100% found this document useful (2 votes)
59 views62 pages

Download full Professional Red Teaming: Conducting Successful Cybersecurity Engagements 1st Edition Jacob G. Oakley ebook all chapters

Cybersecurity

Uploaded by

souvenatenea
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
100% found this document useful (2 votes)
59 views62 pages

Download full Professional Red Teaming: Conducting Successful Cybersecurity Engagements 1st Edition Jacob G. Oakley ebook all chapters

Cybersecurity

Uploaded by

souvenatenea
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 62

Download the full version of the textbook now at textbookfull.

com

Professional Red Teaming: Conducting


Successful Cybersecurity Engagements 1st
Edition Jacob G. Oakley

https://textbookfull.com/product/professional-red-
teaming-conducting-successful-cybersecurity-
engagements-1st-edition-jacob-g-oakley/

Explore and download more textbook at https://textbookfull.com


Recommended digital products (PDF, EPUB, MOBI) that
you can download immediately if you are interested.

Cybersecurity attack and defense strategies infrastructure


security with Red team ens Blue team taxtics 1st Edition
Yuri Diogenes
https://textbookfull.com/product/cybersecurity-attack-and-defense-
strategies-infrastructure-security-with-red-team-ens-blue-team-
taxtics-1st-edition-yuri-diogenes/
textbookfull.com

Cybersecurity attack and defense strategies infrastructure


security with Red team ens Blue team taxtics 1st Edition
Yuri Diogenes
https://textbookfull.com/product/cybersecurity-attack-and-defense-
strategies-infrastructure-security-with-red-team-ens-blue-team-
taxtics-1st-edition-yuri-diogenes-2/
textbookfull.com

All Out Temptation Forbidden Lovers Romance Belford Boys


Book 2 1st Edition Scarlett Oakley [Oakley

https://textbookfull.com/product/all-out-temptation-forbidden-lovers-
romance-belford-boys-book-2-1st-edition-scarlett-oakley-oakley/

textbookfull.com

Vertebrates comparative anatomy, function, evolution 8th


Edition Kenneth V. Kardong

https://textbookfull.com/product/vertebrates-comparative-anatomy-
function-evolution-8th-edition-kenneth-v-kardong/

textbookfull.com
Ernest Hemingway a biography Dearborn

https://textbookfull.com/product/ernest-hemingway-a-biography-
dearborn/

textbookfull.com

Tackling A Level Projects in Computer Science OCR H446


Ceredig Cattanach-Chell

https://textbookfull.com/product/tackling-a-level-projects-in-
computer-science-ocr-h446-ceredig-cattanach-chell/

textbookfull.com

McGraw-Hill's EMT Flashcards 2nd Edition Peter A. Diprima

https://textbookfull.com/product/mcgraw-hills-emt-flashcards-2nd-
edition-peter-a-diprima/

textbookfull.com

Long Term Evolution 3GPP LTE Radio and Cellular Technology


Ahson

https://textbookfull.com/product/long-term-evolution-3gpp-lte-radio-
and-cellular-technology-ahson/

textbookfull.com

Lonely Planet Pocket Lake District Lonely Planet

https://textbookfull.com/product/lonely-planet-pocket-lake-district-
lonely-planet/

textbookfull.com
Persuasive Technology: Development and Implementation of
Personalized Technologies to Change Attitudes and
Behaviors: 12th International Conference, PERSUASIVE 2017,
Amsterdam, The Netherlands, April 4–6, 2017, Proceedings
https://textbookfull.com/product/persuasive-technology-development-
1st Edition Peter W. De Vries
and-implementation-of-personalized-technologies-to-change-attitudes-
and-behaviors-12th-international-conference-persuasive-2017-amsterdam-
the-netherlands-april/
textbookfull.com
Professional
Red Teaming
Conducting Successful Cybersecurity
Engagements

Jacob G. Oakley
Professional Red Teaming
Conducting Successful
Cybersecurity Engagements

Jacob G. Oakley
Professional Red Teaming: Conducting Successful Cybersecurity Engagements
Jacob G. Oakley
Owens Cross Roads, AL, USA

ISBN-13 (pbk): 978-1-4842-4308-4 ISBN-13 (electronic): 978-1-4842-4309-1


https://doi.org/10.1007/978-1-4842-4309-1
Library of Congress Control Number: 2019934346

Copyright © 2019 by Jacob G. Oakley


This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the
material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,
broadcasting, reproduction on microfilms or in any other physical way, and transmission or information
storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now
known or hereafter developed.
Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with
every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an
editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the
trademark.
The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not
identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to
proprietary rights.
While the advice and information in this book are believed to be true and accurate at the date of publication,
neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or
omissions that may be made. The publisher makes no warranty, express or implied, with respect to the
material contained herein.
Managing Director, Apress Media LLC: Welmoed Spahr
Acquisitions Editor: Susan McDermott
Development Editor: Laura Berendson
Coordinating Editor: Rita Fernando
Cover designed by eStudioCalamar
Cover image designed by Freepik (www.freepik.com)
Distributed to the book trade worldwide by Springer Science+Business Media New York, 233 Spring Street,
6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail orders-ny@springer-
sbm.com, or visit www.springeronline.com. Apress Media, LLC is a California LLC and the sole member
(owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc). SSBM Finance Inc is a
Delaware corporation.
For information on translations, please e-mail [email protected], or visit http://www.apress.com/
rights-permissions.
Apress titles may be purchased in bulk for academic, corporate, or promotional use. eBook versions and
licenses are also available for most titles. For more information, reference our Print and eBook Bulk Sales
web page at http://www.apress.com/bulk-sales.
Any source code or other supplementary material referenced by the author in this book is available to
readers on GitHub via the book’s product page, located at www.apress.com/9781484243084. For more
detailed information, please visit http://www.apress.com/source-code.
Printed on acid-free paper
To my children.
You can do anything you set yourself to.
Table of Contents
About the Author��������������������������������������������������������������������������������������������������� xiii

About the Technical Reviewer���������������������������������������������������������������������������������xv


Acknowledgments�������������������������������������������������������������������������������������������������xvii

Introduction������������������������������������������������������������������������������������������������������������xix

Chapter 1: Red Teams in Cyberspace����������������������������������������������������������������������� 1


Intentions�������������������������������������������������������������������������������������������������������������������������������������� 2
Advantages����������������������������������������������������������������������������������������������������������������������������������� 6
Evaluating Preparedness��������������������������������������������������������������������������������������������������������� 7
Disadvantages���������������������������������������������������������������������������������������������������������������������������� 11
Summary������������������������������������������������������������������������������������������������������������������������������������ 14

Chapter 2: Why Human Hackers?��������������������������������������������������������������������������� 15


Innovation and Automation��������������������������������������������������������������������������������������������������������� 15
Modeling Technology������������������������������������������������������������������������������������������������������������� 16
Nonpivot Technology������������������������������������������������������������������������������������������������������������� 18
Pivoting and Exploiting Technology��������������������������������������������������������������������������������������� 20
Automation Advantages and Disadvantages������������������������������������������������������������������������������� 22
Advantages���������������������������������������������������������������������������������������������������������������������������� 22
Disadvantages����������������������������������������������������������������������������������������������������������������������� 22
Example Scenarios��������������������������������������������������������������������������������������������������������������������� 24
Scenario 1����������������������������������������������������������������������������������������������������������������������������� 25
Scenario 2����������������������������������������������������������������������������������������������������������������������������� 26
Scenario 3����������������������������������������������������������������������������������������������������������������������������� 26
Scenario 4����������������������������������������������������������������������������������������������������������������������������� 27
Threat Hunting���������������������������������������������������������������������������������������������������������������������������� 27
Summary������������������������������������������������������������������������������������������������������������������������������������ 28
v
Table of Contents

Chapter 3: The State of Modern Offensive Security������������������������������������������������ 29


The Challenge of Advanced Persistent Threats��������������������������������������������������������������������������� 29
More Capable������������������������������������������������������������������������������������������������������������������������ 30
More Time������������������������������������������������������������������������������������������������������������������������������ 31
Infinite Scope������������������������������������������������������������������������������������������������������������������������� 31
No Rules of Engagement������������������������������������������������������������������������������������������������������� 32
Environmental Challenges���������������������������������������������������������������������������������������������������������� 33
Regulatory Standards������������������������������������������������������������������������������������������������������������ 33
Limited Innovation����������������������������������������������������������������������������������������������������������������� 34
Misconceptions��������������������������������������������������������������������������������������������������������������������� 35
Adversarial Customers���������������������������������������������������������������������������������������������������������������� 36
Technical Personnel��������������������������������������������������������������������������������������������������������������� 37
Effective Red Team Staffing�������������������������������������������������������������������������������������������������������� 40
Summary������������������������������������������������������������������������������������������������������������������������������������ 41

Chapter 4: Shaping������������������������������������������������������������������������������������������������� 43
Who��������������������������������������������������������������������������������������������������������������������������������������������� 43
Customer Technical Personnel���������������������������������������������������������������������������������������������� 43
Customer Operational Personnel������������������������������������������������������������������������������������������� 44
Provider Technical Personnel������������������������������������������������������������������������������������������������ 45
Provider Operational Personnel��������������������������������������������������������������������������������������������� 45
When������������������������������������������������������������������������������������������������������������������������������������������� 46
Preventing Incidents�������������������������������������������������������������������������������������������������������������� 46
Balancing Scope Attributes��������������������������������������������������������������������������������������������������� 47
What�������������������������������������������������������������������������������������������������������������������������������������������� 47
Motivation of the Assessment����������������������������������������������������������������������������������������������� 48
Prior Testing��������������������������������������������������������������������������������������������������������������������������� 50
Existing Security�������������������������������������������������������������������������������������������������������������������� 51
Scope Footprint��������������������������������������������������������������������������������������������������������������������� 52
Inorganic Constraints������������������������������������������������������������������������������������������������������������ 53
Summary������������������������������������������������������������������������������������������������������������������������������������ 55

vi
Table of Contents

Chapter 5: Rules of Engagement���������������������������������������������������������������������������� 57


Activity Types������������������������������������������������������������������������������������������������������������������������������ 58
Physical��������������������������������������������������������������������������������������������������������������������������������� 59
Social Engineering����������������������������������������������������������������������������������������������������������������� 61
External Network������������������������������������������������������������������������������������������������������������������� 62
Internal Network�������������������������������������������������������������������������������������������������������������������� 64
Pivoting���������������������������������������������������������������������������������������������������������������������������������� 65
Wireless Network������������������������������������������������������������������������������������������������������������������ 66
Category�������������������������������������������������������������������������������������������������������������������������������������� 67
Escalation of Force��������������������������������������������������������������������������������������������������������������������� 68
Incident Handling������������������������������������������������������������������������������������������������������������������������ 69
Tools�������������������������������������������������������������������������������������������������������������������������������������������� 69
Certification Requirements��������������������������������������������������������������������������������������������������������� 70
Personnel Information����������������������������������������������������������������������������������������������������������������� 71
Summary������������������������������������������������������������������������������������������������������������������������������������ 71

