Download full Professional Red Teaming: Conducting Successful Cybersecurity Engagements 1st Edition Jacob G. Oakley ebook all chapters
Download full Professional Red Teaming: Conducting Successful Cybersecurity Engagements 1st Edition Jacob G. Oakley ebook all chapters
com
https://textbookfull.com/product/professional-red-
teaming-conducting-successful-cybersecurity-
engagements-1st-edition-jacob-g-oakley/
https://textbookfull.com/product/all-out-temptation-forbidden-lovers-
romance-belford-boys-book-2-1st-edition-scarlett-oakley-oakley/
textbookfull.com
https://textbookfull.com/product/vertebrates-comparative-anatomy-
function-evolution-8th-edition-kenneth-v-kardong/
textbookfull.com
Ernest Hemingway a biography Dearborn
https://textbookfull.com/product/ernest-hemingway-a-biography-
dearborn/
textbookfull.com
https://textbookfull.com/product/tackling-a-level-projects-in-
computer-science-ocr-h446-ceredig-cattanach-chell/
textbookfull.com
https://textbookfull.com/product/mcgraw-hills-emt-flashcards-2nd-
edition-peter-a-diprima/
textbookfull.com
https://textbookfull.com/product/long-term-evolution-3gpp-lte-radio-
and-cellular-technology-ahson/
textbookfull.com
https://textbookfull.com/product/lonely-planet-pocket-lake-district-
lonely-planet/
textbookfull.com
Persuasive Technology: Development and Implementation of
Personalized Technologies to Change Attitudes and
Behaviors: 12th International Conference, PERSUASIVE 2017,
Amsterdam, The Netherlands, April 4–6, 2017, Proceedings
https://textbookfull.com/product/persuasive-technology-development-
1st Edition Peter W. De Vries
and-implementation-of-personalized-technologies-to-change-attitudes-
and-behaviors-12th-international-conference-persuasive-2017-amsterdam-
the-netherlands-april/
textbookfull.com
Professional
Red Teaming
Conducting Successful Cybersecurity
Engagements
—
Jacob G. Oakley
Professional Red Teaming
Conducting Successful
Cybersecurity Engagements
Jacob G. Oakley
Professional Red Teaming: Conducting Successful Cybersecurity Engagements
Jacob G. Oakley
Owens Cross Roads, AL, USA
Introduction������������������������������������������������������������������������������������������������������������xix
Chapter 4: Shaping������������������������������������������������������������������������������������������������� 43
Who��������������������������������������������������������������������������������������������������������������������������������������������� 43
Customer Technical Personnel���������������������������������������������������������������������������������������������� 43
Customer Operational Personnel������������������������������������������������������������������������������������������� 44
Provider Technical Personnel������������������������������������������������������������������������������������������������ 45
Provider Operational Personnel��������������������������������������������������������������������������������������������� 45
When������������������������������������������������������������������������������������������������������������������������������������������� 46
Preventing Incidents�������������������������������������������������������������������������������������������������������������� 46
Balancing Scope Attributes��������������������������������������������������������������������������������������������������� 47
What�������������������������������������������������������������������������������������������������������������������������������������������� 47
Motivation of the Assessment����������������������������������������������������������������������������������������������� 48
Prior Testing��������������������������������������������������������������������������������������������������������������������������� 50
Existing Security�������������������������������������������������������������������������������������������������������������������� 51
Scope Footprint��������������������������������������������������������������������������������������������������������������������� 52
Inorganic Constraints������������������������������������������������������������������������������������������������������������ 53
Summary������������������������������������������������������������������������������������������������������������������������������������ 55
vi
Table of Contents
Chapter 6: Executing���������������������������������������������������������������������������������������������� 73
Staffing��������������������������������������������������������������������������������������������������������������������������������������� 73
The Professional Hacker������������������������������������������������������������������������������������������������������������� 74
Best Practices����������������������������������������������������������������������������������������������������������������������������� 74
Check the ROE����������������������������������������������������������������������������������������������������������������������� 75
Operational Notes����������������������������������������������������������������������������������������������������������������������� 78
Enumeration and Exploitation������������������������������������������������������������������������������������������������ 79
Postaccess Awareness���������������������������������������������������������������������������������������������������������� 80
System Manipulation������������������������������������������������������������������������������������������������������������� 84
Leaving the Target����������������������������������������������������������������������������������������������������������������� 85
Example Operational Notes��������������������������������������������������������������������������������������������������������� 85
Summary������������������������������������������������������������������������������������������������������������������������������������ 88
vii
Table of Contents
Chapter 7: Reporting���������������������������������������������������������������������������������������������� 89
