”) Make sure to include your thesis and key points — if you have trouble stating these, go back to your rubber ducky and tell him why he should be excited about your talk. I also like to explicitly state what attendees should expect to learn since this helps reviewers know your presentation will be of interest to their audience.

As you’re writing your abstract, be sure to review the past conference page to see the length and tone past abstracts have had. If you’re submitting to an academic conference, your tone will be very different than if you’re submitting to BSides, a SANS Summit, or DEF CON — and similarly, if you’re submitting to one of those and write a dense academic abstract, you may be overlooked.

6. Fill in the rest of the proposal fields.

Many CFPs ask for your title, company, Twitter handle, LinkedIn profile, website/blog, videos of you speaking, headshot, and bio. Make sure to have these things ready rather than getting caught without them at the last minute. If you don’t have a professional headshot, you can sometimes get these for free at events, or ask a friend to take one of you against a white background while wearing professional attire. When writing your bio, it’s okay to show off a little (especially if you’re humble)— you may want to include educational background, work history, previous speaking experience, awards, and hobbies. It’s fine to list a team/company blog that you contribute to, but it’s also okay if you don’t have a blog or video to link to.

CFPs often ask if you’ve given the talk previously. Be honest! My opinion is it’s fine to repeat a talk, especially if you’ve spent a lot of time on the research — different events reach different audiences. You should always be up front about this. If you plan to make updates to your talk, you can mention that.

7. Review and edit.

Sleep on your proposal for a day or two if you can, and come back to it with a fresh set of eyes. Make edits and refine it. Have a friend or coworker review it for you and make suggestions — what you intended to communicate may not be what they understand when reading it. SPELLCHECK IT. SERIOUSLY. (This sounds simple, but so many people don’t do it!) In particular, make sure you spell the name of the conference correctly. (Is it Shmoocon or Schmoocon…Defcon or DEF CON…?) As a reviewer, if I can tell someone didn’t spend much time on their proposal, it gives me no confidence they will spend time to make a good presentation.

8. Submit it and wait!

Make sure to submit it on time — if you’re not sure of the closing time (or time zone), ask the organizers. Most CFP systems will provide a confirmation email that you submitted. Conferences vary in how long it takes to get back to you, and it’s usually between weeks and months. If they have posted a date when they will let speakers know, it’s okay to ask about your status if that date has passed (but be nice if they need extra time to decide, particularly since many conferences have volunteer review boards).

If you aren’t accepted, don’t get discouraged! There are many, many infosec conferences out there, and you can submit to another one. (After all, you’ve already done the work to put your amazing proposal together!) Keep your head up and keep trying! I was rejected for the first conference I ever submitted to, but have been accepted at many since then. If you’re rejected, you can ask the committee for feedback if they don’t provide it. Some committees may not provide feedback, but it doesn’t hurt to politely ask.

If you’re accepted, congratulations!!! Now comes the real work: making your presentation. :) But that’s a topic for another day.

Other resources

There are many other great resources on tips for submitting CFPs, and I’ve linked a few of them here.

• Giving A Talk in InfoSec
• So You Want to Speak at a Security Conference?
• So you want to present...
• The Building Blocks of Infosec CFPs
• DEF CON® Hacking Conference - Speaker's Corner

***

The author’s affiliation with The MITRE Corporation is provided for identification purposes only and is not intended to convey or imply MITRE’s concurrence with, or support for, the positions, opinions, or viewpoints expressed by the author.

Writing Infosec Conference Proposals: A Step-by-Step Guide was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.

So I did. Posting stuff like that still feels awkward to me, even after I’ve become more accustomed to doing it. It just feels wrong — like I’m saying “look at me and how great I am!” In spite of that feeling, I suck it up and do it anyway. If I don’t promote what I’m doing, whether it’s on social media or at work, I can’t expect anyone else to do it for me. We are each our own greatest advocate.

I suspect many of you out there might feel the same way (I’m looking at you, women in tech), so I wanted to take some time to reflect on this struggle I’ve had and share how I cope with it. How can I promote myself and what I’m doing while also trying to maintain some semblance of humility?

First, let’s call it like it is: women are expected to be humble. In general (yes, these are generalities), women are taught that they shouldn’t “brag” about themselves. Based on women I’ve talked to, I firmly believe this harms us in our careers. For many years, I believed that if I put my head down and worked hard enough, everyone would notice this and opportunities would rain down upon me. I was fortunate to do fairly well in my career early on, but it’s been incredible to see what has happened once I really started promoting my work and what I bring to the table. (It’s been part of the transformation I talked about in my first blog post.)