Chapter 6: Executing���������������������������������������������������������������������������������������������� 73
Staffing��������������������������������������������������������������������������������������������������������������������������������������� 73
The Professional Hacker������������������������������������������������������������������������������������������������������������� 74
Best Practices����������������������������������������������������������������������������������������������������������������������������� 74
Check the ROE����������������������������������������������������������������������������������������������������������������������� 75
Operational Notes����������������������������������������������������������������������������������������������������������������������� 78
Enumeration and Exploitation������������������������������������������������������������������������������������������������ 79
Postaccess Awareness���������������������������������������������������������������������������������������������������������� 80
System Manipulation������������������������������������������������������������������������������������������������������������� 84
Leaving the Target����������������������������������������������������������������������������������������������������������������� 85
Example Operational Notes��������������������������������������������������������������������������������������������������������� 85
Summary������������������������������������������������������������������������������������������������������������������������������������ 88

vii
Table of Contents

Chapter 7: Reporting���������������������������������������������������������������������������������������������� 89
Necessary Inclusions������������������������������������������������������������������������������������������������������������������ 89
Types of Findings������������������������������������������������������������������������������������������������������������������������ 92
Exploited Vulnerabilities�������������������������������������������������������������������������������������������������������� 93
Nonexploited Vulnerabilities�������������������������������������������������������������������������������������������������� 94
Technical Vulnerabilities�������������������������������������������������������������������������������������������������������� 94
Nontechnical Vulnerabilities�������������������������������������������������������������������������������������������������� 95
Documenting Findings���������������������������������������������������������������������������������������������������������������� 95
Findings Summaries�������������������������������������������������������������������������������������������������������������� 96
Individual Findings���������������������������������������������������������������������������������������������������������������� 98
Briefing������������������������������������������������������������������������������������������������������������������������������������� 101
The No-Results Assessment����������������������������������������������������������������������������������������������������� 102
Summary���������������������������������������������������������������������������������������������������������������������������������� 103

Chapter 8: Purple Teaming����������������������������������������������������������������������������������� 105


Challenges�������������������������������������������������������������������������������������������������������������������������������� 105
People Problems������������������������������������������������������������������������������������������������������������������ 105
Customer Needs������������������������������������������������������������������������������������������������������������������ 107
Types of Purple Teaming����������������������������������������������������������������������������������������������������������� 108
Reciprocal Awareness��������������������������������������������������������������������������������������������������������� 108
Unwitting Host��������������������������������������������������������������������������������������������������������������������� 109
Unwitting Attacker��������������������������������������������������������������������������������������������������������������� 109
Red-Handed Testing������������������������������������������������������������������������������������������������������������ 110
Catch and Release��������������������������������������������������������������������������������������������������������������� 112
The Helpful Hacker�������������������������������������������������������������������������������������������������������������� 113
Summary���������������������������������������������������������������������������������������������������������������������������������� 115

Chapter 9: Counter-APT Red Teaming������������������������������������������������������������������� 117


CAPTR Teaming������������������������������������������������������������������������������������������������������������������������� 118
Worst-case Risk Analysis and Scoping������������������������������������������������������������������������������� 119
Critical Initialization Perspective����������������������������������������������������������������������������������������� 119
Reverse Pivot Chaining�������������������������������������������������������������������������������������������������������� 120

viii
Table of Contents

Contrast������������������������������������������������������������������������������������������������������������������������������������ 121
Zero Day������������������������������������������������������������������������������������������������������������������������������ 121
Insider Threats��������������������������������������������������������������������������������������������������������������������� 123
Efficiency����������������������������������������������������������������������������������������������������������������������������� 124
Introduced Risk������������������������������������������������������������������������������������������������������������������� 126
Disadvantages��������������������������������������������������������������������������������������������������������������������� 126
Summary���������������������������������������������������������������������������������������������������������������������������������� 128

Chapter 10: Outcome-oriented Scoping��������������������������������������������������������������� 129


Worst-case Risk Assessment���������������������������������������������������������������������������������������������������� 129
The Right Stuff�������������������������������������������������������������������������������������������������������������������������� 130
Operational Personnel��������������������������������������������������������������������������������������������������������������� 131
Technical Personnel������������������������������������������������������������������������������������������������������������������ 131
Assessor Personnel������������������������������������������������������������������������������������������������������������� 132
Example Scope������������������������������������������������������������������������������������������������������������������������� 132
Centrality Analysis��������������������������������������������������������������������������������������������������������������� 134
Summary����������������������������������������������������������������������������������������������������������������������������� 138

Chapter 11: Initialization Perspectives����������������������������������������������������������������� 139


External Initialization Perspective��������������������������������������������������������������������������������������������� 140
DMZ Initialization Perspective��������������������������������������������������������������������������������������������������� 140
Internal Initialization Perspective���������������������������������������������������������������������������������������������� 141
Critical Initialization Perspective����������������������������������������������������������������������������������������������� 142
Effect on Risk Assessment�������������������������������������������������������������������������������������������������������� 143
Effect on Risk Assessment: External Perspective���������������������������������������������������������������� 144
Effect on Risk Assessment: DMZ Perspective��������������������������������������������������������������������� 145
Effect on Risk Assessment: Internal Perspective���������������������������������������������������������������� 146
Effect on Risk Assessment: Critical Perspective����������������������������������������������������������������� 147
Effect on Attack Surface Coverage������������������������������������������������������������������������������������������� 148
Attack Surface Coverage: External Perspective������������������������������������������������������������������ 148
Attack Surface Coverage: DMZ Perspective������������������������������������������������������������������������ 149
Attack Surface Coverage: Internal Perspective������������������������������������������������������������������� 150
Attack Surface Coverage: Critical Perspective�������������������������������������������������������������������� 151
ix
Table of Contents

Advantages and Disadvantages������������������������������������������������������������������������������������������������ 152


Introduction of Risk������������������������������������������������������������������������������������������������������������� 153
Summary���������������������������������������������������������������������������������������������������������������������������������� 155

Chapter 12: Reverse Red Teaming������������������������������������������������������������������������ 157


Reverse Pivot Chaining������������������������������������������������������������������������������������������������������������� 157
Local Assessment���������������������������������������������������������������������������������������������������������������� 157
Analysis of Local Intelligence���������������������������������������������������������������������������������������������� 159
Reverse Pivoting������������������������������������������������������������������������������������������������������������������ 161
CAPTR Outputs�������������������������������������������������������������������������������������������������������������������������� 162
Web of Reverse Risk Relationships������������������������������������������������������������������������������������� 162
Weighting Risk��������������������������������������������������������������������������������������������������������������������� 163
CAPTR Teaming Cost Benefit����������������������������������������������������������������������������������������������� 163
Summary���������������������������������������������������������������������������������������������������������������������������������� 169

Chapter 13: Evaluating Offensive Security Processes������������������������������������������ 171


Identifying Requirements for Defensible Evaluation����������������������������������������������������������������� 172
Controlled and Realistic Environment��������������������������������������������������������������������������������� 173
Defensible Security Assessments��������������������������������������������������������������������������������������� 173
Defensible Systems Administration������������������������������������������������������������������������������������� 174
Emulation of a Motivated and Sophisticated Attacker��������������������������������������������������������� 175
Measurable Results and Metrics����������������������������������������������������������������������������������������� 175
Evaluation Media����������������������������������������������������������������������������������������������������������������������� 176
Real Network with Real Attackers��������������������������������������������������������������������������������������� 176
Real Network with Simulated Attackers������������������������������������������������������������������������������ 177
Lab Network with Real Attackers���������������������������������������������������������������������������������������� 177
Lab Network with Simulated Attacker��������������������������������������������������������������������������������� 178
Summary���������������������������������������������������������������������������������������������������������������������������������� 179

Chapter 14: Experimentation�������������������������������������������������������������������������������� 181


Target Determination���������������������������������������������������������������������������������������������������������������� 181
Experiment Summary��������������������������������������������������������������������������������������������������������������� 182
Lab Design�������������������������������������������������������������������������������������������������������������������������������� 183

x
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
Table of Contents

Lab Network Operating Systems����������������������������������������������������������������������������������������� 183


Lab Network Layout������������������������������������������������������������������������������������������������������������ 183
Experiment Metrics������������������������������������������������������������������������������������������������������������� 184
Personnel Requirements����������������������������������������������������������������������������������������������������� 185
Experiment Schedule and Walkthrough������������������������������������������������������������������������������� 186
Addressing Defensibility Requirements������������������������������������������������������������������������������� 191
Summary���������������������������������������������������������������������������������������������������������������������������������� 193

Chapter 15: Validation������������������������������������������������������������������������������������������ 195


Results: Recommendation Phase���������������������������������������������������������������������������������������������� 195
Results: Campaign Phase��������������������������������������������������������������������������������������������������������� 196
Case Studies����������������������������������������������������������������������������������������������������������������������������� 200
Case Studies: Scenario 1����������������������������������������������������������������������������������������������������� 200
Case Studies: Scenario 2����������������������������������������������������������������������������������������������������� 202
Summary���������������������������������������������������������������������������������������������������������������������������������� 203

Index��������������������������������������������������������������������������������������������������������������������� 205

xi
About the Author
Dr. Jacob G. Oakley spent more than seven years in the
U.S. Marines and was one of the founding members of
the operational arm of Marine Corps Forces Cyberspace
Command at the National Security Agency (NSA), Ft. Meade,
leaving that unit as the senior Marine Corps operator and
a division technical lead. After his enlistment, Dr. Oakley
wrote and taught an advanced computer operations course
and eventually returned to mission support at Ft. Meade.
He later left government contracting to conduct threat
emulation and red teaming at a private company for commercial clients, serving as
principal penetration tester and director of penetration testing and cyber operations. He
currently works as a cyber subject matter expert for a government customer. Dr. Oakley
completed his doctorate in information technology at Towson University, researching
and developing offensive cybersecurity methods. He is the technical reviewer of the
book Cyber Operations, second edition, by Mike O’Leary.

xiii
About the Technical Reviewer
Michael Butler has nearly a decade of experience in cybersecurity, including training
and operational experience with US Army Cyber Command and the NSA at Ft Meade.
As a soldier, he received several medals for both his academic and operational success.
After his enlistment, he developed content for and taught an advanced cyber operations
course. He then joined a private cyber security company as the lead of penetration
testing, where he led and personally conducted offensive security operations in support
of contracts with both government and commercial entities. He currently works as the
vice president of offensive services at Stage 2 Security.

xv
Acknowledgments
I thank my beautiful wife and family for sacrificing their nights and weekends to let
me write this book, and for loving and supporting me through this and other nerdy
endeavors.
I thank my father for exemplifying hard work and for all he did to give me the best
chance to succeed in life.
To Mike O’Leary, who nudged me in the right direction, and Mike Butler, who
performed the technical review, this book was not possible without you.
To all you keyboard-wielding cyber warriors out there protecting freedom, I salute you.

xvii
Introduction
This book is intended as a resource for those who want to conduct professional red
teaming, as well as for those who use their services. The text is not intended to teach
you how to hack a computer or organization, but rather how to do it well and in a way
that results in better organization security. It takes a lot more than sweet hacking skills
to perform offensive security assessments. Whether you are looking to employ ethical
hackers, work with them, or are one, after reading this book you should understand what
is required to be successful at leveraging cyber threat emulation to mitigate risk.

xix
CHAPTER 1

Red Teams in Cyberspace


There exists a mountain of discourse in both digital and print form that discusses new
exploits or tools that aid in the compromise of information systems. These texts are
valuable implements to be used by offensive security practitioners in carrying out
their profession. There are certainly hallmark publications that contribute to the craft
of ethical hacking; however, many and most are timely in nature. In fact, much of the
reason for the largess of this body of work is that each day there is new code written
or tools developed and new vulnerabilities and exploits to leverage that can obsolete
previous works.
The dizzying speed of innovation in both offensive and defensive technologies is
tantamount to an arms race. Offensive tools may be outdated by improved security
posture provided by newer defensive tools, or may simply be outpaced by better and
more effective offensive ones. Weaponized vulnerabilities may be nullified by patching
or heuristic measures as well as potentially new exploits that are less volatile and more
likely to succeed.
Despite the great attention and efforts to modernize continually the tools of offensive
security and the body of knowledge detailing their use, scant attention has been paid to
the professional process itself. One hoping to become an offensive security professional
can find quickly dozens of books that tell readers how to hack this system or that with
code, exploits, and tools. Conversely, it is rather challenging to find literature on how
to use all those abilities and tools successfully to affect customer security posture in a
positive nature through professional processes.
The greatest challenges of any engagement are often not discovering and leveraging
vulnerabilities, but rather are those challenges manifested throughout the engagement
life cycle itself. These obstacles can be difficult customers, suspect rules of engagement,
or inaccurate scoping, to name a few. Offensive security techniques such as penetration
testing or red teaming represent some of the premiere tools used in securing information
systems. As such, it seemed extremely important to me that I contribute to the field of

1
© Jacob G. Oakley 2019
J. G. Oakley, Professional Red Teaming, https://doi.org/10.1007/978-1-4842-4309-1_1
Chapter 1 Red Teams in Cyberspace

offensive security with at anecdotal guidance and best practices involved in carrying
out professional offensive security engagements. This book serves as a resource to both
those wishing to enter the field or those already practicing.
For the purpose of this book, the term “red team” is used interchangeably and as an
umbrella word that refers to the offensive cybersecurity methodologies of red teaming
and penetration testing. Although many in this profession argue differences between
the two, all will benefit from the information provided herein. In this chapter I explain
provide what red teaming is, how it was tailored to cybersecurity, and the intention for
cyber red teaming, as well as its advantages and disadvantages.
Red team is a term with alleged ties to the Cold War, when a “Red” force was used
to represent the enemy in tests against organizations under attack from the Soviets. The
concept of simulating attacks to test defenses and responses is much older. Although the
term red team can refer to attacks of a military nature, this book focuses on the aspects of
integrating this attack simulation concept into the cyber realm. Unless stated explicitly,
red teaming refers to cyber red teaming—or offensive security engagements in general—
and not those of a kinetic military nature.

I ntentions
The intent of a cyber red team is to simulate attack against an organization to test
information systems and their related facilities. This is an overly broad generalization,
and the term “attack” is often inappropriately aggressive regarding the behavior of
both red teams and the malicious actors they mimic. In many cases, the purpose of
a malicious actor is to gain intelligence or steal information. Such goals are affected
negatively by aggressive attack actions, as the actor in these scenarios is likely intent
on staying unnoticed for as long as possible. Adversary emulation is perhaps the most
appropriate and accurate description of the activity of red teams. The intent of this
emulation is to improve understanding of capabilities and inadequacies in the defense,
detection, and responses regarding threat actors.
Adversary emulation by red teams comes in many forms and can be classified
broadly as a holistic compromise attempt, a specific compromise attempt, or assumed
compromise. A holistic compromise attempt is one in which the red team is going after
the entirety of the target organization’s attack surface, with the goal of compromising
as much as possible (Figure 1-1). Specific compromise attempts are those in which
a certain subset of the attack surface is prioritized for assessment and the rest of the

2
Chapter 1 Red Teams in Cyberspace

organization is off-limits. Assumed compromise is a red team engagement during


assessment begins from access granted to the assessors that is predicated by an assumed
successful actor infiltration. Each of these classes of red team engagements come with
their own challenges and complexities and subclasses, and each are appropriate in
different test scenarios.

Figure 1-1. Holistic compromise

Holistic compromise may be considered the truest form of adversary emulation


as the goal is complete compromise, and the point of origin for the assessors is likely
the Internet. In this situation, the organization gets the most realistic simulation to
test defenses: detection and response against. However, this type of assessment is
also the least efficient and is likely to provide incomplete results. If the assessment is
unable to compromise a given portion of the organization because of time limits or skill
deficiencies, the results of the engagement may offer a false sense of security.

3
Chapter 1 Red Teams in Cyberspace

Holistic compromise attempts can also be considered in several subclasses.


Although the entirety of the organization is the target, the avenues of attack delivery are
often specified. A completely holistic attack, for instance, is one in which any avenue is
considered appropriate. These avenues may be Internet connections, physical attempts
at breaking into the facility to enable cyberattacks, supply chain interdiction, or tapping
into communication pathways such as physical cables or wireless networks used by the
organization. Most of the time, a holistic red team attack is going to be conducted over a
subset of or one of these avenues. The most common holistic compromise engagement
by a red team is likely to target the entire organization using Internet-connected avenues
of approach only.
Specific compromise engagements offer a more efficient and tailored assessment
of an organization (Figure 1-2). They do not provide the potential big picture of the
security posture that can be accomplished via holistic compromise. However, specific
compromise is likely to lead to successful discovery—and, therefore, mitigation of—
vulnerabilities present in a subset of the organization. As long as this subset is comprised
of appropriately prioritized assets, it can be an extremely efficient and effective way to
conduct red teaming.
Different types of targets delineate the various subclasses of specific compromise
assessment. Specific compromise can be as narrow as a specific application running
on a specific device with a specified user access level. This type of testing is common in
rollouts of new and important application software within an organization. This attack
surface, although small, contains potentially some of the greatest risk an organization
may face. Specific compromise can also be a prioritized subset of users, systems, or
applications within the organization. The specific (or combination of ) security objects
and types on which the engagement focuses drives the assessment process.

4
Chapter 1 Red Teams in Cyberspace

Figure 1-2. Specific compromise

Assumed compromise engagements are ones that lean toward being more efficient
while giving a potentially less-realistic picture of an adversary. When performed and
scoped correctly, though, this type of red team engagement offers perhaps the best cost
benefit toward improving security posture.
Assumed compromise can be broken down into the types of access from which the
assessment begins and their location within an organization. If holistic and specific
compromise attempts leverage an e-mail-propagated malware campaign against an
organization, assumed compromise assessments simply begin the assessment from the
type of access such a campaign would enable if successful. In this scenario, assumed
compromise engagements save potentially weeks of time waiting for a user to open
malware in an e-mail, and bypasses the potential ethical and legal risks of such operations.
Whether the access given in assumed compromise engagements is a specific user access or
an entire machine added to an organization, it sacrifices some realism for efficiency.

5
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
Chapter 1 Red Teams in Cyberspace

The security training of employees with regard to malicious e-mail may not be tested
in assumed compromise. However, operating under the assumption that someone
will be fooled eventually allows for time to be spent discovering more dangerous and
mitigatable vulnerabilities than the ever-present vulnerability of human error.

Advantages
Red team engagements offer advantages over other methods and technologies in
improving the security posture of an organization. Red teams are the sharpest tool
in the metaphorical shed of information security implements. This is not to say
that it is the best, or the best in any given situation; it is simply the sharpest. As
mentioned earlier, red teaming can identify the capabilities and shortcomings of
an organization’s various security assets, which provides a unique assessment of
the preparedness of an organization to withstand the efforts of a malicious actor.
It is important to understand that this assessment is only as good as the ethical
hackers conducting it, and the assessors are as limited or empowered as the scope
and rules of engagement to which they are held. All things considered adequate to
the situation, red teaming provides a greater cost efficiency in improving security
posture when compared to addressing security concerns reactively—after they are
leveraged by malicious hackers.
Red teaming is considered a sharp tool because it is surgical in its application
and can be extremely dangerous in untrained or unethical hands. Conducted by a
competent team, it is the only proactive precompromise tool available. Where many
security technologies are built around the concept of reacting, red teaming allows an
organization to pursue securing and mitigating issues before compromise attempts
are initiated, not after. It may be argued that activities such as vulnerability scans and
good patch management are proactive as well. It is important to note, though, that
although not based on a reaction to a security event within an organization, both are
reactions to security events elsewhere that provide details for new vulnerabilities for
which to scan or fix. One other tool is considered by some to be proactive in nature—
threat hunting—which aims to identify indicators of compromise from actors already
within the organization that may or may not already be known aggressors. Unlike red
teaming, though, threat hunting is a postcompromise activity.

6
Chapter 1 Red Teams in Cyberspace

Evaluating Preparedness
The unique advantage of these proactive and precompromise attributes is that red
teaming provides an understanding of preparedness whereas other information
security tools are attempts to prepare better. Other security tools may better prepare
organizational defenses to thwart malicious actors, monitoring to detect them or aid
in the effectiveness or resilience of response. Red teaming identifies whether those
technologies are effective in increasing an organization’s preparedness. It also helps
identify wasted or redundant resources within the organization via missed detections,
or unnecessary duplication of security event detection and recording from different
technologies.