You should still expect others to help you along the way, and I am where I am due to many awesome people advocating for me. You should regularly ask for advocacy from your leadership and those who have more “power” than you, particularly since research shows women often don’t do this. However, you can’t rely on your leadership to be your sole advocate. Leaders tend to be busy, and they may not have time to track everything you’re doing — so tell them!

It’s easy to say “go promote your work,” but it’s tougher to take this to heart and do it in practice. Here are a couple actions I take and would suggest to others:

• Keep a personal list of my accomplishments throughout the year (great presentations, important meetings, “kudos” emails, etc.). At the end of the year, I share it with my boss to demonstrate what I’ve done. This list is also a great mitigation for impostor syndrome!
• Tell my bosses and teammates when I’ve done something awesome. I’ll write a summary of what I did, why it was important, and the impact it made. Sometimes they already know, but it’s important to write it down so they remember and can send it to *their* bosses if they want.
• Share what I’m doing on social media. If I get accepted to speak at a conference or publish a new blog post, I share it on Twitter and LinkedIn. I realize sharing publicly may not be for everyone, so consider how you might share your accomplishments with a smaller group.
• Think about my personal brand and trying to make my actions and words align with it. For me, my brand is something like “a down-to-earth CTI analyst who brings liberal arts prowess to cybersecurity.” I want to be seen as a leader, a mentor, a public speaker, and an overall kick-ass woman in cyber. (If you need an example of personal branding, check out Cheerio! No joke, she handed me her own personal stickers at RSA!) I think someone has a strong personal brand when I can easily describe what they’re about in a short sentence.
• Watch what others have done to figure out how you want to self-promote. For example, when starting this blog, I realized I should pull together a list of public talks and publications. So, I looked to someone I respect, Lesley Carhart, and followed her lead to make my own “About me” page. I liked her style, so I used it as a point of reference and modified it for myself. If you hate something that someone else does, make a note and don’t do it! If you love someone’s style, great, emulate it. I also apply this same philosophy of “watching and borrowing” to leadership styles.
• Get someone to hold you accountable. I have a great colleague who tells me when I’m undervaluing myself. I walked out of a discussion I facilitated and he told me I did a good job. “Thanks, it’s easy when it’s a topic I like,” I said. He gave me look and said “no…you’re selling yourself short. The appropriate response is thank you.” And he was absolutely right. Sometimes our attempts to be humble only diminish our real accomplishments, and we have to watch out for that because it’s not fair to us. I know I have this problem. A teammate, boss, friend, or family member can help hold you accountable by pointing out times when you have awesome accomplishments to share or times when you’re diminishing them.

And how do I deal with that “icky” feeling like I’m bragging? Well, some people would tell you to just get over it, but if that’s not you, try thinking about these things…

1. Make it about those you’re sharing with

Instead of focusing on what you’re doing, focus on those you’re sharing with. For example, when I facilitated the Peer2Peer discussion at RSA, I posted this tweet:

My focus here was on thanking the attendees, which was easy to do because there were 30 of them and one of me as the facilitator. They drove the discussion and shared their thoughts, and my role was to keep the discussion going. By phrasing it like this, I still shared with everyone what I accomplished, but I made it about the attendees more than about myself. Other phrases you can use to accomplish this might be “Thanks for coming…” or “If you care about X, you might be interested in hearing my talk about Y.” Doing this helps me feel like I’m still remaining humble. Whenever you share something about yourself, keep in mind that the information you’re sharing could help others learn something new.

Sure, I could have just posted “I just did an awesome job leading a Peer2Peer session,” but that’s boring and it also doesn’t feel like me. That brings me to my final point…

2. Do what feels authentic to you.

Above all, stay true to what feels authentic to you. If you suddenly start posting a bunch of tweets that seem like someone else wrote them, it’ll get weird and people will sense that. Yes, you should stretch yourself a little to make sure you’re sharing your work and accomplishments, but figure out what works for you. I’ve shared some of my advice on what has helped me overcome hurdles in the hopes that it will help you, but ultimately, do what feels right.

In closing

I’ve shared with you some possible approaches you can use to promote yourself and your work. This doesn’t have to feel sleazy or uncomfortable — you’re not bragging, you’re sharing. Even though I promote my work, I still consider myself to be humble. I don’t know everything, and I don’t pretend to. But if I don’t share what I do know, I’m not just selling myself short — I’m also selling everyone else short who could have benefited from hearing what I had to say.

***

The author’s affiliation with The MITRE Corporation is provided for identification purposes only and is not intended to convey or imply MITRE’s concurrence with, or support for, the positions, opinions, or viewpoints expressed by the author.

The Struggle between Self-Promotion and Humility was originally published in Katie’s Five Cents on Medium, where people are continuing the conversation by highlighting and responding to this story.