Evaluating Defenses
A successful red team campaign tests the many defensive facets of an organization
via interaction with systems, users, and applications, and identifies the ability of these
objects to impede the actions of the assessors. An example of a defensive system in an
organization is a firewall. This system is meant to stop unsolicited or malicious traffic
from traversing from one point to another. The red team tests the firewall in both direct
and indirect manners. Indirect testing of a defensive object such as a firewall results from
scanning and other reconnaissance activity with systems or services that were intended
to be stopped but were allowed through the firewall for one reason or another, such as
misconfiguration or a flaw in the system itself. In either case, the defensive preparedness
of the firewall system was tested without the assessor having specific knowledge that
their actions were supposed to be stopped. Directed testing is when the assessor
knowingly tries to get past a defensive mechanism. This type of attempt falls into the two
subcategories of subversive exploitation or direct exploitation.
Subversive exploitation is when the assessor knows of the device and attempts
to bypass its defensive capabilities by leveraging flaws specific to it or by probing for
misconfigurations that allow assessor to get past them. Direct exploitation is when
the assessor leverages a flaw or misconfiguration in the system to gain remote code
execution in an effort to change the defensive settings of the device to get past it.
Other types of defensive security objects may be evaluated in the same manner.
An operating system may have a defensive setting that prevents scheduled scripts from
executing with a certain privilege. A flaw in that setting’s implementation may allow a
red team to run the script at that privilege. Or, the red team may actively pursue a bypass

7
Chapter 1 Red Teams in Cyberspace

to the defensive mechanism by using an execution method the operating system cannot
address or by compromising the operating system in such a way that the setting may
simply be changed. This is also the case at the application level. Input validation for a
field in an application may be bypassed wittingly or unwittingly by an assessor, or the
assessor may gain administrative command of the application through other means and
remove the input validation to perform a needed action. These same principles of testing
the preparedness of defensive mechanisms within an organization are not limited to the
technological security objects. The personnel of the organization should be considered
defensive security objects and be included in red team assessments when appropriate.
With effective training and procedures, they are capable of providing defensive actions
toward stopping the opening of malicious e-mails or thwarting activities such as
“shoulder surfing” valuable information off a coworker’s screen or tailgating through a
badge-accessed door. Identifying shortcomings in the preparedness of personnel-based
defensive security can be one of the most valuable findings in an engagement.

Evaluating Monitoring
The ability to evaluate how an organization monitors for malicious activity also
contributes toward understanding an organization’s security preparedness. Monitoring
for malicious activity within an organization is a two-step process of detecting and
alerting. Red teaming provides the ability to address and understand where delinquency
is taking place in the monitoring apparatus. Delinquency within the monitoring
apparatus can be technological and/or procedural, and may involve both the actions
of devices and personnel. Determining whether monitoring is failing to detect or alert
adequately and whether that delinquency is based on a technology or procedural gap
are required to mitigate monitoring issues correctly.
Detection is the identification of a security event within an organization. Security
events can be as vastly different as a security camera snapshot of an individual entering
a building, to an e-mail leaving the network to a particular address. Different red team
engagements create different security events and thus evaluate different detection
mechanisms within an organization. Similar to defensive security objects, detection of
security events can be tested in the same subversive or direct nature.
Alerting is the second portion of the monitoring apparatus and it focuses on what
happens after a security event is detected. Alerting may be as negligible as discarding the
security event and logging nothing, or as involved as escalating the activity of defensive
capabilities based on an alert triggering follow-on activity. In addition to being subject

8
Chapter 1 Red Teams in Cyberspace

to the same testing as previously mentioned detection and defensive capacities, alerting
adds a new wrinkle to the evaluation process. Alerting can be evaluated using direct and
indirect testing; however, it can also involve a third type of purposeful testing. Subversive
exploitation allows an assessor to avoid a detected event from causing an appropriate
alert. Direct exploitation could enable the assessor to disable appropriate alerting.
The third type of purposeful testing is evidence exploitation. This is when an event
was detected successfully and the appropriate alert generated, but the integrity of the
alert or evidence of the alert is altered. In some cases, this involves direct exploitation
of the system to delete the alerts, whether they be system logs, pop-up windows, or
entire files. The reason this activity does not fall completely within direct or indirect
exploitation is that, in many cases, alerts are part of a greatly distributed monitoring
apparatus, and direct exploitation of a given system may not remove all iterations of the
alert evidence.
Consider a system that contains a certain number of logs before it begins to
overwrite the oldest entry, or a system that can handle logging only a certain number
of events at the same time. Either system is susceptible to evidence exploitation.
The assessor could create so much noise that it prevents a specific alert from being
created, or may overwrite the alert in log form because of the volume of entries created.
Evidence exploitation can also occur from activities that cause the alert to document
false information, such as spoofing a source address of malicious traffic. Evidence
exploitation can also involve creating a much more serious false-positive alert to detract
the monitoring apparatus procedurally from heeding alerts related to the actual assessor
purpose and activity.

Evaluating Responses
The last portion of preparedness evaluated by red teams is the response of the
organization to the assessment activity during the engagement. A response is carried
out to varying levels of completion based on the intent and scope of the test. In some
red team scenarios, if the activity of the assessors is detected, the first step of the security
staff is to check with the head of red team operations to find out whether the activity
is related to a real malicious threat or the red team itself. After being informed that the
red team is the perpetrator, the security staff may end its response and let the red team
carry out the rest of its engagement unhindered. This is the easiest implementation of
response analysis a red team engagement can provide, but it is also the least intensive.
The detection of the threat by the security staff, and the subsequent knowledge that

9
Chapter 1 Red Teams in Cyberspace

the red team was responsible does not result in an end-to-end understanding of the
organization’s response preparedness regarding that type of malicious threat.
The most complete scenario is when, upon being alerted to potentially malicious
activity, the security staff carries out its response as if the treat was real. In this instance,
the red team tries to outmaneuver and evade the activities of the security staff, which
includes both defensive efforts to remediate infected machines as well as attempts to
thwart threat hunting mechanisms. The risk here is that the presence of the red team can
introduce security concerns by distracting from legitimate malicious activity within the
network. The medium between immediate stop of response and complete uninformed
response to red team activities is the optimal evaluation of an organization and should
be tailored to the specific needs of the assessment.
Beyond evaluating an organization’s preparedness to respond to malicious threats,
the red team provides the advantage of aiding the organization improve its defenses.
Not only do red teams identify issues in defense, monitoring, and response, but also
they aid in remediation, mitigation, and hunting efforts. A proper red team assessment
identifies findings for the client organization and supplies potential remediation for
given vulnerabilities, misconfigurations, or procedural shortcomings.
Many offensive security professionals began their careers as systems engineers,
administrators, or developers in some capacity, and they apply their experience and the
hacker mind-set to providing remedial guidance. It is extremely useful for these experts
to discuss remediation with the implementing parties from the organization such as
administrators or security personnel. Oftentimes, their ideas at fixing a problem do not
consider the way an attacker thinks or acts. Involving the red team in determining remedial
action saves time and addresses security findings more efficiently. Furthermore, on
completion of remediation efforts, it is often useful to bring in red team assessors for a short
engagement to identify whether the changes have addressed previous findings satisfactorily.
Mitigation of threats can also benefit from input from the red team—whether in its
report or in discussions with security staff. It may be that, although remediation exists
for a particular finding, the risk it poses can be addressed more efficiently or cheaply by
other mitigating circumstances, such as changes in settings or configurations that nullify
the impact of a current vulnerability. The findings of the red team are invaluable to the
security staff in other ways. For example, a vulnerability scan may identify findings on
certain low-cost machines used by an organization, but management may not allow
the security staff to address those findings. As a result of the low cost of the vulnerable
machines, the organization may decide to replace or reformatting these same devices

10
Random documents with unrelated
content Scribd suggests to you:
judgment of values (such as it is) gleaned in the college of hard
knocks and nine danged slaving years of schooling in that institution,
slaving and heart-rupture. But in beginning, books on writing and
even courses certainly have their value. I've had the correspondence
drill—with editors who've stood me up and knocked me down. But
that's rough on the editors, if everybody does it.

Barry Scobee: Before I was twenty, or about that time, I took a


course in short-story writing and newspaper also. Don't remember
what school of correspondence. I may have acquired a few basic
principles; it probably did me some good. I never had classroom
instruction in writing. I have studied a dozen books on the subject of
fiction writing. At first, for a year or two, I struggled along without
even knowing there was such a thing as books on the subject, or
without ever talking to a single person in the world who knew the
first thing about writing. Then The Editor began to help me, and
various books, especially on plot and, I think, Price on the Drama.
These were a tremendous help to me in the preliminary stages. A
fuller answer will be found under VII.

R. T. M. Scott: I have never taken a course of any kind in fiction


writing. I have breezed through a few books on short stories but I
have never studied them. Most of the stories which I have sold have
violated the rules laid down in these books. I am still in the
elementary stage, however, and perhaps, some day, I shall be able
to stick to the rules and still sell the stories.

Robert Simpson: I have had no classroom or correspondence


course. Neither, as it happens, have I ever read any books on writing
fiction. This was more a matter of chance than anything else. I've
learned most of what I know of the technique of story writing from
writing "bad ones" and finding out why they were bad; from the
good advice of an editor or two, and from simple, cold-blooded
analysis of my own and other men's work. This is a long and tedious
process, but it has the advantage of being thorough if one is built for
it. If I may say so, the method of study is largely up to the make-up
of the individual, but, in agreement with a certain advertisement,
"there are no short-cuts to quality."

Arthur D. Howden Smith: No.

Theodore Seixas Solomons: I never had a course. I have


studied, or rather carefully read, one or two books on writing, and
numerous articles. I think that the idea of unity has been the main
derivative to me. The rest I usually saw to be true enough, almost
axiomatically, from general considerations of art, but I do not think
they helped—probably more because I did not actually study such
writings than because they are incapable of lending real help. I do
not see how a proper study of them in connection with exercise in
writing can fail to be beneficial. Yet such works, for the most part,
are analyses of the reasons for things which must be understood
instinctively and by experience, and then acquired, before the
reasons make such appeal.

Raymond S. Spears: No literary course except reading,


deliberately undertaken for certain purpose, as reading Ruskin to
learn how to describe.

I've read and tried to profit by practical books, handbooks, books


on authorship, writers' biographies, etc. But I find my own view-
point and methods are nowhere described or much helped by
experience of others.

Norman Springer: No. I once tried a university extension course


in play writing. It was silly. Of course, I read all the books I could
find on the subject of story writing. They didn't help much. They told
me something about the mechanics of a story (though even this
information was usually buried beneath mountains of pompous
academic phraseology), but they never gave me a clue to the
solution of the more important question that worries the beginner
—"How can I infuse spirit into the story; how can I make it live?"
This questionnaire is really the first attempt I have encountered to
get behind the mechanics.
Being of the "self-raised" variety of writer, I've had some
experience with the "How To Write a Story" books, and I confess
they harmed rather than helped me. All those I opened merely told
me in technical, often almost unintelligible language just what my
story sense was telling me in simple language. I didn't find a single
book that took me behind the mechanics of the story.

That is where the beginner is always trying to get to. About the
hardest thing he has to learn is how to weigh, select and subdue
thoughts. Memorizing all the rules and learning all of O. Henry's
tricks by heart won't help him. But access to information such as
your third query will bring out will help him. So will the news that he
must discipline his imagination and make it obedient. Think how we
run wild and waste ourselves in the beginning.

Julian Street: No courses. I've read, written and in my early


stages been criticized by abler men—men like Tarkington and Harry
Leon Wilson. I think it well for the absolute greenhorn to read and
learn everything he can about the art, but he must have the power
to discriminate between good and bad advice; and he must know
whether he himself wishes to aim high or aim low—whether he
wishes to run the risk of trying to produce something that may
possibly live, always facing the great danger of failing in that aim, or
whether he wishes to write popular truck. That will be determined
ultimately, I think, by the character and tastes of the aspirant, but
the sooner he acquires a definite aim, the better for him.

T. S. Stribling: Have never had classroom or correspondence


course in fiction. I did pay a dollar once to have a story criticized.
Afterward I wrote to the man and offered him his criticism back if he
would return my dollar, but he wouldn't do it.

Booth Tarkington: No course or books on writing fiction, ever.

W. C. Tuttle: I have never had any instructions on story writing,


beyond the kindly help of a certain editor. Once upon a time I
bought some books on short-story writing. After reading them I
ached from the reaction. I understood that I was all wrong. But
there seemed to be no help for it; so I hid the books and went back
to work.

Lucille Van Slyke: Very superficial daily theme course in college


my freshman year. Very bad for me, I think, because I did it easily,
got good marks and took no pains whatever. Took me years to live
that down! I have read and continue to read every book on fiction
writing that I can find. In the elementary stages they helped a very
little—oh, very little. Not their fault, but mine, because I did not see
how to apply them to my case. Beyond the elementary stage I found
that Polti's Thirty Six Dramatic Situations helped me to straighten out
the plot difficulty I already mentioned. ——'s Short Story Writing did
me good this way—I disagreed with it so violently that it cleared my
ideas on many points—but I found myself singing, "Now mother has
a sausage machine and to-day she said to me, Tom, Tom, hurry back
home, there'll be sausages for your tea—"

Atreus von Schrader: I put in the winter of 1913 working with


Walter B. Pitkin at Columbia; I had written, without success, for
some time. His genius, for that is what it amounts to, gave me a
foundation and understanding that have been invaluable. General
formulas and methods can be used to great advantage; to the
greatest advantage when practise has made their use instinctive.

T. Von Ziekursch: Never had anything in that line. Was


introduced to a teacher of how to write fiction once and he bored
me.

Henry Kitchell Webster: I've never had a classroom course or


a correspondence course on writing fiction. I have read books on it,
some of which interested me because I agreed with the writers and
some of which interested me because I disagreed with them
altogether. I am not conscious that the first sort ever caused me to
cry out, "Eureka!" though I may have decided, over an item in the
second, "This is what I never do."
G. A. Wells: I have had no classroom course in story writing and
deplore that fact a great deal. Correspondence courses are valuable
to this extent—they urge one to work and study by the reflection
that he will have thrown away his money if he doesn't. The same
results may be obtained by investing in a few good books on the
subject of writing. I would strongly advise the beginner to let the
correspondence schools alone. I have had much experience with
them. None of them can possibly do what they so boldly assert in
their literature. Not so long ago I paid ninety dollars cash for a
course in picture play writing. For that sum I received two thin books
of instruction, three detailed synopses of plays produced (all of them
rotten!) and twelve pamphlets of lectures. I learned nothing that I
had not previously learned from text-books got from the public
library. Never again: (Right hand up and left on heart.)

It is of interest that most of these correspondence schools can't


cite students who have been successful. One school cited me ——
——. Her stories appear in the —— but nowhere else that I have
ever noticed. I do not call that success. That is the only school of
correspondence of about a dozen I have investigated that can cite a
student who has had anything published in a reliable magazine, and
I think that unless such a school can show such graduates it is
scarcely worth bothering about.

I attach great importance to books on the art of fiction writing.


They have been of great value to me. The chief fault I find with
these books is that they refer the student for examples to stories
that are not easily available to a great many people. Too, they incline
too much toward citation of the classics, such as Poe, Dickens,
Thackeray and others. The student should have for his examples
Kipling, O. Henry, London, Melville Post and the modern writers.
Current magazine fiction is as a rule out of the question.

But after all the only way to learn to write fiction is to write
fiction. I am of that number who contend that fiction writing can't be
taught. It must be learned. But first of all one must have talent for
it. That talent can't be acquired, though, given that, it can be
cultivated. If one hasn't a talent for writing fiction all the teaching of
all the teachers won't make one a writer of fiction. Education alone
will not suffice, though I have had people say to me, "He should be
able to write stories, he is so highly educated." It is to laugh. I say
that the man with the gift or knack for writing fiction will turn out a
writer in the end if he applies himself, regardless of schools and
books teaching the method and art.

In this town is a woman, very highly educated, who studied two


years in the classes of Dr. —— at Columbia. She has tried time and
again to sell stories she has written, but up to date without success.
From time to time I have had people come to me for information on
the business of writing. The first thing I ask for is some of their stuff.
Not an editor in the country would print such truck. This is rather
unseemly in one who himself turns out a great deal of worthless
truck, but I can see the faults of others better than my own. I can't
see my own at all.

The best text books on the subject are to be found on the news-
stands—Adventure, American, Saturday Evening Post, Harper's, etc.
These should come first because they show the finished product of
people who are actually succeeding at what the student aspires to
do. It is the whole machine that can be taken down to learn how it
was assembled in the first place.

Text-books, I think, are valuable to the student in proportion to


their relationship to him. Are they really prepared for the student, or
written because the author had certain views he wished to publish
about a certain subject? I think they should suggest rather than
dictate. The author should say, "Let's try this and see what
happens," and not "Do this or you are damned." In short, I have
found most text-books far too dictatorial.

Detailed laws and rules should be avoided. The student should


get the general impression, but be left free to modify his
performances to suit existing needs or to satisfy his individual point
of view. Of course there are certain laws of story writing that
preclude dispute by their very obviousness. I don't pay any more
attention to the rules of story writing than I do to a fly on a
Chinaman's nose in Canton.

It therefore galls me to have a text-book author tell me that I


must do thus and so. All I want him to do is to give me the platform
to stand on. I'll make and speak my own piece in my own way. If he
is going to write and make my speech I'll step down.

William Wells: No.

Ben Ames Williams: I've never taken any "course" in story


writing. I once read a book on it. It helped me not at all. The books
that have helped me most in the technical work of writing are books
of criticism. Any of the standard works.

Honore Willsie: Neither.

H. C. Witwer: I have never had any course of any kind in short


story writing, or, I should say, in writing. Nor have I read or studied
books on the art, gift, trade, profession, crime, or whatever it may
be. I have about me at all times as working tools, a dictionary,
Roget's Thesaurus, Shakespeare, Encylopedia Brittanica, Bartlett's
Familiar Quotations. Find all invaluable.

William Almon Wolff: No courses at all. The best book I know


is not about narrative fiction at all—it's William Archer's Play Making.
That has been and remains, invaluable to me. I think, incidentally,
that it's helpful to think of a story in "scenes."

Edgar Young: No classroom course. Wrote several stories before


I ever knew there was such a thing as a book on the subject. Must
have learned something by reading current magazines but was
where I couldn't get them for years when in South America. Since
being here in New York have read many of the books concerning
writing.

Summary
Of 113 answering, 55 have used neither class, course or book, 56
have tried one or more of these, and 2, saying only that they took
no course, are probably to be included with those having tried none
of the three.

Of the 56 who have tried one or more of the three, 40 give


definite reply as to whether, in the elementary stages, they derived
benefit, as follows: much benefit, 6; benefit, 4; some benefit, 5;
total 15. No benefit, 11; some harm, 1; harm, 2; much harm, 1;
total, 15. There are 10 who state they derived "little benefit" and
this presumably is to be taken as a negative answer. In any case, out
of 40 there are 25 who derived little or no benefit in the elementary
stages of learning their art, and 4 of the 25 state that they derived
actual harm instead of benefit.

Add the fact that if the remaining 16 of the 56 who have used
one or more of the three derived any benefit they did not take the
trouble to say so, which would indicate that, if there were any
benefit at all, it was not a considerable one. Add the additional
damning fact that of the 113 answering the general question 55
(probably 57) have not found it necessary to success to use any of
the three. Out of 113 writers only 15 claim any benefit, in even the
elementary stages, from classes, courses or books purporting to
teach the writing of fiction! Ninety-eight against fifteen!

That testimony fills me with joy. Yes, I've written a book myself
on fiction writing, but it had not been published when this
questionnaire was answered, it was written largely as an earnest
protest against present methods of teaching fiction and a chief
purpose of this questionnaire and of this present book giving its
results was to get proof in facts from a final source that present
teaching methods, as practised in all but a tiny handful of cases, are
badly in need of revolutionary revision.

My feeling in the matter was not due to theorizing. For twenty


years my life-business has been the handling of the results of those
methods as they pour in in the form of submitted manuscripts across
the editorial desk. For twenty years it has been my business to deal
with the authors and would-be authors who write those manuscripts,
to try to find their strong points and their weak points and to ferret
out the causes and the remedies. They have worked with me to this
end and have talked frankly. Even if there had been only the
manuscripts themselves to look at, it would have been evident
enough that there was some general cause, other than the writers'
inabilities, for the wide-spread and persistent weaknesses that were
making most of those manuscripts unavailable or at least far below
the standards possible to their authors.

If only half of our 113 successful writers have been touched by


these methods, remember that the successful writers are only some
ten per cent. of those who write and that the remaining ninety per
cent. are more prone to turn to formal books and teaching. The man
or woman with pronounced native ability is more likely to hew his
own way or go to first courses, particularly after examining the
outside helps available. Do not forget, too, that these prevalent
weaknesses in manuscripts are due not only to positive faults in
teaching methods, but to the lack of really helpful, constructive
advice and guiding.

A chief bad result of these teaching methods will be taken up in


our consideration of the question on the value of technique. To take
up all the bad results in detail would fill more space than the nature
of this volume warrants its devoting to the subject.

While only 15 derived benefit from these methods in the


elementary stages, still fewer—10—found benefit in the more
advanced stages. One might expect the falling off to be still more
pronounced until one remembers that these books and courses,
whatever their general faults, do cover a vast number of specific
points and that in the discussion of these points a writer who has
already built his own foundations can often find suggestion and
information of decided value to him without suffering from the
general faults. None of our answerers reports harm, in advanced
stages, from these methods and none reports failure to get benefit
in the advanced stages specifically, though many simply give a "no"
to the general question of benefit.

Considering class, course and book separately, of 13 reporting


definitely on class experience 7 state benefit of varying degree in
elementary stages, though one of these expresses doubt; 1, "little";
4, none, 1 of these reporting harm. Only one reports on advanced
stages—no benefit.

On correspondence courses, 8 state experience; 3, benefit; 1,


probably some; 1, "little"; 3, none. This as to elementary stages. On
advanced stages only 1 reports—some benefit.

On books 40 report. On elementary stages, 35; benefit, 14;


possibly, 1; little, 10; no benefit, 7; harm, 3. On advanced stages,
10, including some of the 35 reporting also on elementary stages;
benefit, 3; little, 3; no benefit, 4.

Tabulating negatively, 78 of the 113 specifically report no class


experience; 73 no correspondence course; 47 no book. As already
stated, 55—or 57—make a blanket report of using none of the three.

Unfortunately the questionnaire did not include a specific question


on benefit derived from magazines devoted to writers and their art.
In spite of this omission three or four voluntarily reported benefit
therefrom in elementary stages and no one volunteered to report
harm or lack of benefit. If reports had been asked for on these
magazines, I believe it would have been far more favorable than on
books, classes or courses.
These magazines use many articles by writers telling their own
experiences, difficulties, solutions. The people best equipped to
teach others are those who have themselves learned how—who
have accomplished, not merely theorized. Each is handicapped as a
teacher by the facts that his methods and principles are naturally
those he has found best adapted to his own individual case, that the
needs of no two individuals are exactly alike and that his methods
may be for some others altogether useless or even harmful. But in
these magazines where many writers are heard from these very
differences appear and the intelligent reader can pick and choose
with profit. Most of all, he learns that no one rule applies to all
writers alike.

QUESTION VI

How much of your craft have you


learned from reading current
authors? The classics?

Answers

Bill Adams: I have to admit that I know no current authors—I


never read a magazine story, and exceedingly seldom a book. Used
to read a great deal twenty to twenty-five years ago.

Samuel Hopkins Adams: How can one tell? I might guess at


half and half.

Paul L. Anderson: Mostly the classics: that's one reason I


haven't sold more stuff—too old-fashioned.
William Ashley Anderson: Not much—if any—from current
writers, with a few isolated examples—except for those who have
already become standard: Kipling, and authors of similar standing in
various countries. I believe strongly in the classics and regret very
much that they were not very deeply ingrained in me when I was at
school, as they were fundamental in literature. I believe just as
strongly in the standard works of literature. But I believe a
professional author wastes time reading current authors, unless the
work has distinct and special merit and is brought to his attention.

H. C. Bailey: I should put the classics (using the word in the


widest sense, say from Homer and the Bible to Maupassant and
Mark Twain) first. Good models are of any time and all time. From
good models living and dead and what I know of their methods I
learned any craftsmanship I have.

Edwin Balmer: When I began writing I considered Kipling and


Richard Harding Davis and Sophocles about the best writers in the
world. I had taken a great deal of Greek in college and took an M. A.
at Harvard in Greek and when I finished I could read classical Greek
almost as readily as English. I remember consciously admiring and
trying to put into my writing some of the sense of quantity which the
Greeks used. The first story I ever sold to a magazine was certainly
strongly influenced in its wording by Greek models. I still think Greek
literature second to none.

Ralph Henry Barbour: Who knows the answer to this question?


Not I!

Frederick Orin Bartlett: I have absorbed, rather than learned,


a great deal from current authors—especially English authors. The
classics I feel to be an invaluable background—a background that
too many American authors lack.

Nalbro Bartley: From the classics, I think I have learned much—


also from the daily newspapers but not from current authors.
Konrad Bercovici: Reading current authors I have learned what
not to do. I have only learned something about writing from the
Bible, a little more from Balzac, and if writing were a trade and I
were a young man, I should apprentice myself now to Anatole
France.

Ferdinand Berthoud: None. Don't read current authors. Have


never read the classics. I wrote my first story for my own
amusement and without knowing that it was a story, and without
any single thought of how other people wrote.

H. H. Birney, Jr.: Can't honestly say I've gained a great deal


from either. Try to read current authors to learn, if possible, the
secret of just how they "put it over." Have read most of the "classics"
and have doubtless, though unconsciously, benefitted from them.

Farnham Bishop: I've read everything from Diamond Dick to


Marcus Aurelius, beginning early and sitting up late, mixing my
reading till now it is utterly hopeless for me to disentangle the
results and reactions. There are huge gaps in it, and some rather
odd specializations. How much have I learned from Homer and
Vergil, and how much from Kipling and Conan Doyle? Blessed if I
know the exact proportions! But I think that varying your reading is
a safeguard against writing pseudo-Kiplingese and diluted O. Henry.

Algernon Blackwood: None. I read little fiction. As a boy I


missed the classics, and have only made up a little of this leeway
since. I never read a story without feeling how completely otherwise
my own treatment of his idea would have been—probably, that is,
how much better his treatment is than mine.

Max Bonter: Whatever I may have learned from contemporaries


has been acquired unconsciously and without design.

I studied Milton intensively with the idea of letting some of his


wonderful construction sink into me—particularly the first two books
of Paradise Lost. Have never regretted the time so spent.
Katharine Holland Brown: Hard to answer. Reared on the
classics,—by the simple device of keeping them on the top shelves,
with the grave command, "Not to be read till you grow up." Will
admit to an extreme preference for the most recent of the current
fiction.

F. R. Buckley: Hard to say how much I got from classics and so


on. A great deal. Rough guess—should say Rudyard Kipling and an
English author named Neil Lyons were my best teachers.

Prosper Buranelli: Reading current literature does nothing but


harm. Read Sophocles.

Thompson Burtis: I should say that all the superficialities of the


craft I have learned from current authors. Fundamentals, such as
vocabulary and characterization, I believe I learned from the
classics. As a young and green writer, I believe I am picking up tricks
of the trade constantly from my contemporaries.

George M. A. Cain: How much I owe to reading current or


classic authors I have not the slightest idea. I have not consciously
studied the work in half a dozen stories. And I have not, within my
memory, read a story without a certain critical attitude which
unconsciously noted its structural features. For all the readiness with
which my mind conjures settings for what I read, I don't think I have
ever read anything without constant consciousness of the man who
wrote it, or ever forgotten to watch the writing. Though I was late in
putting my efforts to actual use, my desire to write fiction goes back
of my memory. At twelve years of age I was habitually putting into
words every emotion and situation and scene I saw, experienced or
felt. I shall never know in this world to what degree that has reacted
upon me to make me everlastingly the actor of what I imagined I
should be rather than the natural doer of what I was. Perhaps I
should put it that the expression of things has always assumed
entirely undue importance. In that attitude, I have unconsciously
studied everything I have read. And here I might mention that, for
me, the greatest difficulty of the relation between reading and
writing is the avoidance of unconscious imitation. I can not read ten
pages of Addison or Irving, still less of Gibbon or Macaulay, without
having my writing run into sonorous cadences that frequently are as
out of place as a Gregorian hymn-tune for a coon-song's words.
Writers of striking idiosyncrasy, like O. Henry, or Samuel Blythe in his
humorous sketches, Wodehouse, or Harry Leon Wilson, or anything
in slang or dialect, are completely fatal to the straightaway putting of
what I want to say which is my only notion of a style of my own.

Robert V. Carr: I might imagine some writer helped me, when


he merely salved my prejudice or put into words certain racial
memories that harmonized with mine.

George L. Catton: Consciously, little. Subconsciously, it is hard


to say; perhaps all of it. From the classics, ancient classics, none.
Never had the patience to wade through a lot of explanatory matter
and minute detail I found in the so-called classics—to get at a fact or
truth that could have been put in one sentence to stand out in the
clear. Classics? Not to my way of thinking! I don't have to be told
one thing twenty different ways to get the guts of it. Classics? old-
fashioned expositions of old-fashioned views and ideas, most of
which have been exploded long ago.

Robert W. Chambers: Current authors, nothing. Classics, much.

Roy P. Churchill: Both are necessary. The classics for


vocabulary. People and current writers for modern styles. One is as
valuable as the other to me.

Carl Clausen: A great deal.

Courtney Ryley Cooper: None from current authors. A lot from


the classics, all devoured by the time I was sixteen. I had read
everything from Dickens to Gautier by that time.
Arthur Crabb: I think I have learned very little from reading
current authors, if you mean by current authors the average writer
for the popular magazines. I used to read a great many stories, but
of late years have practically stopped doing it. I have read and am
reading constantly classics, if by that you mean great books written
in the last three or four hundred years. I think that one of the
reasons I am not more successful is that I try to write, as I see it,
along the lines of the great novelists and haven't the goods. If I
aimed at a less pretentious mark I would probably do a great deal
better.

Mary Stewart Cutting: I have read everything classic and


current that I could lay my hands on from the age of six.

Elmer Davis: Haven't learned it.

William Harper Dean: My work is influenced greatly from


reading current authors. Little through the classics, unless you
include Dickens among the latter. From him I have absorbed an
invaluable conception of what the true meaning of atmosphere is,
the weight of the short sentence and the power of the long one. But
I am inspired in many ways when I read Hall Caine or Hutchinson or
Hamsun or Conrad. I aspire to the easy, forceful style of Hutchinson,
I want to be able to handle my characters with that charming grace
which characterizes Conrad.

Harris Dickson: I read spasmodically current fiction, browse


among the classics and naturally pick up ideas. These pick-ups are
not, as a rule, conscious. Things just soak in, as water soaks into the
ground and a spring comes out somewhere else.

Captain Dingle: Impossible for me to say. If I have learned from


anybody it has been unconsciously. Had I taken a master, I suspect I
might have got farther.

Louis Dodge: I get enthusiasm from reading current authors and


the classics; but I try to find my own stories among people and tell
them in my own way. To me a good book is like a preacher (the
"ungracious pastor" of Shakespeare): it says to me "be good"—but it
doesn't show me how.

J. Allan Dunn: I don't know. Don't believe much until I had


myself acquired a certain amount of technique and could recognize
the cleverness of others.

Phyllis Duganne: I've learned a great deal from reading current


authors. It's interesting to read a story and like it, and then pick it to
pieces to see how its writer made me feel as he did, how he made
scenes so vivid and people so real, how he took an ancient plot and
made it worth reading even when I knew after the first paragraph
what the end would be. And it's instructive. And I suppose the same
thing holds more or less in the classics. I'm much more interested in
the modern school, so far as my own work is concerned.

Walter A. Dyer: I have read studiously both modern authors and


the classics, and have got more inspiration from the latter.

Walter Richard Eaton: Nobody can say for me, I'd answer. One
learns much of his "craft" (in both senses!) from a study of his
market, the magazines. That is, he adapts the size (length) of his
story, etc., to the editorial demands.

E. O. Foster: I have been an "omnivorous reader" all my life, the


dictionary and encyclopedia being my favorite works.

Arthur O. Friel: Nearly all from current writers.

J. U. Giesy: All of it except what I have worked out myself. Have


been a somewhat omnivorous reader all my life.

George Gilbert: No author can answer that, for he does not


know himself.

Kenneth Gilbert: Current authors have been very helpful;


classics scarcely at all.
Holworthy Hall: If I have learned anything at all about any
"craft," I have learned it from Leonard Merrick, Mary Rinehart and
Theophile Gautier.

Richard Matthews Hallet: I've probably learned a lot from


reading current authors. Couldn't quite say how or what; and people
who read me may doubt the above proposition. The danger of
watching the tricks of a contemporary consists in liability to ape him
in your own stuff, especially if he is a powerful contemporary. We
have with us all the time young shadow-forms of Kipling, O. Henry,
etc. I dogged Conrad nearly to my undoing. A man with some
writing instinct can pick up the mannerisms of another writer as
easily as butter absorbs a taint. The danger from reading the classics
is less, and such reading is probably worth more to a man.

William H. Hamby: Not consciously from either: although I


know I must have benefited from both, especially modern writers.

A. Judson Hanna: I can not say that reading the classics has
helped me to write a story which will sell to an American magazine. I
have received much valuable help by reading current authors. For
instance, a story appearing in —— has passed the test. By studying
it I get an idea of what makes a short story. However, the most help
I have ever received I gained from criticisms, by magazine editors,
of rejected stories.

Joseph Mills Hanson: It seems to me difficult to estimate how


much of one's craftmanship in writing has been gained from reading
the work of others and how much from his own impelling instincts
and impulses. If he feels the necessity of expressing himself in
writing, his natural abilities and limitations in narration probably
govern his craftsmanship in greater degree than any reading. I
believe, however, that my own style has been influenced at different
times by different writers who aroused my admiration, both current
authors and classic ones. Such influence I think is detrimental to
one's individual style and should be guarded against. Even a poor
individual style is better than a poor imitation of another's style. But
the general effect of reading good authors can not but be elevating
and improving to one's own imagination and narrative ability.

E. E. Harriman: Have developed more disgust than delight in


reading current authors, because I find so much that is rotten-
incorrect-ridiculous and out of reason in them. For instance —— ——
telling us that when on skiis, crossing snow five feet deep, he found
a bird sitting on its eggs in a nest. And —— —— giving a grizzly bear
a round track.

The classics help me most. For clearness in composition—


Shakespeare and the Bible. Drummond's poems aid me. Being
foolish enough to do some versifying myself helps me in prose
writing.

Nevil G. Henshaw: I've got a lot from both, possibly more from
current authors.

Joseph Hergesheimer: All my early and important reading was


in the English lyrical poets.

Robert Hichens: I have learned, I think, a great deal by reading


certain authors, but not current authors. A book that has helped me
is Tolstoy's Author's Art.

R. de S. Horn: After the beginner has got the fundamentals of


writing straight in his mind the greatest assistance he can get
anywhere is from reading current authors and the classics. The
classics show him the art at its highest form: the models of
technique. The current authors show him the popular style and the
trend of the times. Neither one should be studied to the exclusion of
the other. A fifty-fifty ration is best, I think.

Clyde B. Hough: "How much of your craft have you learned


from reading current authors?" Absolutely all that I know. "From the
classics?" None. I don't strive to write classics, so why study them?
The classics of today, most of them, were not considered classics
when they were written. And the good human stories of to-day will
be the classics of to-morrow.

Emerson Hough: I hope I never imitated any current author.


Could not any classic.

A. S. M. Hutchinson: I don't know; but I think wide reading


(not necessarily, or even at all, fiction) is necessary to good writing.

Inez Haynes Irwin: I do not think I have gained anything


technically from reading the classics—with the exception of the
Elizabethan dramatists. And I can not say exactly that they helped
me technically—they delighted, thrilled and inspired me. I suppose,
to be perfectly fair, I ought to say that the Russian novelists, who
also dominated my girlhood, gave me my taste for realism. I have
learned more than I can tell from the work of my contemporaries.
When I was at Radcliffe College, following I think the example of
Stevenson, my Harvard instructor had the class write themes in
imitation of the Bible, Dryden, Walton, Addison, Johnson, Goldsmith,
etc., etc. I believe now it would have had infinitely more value if we
had been studying the short stories which were appearing in
McClure's Magazine at that period—a great period in American short-
story writing. I can not overestimate how much I have gained from
the short fiction of such writers as O'Henry, Percival Gibbons, Edna
Ferber, Fanny Hurst, Joseph Hergesheimer, Willa Cather, and of
course Henry James and Joseph Conrad.

Will Irwin: I suppose that I have learned a great deal of my


craft from both current authors and the classics. How much, it would
be hard to say. One absorbs such training unconsciously.

Charles Tenney Jackson: As to "current authors and the


classics" I read the former very little; and the latter seem to be part
of a past curiosity which left me with a certain vague, large respect
much as you would give to a ninth-century cathedral or a tapestry. I
reckon they did their durndest in their time, but I could wish that
some Athenian philosopher had stopped a moment to record what
he ate for breakfast, how the family wash was handled, what he
shaved with ... all about the life about him, in fact; the picture, the
color, the motives of folk about him. My imagination turns from the
temples to what possibly housed the cobbler who mended Caesar's
sandals, and where his children played. The guesses of the classic
writers as to the riddle of life are not of interest, for I have my own;
but I would like to know the flavor of the common life about them.

Frederick J. Jackson: I can't say how much technique I have


learned from reading current authors. The classics is an easier
question. The answer is about nothing, net, plus war tax.

Mary Johnston: I do not know.

John Joseph: Have been a tremendous reader and student of


both current and classic literature, and if I know anything at all
about writing I must have picked it up in this manner.

Lloyd Kohler: I think that it's safe to say that I've learned a
good half of my craft from reading and studying current authors and
the classics. There is a danger in this, especially if one follows a
certain current author too closely. It's best to read them all. As to
the classics, there is little danger of ever getting too much of them—
I'd venture that the average of us don't get enough of the classics. I
know that I don't.

Harold Lamb: Current authors, no. I read them very little as a


boy, and hardly at all as an author. The classics, yes, if you let me
name my own classics.

They were my friends. They still are my friends. I refer to the


coterie gathered together in the libraries of my grandfather and
uncle. Messrs. Gustave Doré, Æsop, the Nibelungs, Roland and
Oliver—the Song, you know—Pierrot, Prince of Tatary, The Apostles,
Dante in Purgatory, Plato, Rider Haggard, Napoleon, Don Quixote de
la Mancha (but Sancho Panza was a better chum). A host of others.
But these had the finest pictures—an artist's library, and a poet's. So
they were my earliest friends. I had others. Especially Francois
Villon, Catullus, Henry, Babur, Li Po, Macdonald, Robert Burns.

Sinclair Lewis: I don't know.

Hapsburg Liebe: Since I never had any schooling, I guess I


learned the little I know from reading, both modern authors and
classics—I haven't read enough of the classics; they seem wordy to
me. The average magazine, I guess, wouldn't buy or publish half the
classics now if they were new.

Romaine H. Lowdermilk: Can't say. More from current authors,


anyway.

Eugene P. Lyle, Jr.: Can't say, but doubtless I've learned a great
deal from reading current authors (for technique in current fiction)
and from the classics for the basic fundamentals.

Rose Macaulay: A great deal.

Crittenden Marriott: Mighty little.

Homer I. McEldowney: Thus far, I should say that current


authors have had more influence upon my writing than have the
classics, due to the fact that I read rather for amusement than for
any lasting good which I might derive.

Ray McGillivray: In so far as any one must be blamed, I believe


the classics—if you'll stretch the definition to include also Nick Carter,
Old Sleuth and the Dalton Boys—are responsible. I set the onus of
responsibility at the door of my own general cussedness, the trait
which makes me lay off any labor any time a bunch of good pals
takes a notion to drift from here to helangon, taking as equipment a
deck of cards, a few well-hidden quarts, a couple of rifles and
shotguns, a camera and some merry songs of the road as cargo for
the old gas-buggy. Such a guy must write; it's about the only excuse
he's got to live—except the living, which is joy.

Helen Topping Miller: I read all the classics when I was very
young. How much of my ability to write I owe to those early
associations I am not able to judge. Of late I have naturally studied
the craft of successful current authors. From modern novels I do not
feel that I gain anything; indeed it is very rarely that I am able to
finish a book without being dismally bored. On the other hand,
scientific and historical works, especially ancient history and religious
history, fascinate me. Travel also forms a large part of my reading.

Thomas Samson Miller: Impossible to say how much I am


indebted to current authors and the classics. This is all subjective.

Anne Shannon Monroe: I do not read many current authors—


haven't the time. I know many are good and I miss a great deal, but
out on our coast we just have twenty-four hours a day, the same as
in New York, and some of them must be spent in the open, when
the open is such an enchanting wonderland. I read the classics in
school-days—had bookish parents who drove them down our throats
—but not since.

L. M. Montgomery: I think I owe considerable to my greedy


reading and rereading of standard fiction—the old masters—Scott,
Dickens, Thackeray, Hawthorne. Occasionally, too, a well-written
modern magazine story has been helpful and illuminating. But, as a
rule, I think aspiring authors will not reap much benefit from current
fiction—except perhaps from a purely commercial point of view in
finding out what kind of stories certain magazines take! Most
writers, except those of absolute genius, are prone to unconscious
imitation of what they read and that is a bad thing.

Frederick Moore: I can not gauge what the classics have done
for me. There is some "bunk" about classics. But I believe that
behind every writer there is the inherited tendency to write. This
trait seems to well up, even if several generations have been skipped
in the art. The creative urge does not always show itself in the same
metier—for instance, it will crop out as music in one generation, as
painting or sculpture in another, or as invention.

Talbot Mundy: God knows. I haven't read much. Kipling has


given me more pleasure than any other writer. Have only just begun
to read. Had no particular education, beyond the usual grounding in
Latin, Greek and "English"—all worked into me with a stick and with
all the useful parts left out.

Kathleen Norris: The best modern authors, and all the classics
one can assimilate, seem to me indispensable. But unless one can
read them in their own languages it is obvious that the only gain
would be in plot, construction and character work. But every one,
from Milton to Galsworthy, for style.

Anne O'Hagan: I can't answer this, but I should say that I had
learned most of my craft from reading the English classics.

Grant Overton: In the beginning I really learned everything


from reading. I do not think one learns his writer's craft directly from
reading either current authors or the classics. I think he gets from
good reading a mental elevation and impetus. The rest must come
out of himself.

Sir Gilbert Parker: Nothing. I have always gone my own way,


good or bad.

Hugh Pendexter: I am not conscious of being helped by current


fiction, which I read for entertainment purely. I studied and taught
Latin and Greek but could never discover my work in those subjects
has helped me any in my work of writing.

Clay Perry: I am afraid it is impossible to answer such a


question. Undoubtedly the reading of the classics when I was a boy
has had a more lasting influence upon me than the reading of
current authors in the past few years. If by "classics" is meant
recognized craftsmanship by modern authors, I should say that I
had learned a great deal from such writers as Jack London, Edith
Wharton, Hall Caine and a score of modern writers whose style and
craftsmanship is good. (One or both.)

Michael J. Phillips: I have not read the classics extensively. I


can't see Dickens nor Shakespeare. I consider Charles Reade, the
Cricket on the Hearth fellow, and Blackmore, who wrote Lorna
Doone, great artists and I suppose they influenced me.

Of course I have been taught very largely by my job, which has


practically always been newspaper work. In the shortest newspaper
item there must be a certain construction. It must have a beginning,
tell its story in orderly fashion, and an end. In my formative
newspaper days I had the advantage of being trained by a
metropolitan newspaper man who was the best judge of news
values I ever knew. He taught me unerringly, or nearly unerringly, to
put my finger on the novel, the dramatic, the leading feature of a
newspaper article, or "story," and play it up. I think that this has
been of great assistance to me in fiction writing; that is, I believe it
has taught me selection and emphasis—what to write and what was
the more important.

Walter B. Pitkin: What I have learned about writing has


definitely come from little reading, much observation, and an
irresistible tendency to write about all sorts of things. Nobody ever
urged me to write. I began it when I was a schoolboy, kept
elaborate journals, sold a story when I was about ten years old for
ten dollars, wrote essays, treatises, fantasies, poems, everything but
plays, in fact; and have probably written in my life, in one way or
another, at least twenty million words of copy. I have never liked the
classics; have read very little in them; know only three of Dickens,
four of Thackeray, never a novel of George Eliot, and so on. Am
bored to death by things that are not contemporary and verifiable in
my own life. (This is probably a violent reaction against too much
study of ancient philosophy and literature when a youth.)
E. S. Pladwell: Classics and current authors have their reflective
influence upon the mind; but I have refrained from trying to study
any of them with one exception. Kipling's magnificent condensation I
believe to be worthy of emulation. As for O. Henry, I think he is the
curse of American writers. The person who reads one of his stories
can not help but try, unconsciously, to ape the brilliant gallop of his
style, and they all come to grief. The other authors have their styles,
but to me they give little that is remarkable. With them it is the story
that counts.

Lucia Mead Priest: I have always been a reader; I can not


answer you. May be all I have ever done has come out of the
reservoir of many years' storage. I should say it is a toss-up between
the classics and modern literature.

Creative power is low and I have been a great reader; there you
are! May be all of me is somebody else. Can you unravel that?

Eugene Manlove Rhodes: Current authors, none. The classics,


all.

Frank C. Robertson: I should say that I have learned about


seventy-five per cent. of my craft from reading current authors, and
about one per cent. from the classics. Perhaps this is because I have
devoted about the same proportion of time to reading each.

Ruth Sawyer: Everything I know has been gained through


contact with authors—and these largely the so-called classical.
Coupled with these, the most helpful stimuli I have had have come
from the constructive criticisms given by kindly and humane editors.

Chester L. Saxby: The classics are mainly barren stuff for me—
labored writing, involved presentation, devious and unnecessary
description and reference, slag-heaps of introspection. I've learned
from them—what not to do. But from current authors I have gained
everything. I could say I have my little saints: Mary Johnston, Booth
Tarkington, Jack London, Margaret Deland, Ben Ames Williams,
Richard Harding Davis.

Barry Scobee: Tee-totally nothing, unless it might be for a few


minor—what shall I say, tricks of technique? This in the current
story. I seem to have been unable to get anything from reading
other writers, except in the instance of one or two I have come to
know.

R. T. M. Scott: So far as current authors are concerned—and


even the classics—I find that, when I try to derive benefit from
them, I imitate and fall down. In other words I fail to be myself and
a man can be nobody as well as he can be himself. Of course a man
may derive knowledge and inspiration from all good authors, but he
takes those qualities and builds them into himself so that they are
part of himself. In this way all good reading is beneficial and I have
benefitted. One thing might be pointed out. The classics stick in my
memory much more than does the work of modern authors.

Robert Simpson: I have learned a great deal from studying how


"the other fellow" did it. This applies to all sorts of writing from that
of the rawest novice to Scott and Boccaccio. But Dumas, Hugo,
Balzac, Dickens, Stevenson, Kipling, O. Henry, Addison, Swift, Lamb,
Newman, Carlyle, Emerson and several others of the big guns
among fictioneers and essayists have had most influence on
whatever style and technique I've achieved in twenty years of trying
to learn how to write.

Theodore Seixas Solomons: I have no idea how much current


authors have taught me. Mighty little that is useful, I believe, in
comparison with the dangers to imitation they have constituted. The
classics, however, read largely in youth, must have been of
tremendous influence, but chiefly, I think, in the matter of
expression. I think the story-telling art is a thing antecedent to any
influence of stories or story-tellers, common or classic.
Arthur D. Howden Smith: Most of it, I should say, in about
equal proportions.

Raymond S. Spears: I read magazines rather than authors, for


I find that magazines generally group authors rather sharply—
perhaps I should say magazines group moods of authorship. I read
what I like, and I have five feet of bandits, badmen, desperadoes
above fifteen feet of Mississippi River; and ten feet of outdoor hand-
books and information, including pearls, formulas, wild animals,
under six feet of classics, including Borrow, Plutarch, Poe, Ruskin,
Emerson, etc. I am not conscious of playing any favorites among
classics, dime novels, hand-books, government documents, poetry,
history, natural history, etc.

Norman Springer: Practically all I have learned about story


writing. I've tackled the living and the dead both, with good results.

Julian Street: I've read both—that is in English. I believe that


Latin and Greek (languages I don't know) tend to increase one's
vocabulary and beautify one's style. I know some French and Italian
and I think languages help. It is good to read French—for delicacies
of expression and grace of style. "The style is the man."

T. S. Stribling: I think I picked up most of my ideas on how to


write from the Russians.

Booth Tarkington: Learned nothing from reading current


authors; all from authors now dead. From the classics, I don't know
what proportion.

W. C. Tuttle: At the risk of being called a "low-brow" I must


admit that I do not enjoy the classics. I have only read a few, which
is another "low" admission. I feel toward them as I do toward the
old masters in art—admit that they are wonderful—and change the
subject.
Lucille Van Slyke: I ar'n't larned me my craft and never expect
to. I don't want to be either a deliberate or unconscious copy cat.
But I'll tell you this—it sounds funny but it isn't—Mother Goose is
actually the biggest help I have as a writer. Almost any situation in
life or books or plays will sum itself up in a Mother Goose rhyme,
plot and all. And if any writer knows a better 'ole—let him go to it!

Atreus von Schrader: With rare exceptions I find that I very


much prefer the classics, using that term in its broader sense, to
current writers. This is true only of the longer forms of fiction. The
short story, in its present state, has been developed within the last
decade or two. Jack London, for example, is of another period;
tremendously colorful, but too often lacking in plot. Upon rereading
your question, I find I have only half answered it. I believe the
modern American short story is in a class by itself for neatness and
finish of plot. But for color and substance, for care and matured
thought, the older writers are our masters.

T. Von Ziekursch: Do not believe I have learned anything much


from reading current authors. Do not know about the classics. Like
the Greeks, the Latins, the French and Russians. Thoreau, Anatole
France, etc. Am at a loss to answer this. John T. McIntyre, who to
me is a master of technique, has probably done more than anything
else for me by pointing out faulty tendencies to be guarded against.

Henry Kitchell Webster: I don't know.

G. A. Wells: What I have was gained both from moderns and the
classics in about equal proportions. I would say that the classics
taught me style, the moderns structure. The two writers most
responsible for what style I may show are Macaulay and Emerson,
though I would feel guilty did I fail to mention Lowell, Stevenson,
Addison, Carlisle, Fenimore Cooper. There are others I can't call at
the moment. To me, Macaulay is the peer of all writers, whether
modern or classic, and I attribute my style to him.
For structure I would earnestly recommend Post, O. Henry,
Kipling, Mrs. Rinehart in the novel, and De Maupassant; and more
intimately, Gordon Young, Mundy, Solomons and Pendexter, to
mention a few. A student should not study the classics for structure,
provided he wishes to write modern fiction. And to even matters, he
should not study the moderns for style. Moderns have style, but it is
not the quality of the classics.

William Wells: Don't know; have read very widely, some


translations of the classics, am familiar with nearly all that is best in
both American and English literature.

Ben Ames Williams: I'm unable to recall having learned


anything about writing from reading modern authors. What I have
learned from them has been acquired unconsciously. I've read
comparatively little written by living writers, except that for four
years I read all the magazines, every issue, all the way through. I
had never read Conrad at all till some fatuous reviewer compared
one of my stories to his work; the same is true of Hardy. I am
entirely at odds with the play-in-the-dirt school of modern writers.
They may be right; but the things that seem to them ugly and
depressing seem to me beautiful and even glorious. They, I think,
look at them from the outside. But as the fellow said, many an
honest heart beats under a ragged jacket. I'm not talking about sex
stories. I've no quarrel with them. I'm talking about the Main Street
school. If a man tries to take care of his family and help them
forward, I don't care whether he appreciates Dunsany or not; and if
a woman loves her husband and her children, she doesn't lose caste
in my eyes by failing to appreciate Amy Lowell. There are other tests
of manhood and womanhood besides a razor-edge taste in
literature; and one of the most valorous and admirable men I know,
a guide in the Maine woods, who loves his neighbors, speaks not
uncharitably, helps when he can and tells the truth, can not even
read his own name. There is a splendor in the commonplace life
which most of us live, even though the only novel in the house may
have been written by Harold Bell Wright, and the only poetic works

You might also like