Necessary Inclusions������������������������������������������������������������������������������������������������������������������ 89
Types of Findings������������������������������������������������������������������������������������������������������������������������ 92
Exploited Vulnerabilities�������������������������������������������������������������������������������������������������������� 93
Nonexploited Vulnerabilities�������������������������������������������������������������������������������������������������� 94
Technical Vulnerabilities�������������������������������������������������������������������������������������������������������� 94
Nontechnical Vulnerabilities�������������������������������������������������������������������������������������������������� 95
Documenting Findings���������������������������������������������������������������������������������������������������������������� 95
Findings Summaries�������������������������������������������������������������������������������������������������������������� 96
Individual Findings���������������������������������������������������������������������������������������������������������������� 98
Briefing������������������������������������������������������������������������������������������������������������������������������������� 101
The No-Results Assessment����������������������������������������������������������������������������������������������������� 102
Summary���������������������������������������������������������������������������������������������������������������������������������� 103
viii
Table of Contents
Contrast������������������������������������������������������������������������������������������������������������������������������������ 121
Zero Day������������������������������������������������������������������������������������������������������������������������������ 121
Insider Threats��������������������������������������������������������������������������������������������������������������������� 123
Efficiency����������������������������������������������������������������������������������������������������������������������������� 124
Introduced Risk������������������������������������������������������������������������������������������������������������������� 126
Disadvantages��������������������������������������������������������������������������������������������������������������������� 126
Summary���������������������������������������������������������������������������������������������������������������������������������� 128
x
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
Table of Contents
Index��������������������������������������������������������������������������������������������������������������������� 205
xi
About the Author
Dr. Jacob G. Oakley spent more than seven years in the
U.S. Marines and was one of the founding members of
the operational arm of Marine Corps Forces Cyberspace
Command at the National Security Agency (NSA), Ft. Meade,
leaving that unit as the senior Marine Corps operator and
a division technical lead. After his enlistment, Dr. Oakley
wrote and taught an advanced computer operations course
and eventually returned to mission support at Ft. Meade.
He later left government contracting to conduct threat
emulation and red teaming at a private company for commercial clients, serving as
principal penetration tester and director of penetration testing and cyber operations. He
currently works as a cyber subject matter expert for a government customer. Dr. Oakley
completed his doctorate in information technology at Towson University, researching
and developing offensive cybersecurity methods. He is the technical reviewer of the
book Cyber Operations, second edition, by Mike O’Leary.
xiii
About the Technical Reviewer
Michael Butler has nearly a decade of experience in cybersecurity, including training
and operational experience with US Army Cyber Command and the NSA at Ft Meade.
As a soldier, he received several medals for both his academic and operational success.
After his enlistment, he developed content for and taught an advanced cyber operations
course. He then joined a private cyber security company as the lead of penetration
testing, where he led and personally conducted offensive security operations in support
of contracts with both government and commercial entities. He currently works as the
vice president of offensive services at Stage 2 Security.
xv
Acknowledgments
I thank my beautiful wife and family for sacrificing their nights and weekends to let
me write this book, and for loving and supporting me through this and other nerdy
endeavors.
I thank my father for exemplifying hard work and for all he did to give me the best
chance to succeed in life.
To Mike O’Leary, who nudged me in the right direction, and Mike Butler, who
performed the technical review, this book was not possible without you.
To all you keyboard-wielding cyber warriors out there protecting freedom, I salute you.
xvii
Introduction
This book is intended as a resource for those who want to conduct professional red
teaming, as well as for those who use their services. The text is not intended to teach
you how to hack a computer or organization, but rather how to do it well and in a way
that results in better organization security. It takes a lot more than sweet hacking skills
to perform offensive security assessments. Whether you are looking to employ ethical
hackers, work with them, or are one, after reading this book you should understand what
is required to be successful at leveraging cyber threat emulation to mitigate risk.
xix
CHAPTER 1
1
© Jacob G. Oakley 2019
J. G. Oakley, Professional Red Teaming, https://doi.org/10.1007/978-1-4842-4309-1_1
Chapter 1 Red Teams in Cyberspace
offensive security with at anecdotal guidance and best practices involved in carrying
out professional offensive security engagements. This book serves as a resource to both
those wishing to enter the field or those already practicing.
For the purpose of this book, the term “red team” is used interchangeably and as an
umbrella word that refers to the offensive cybersecurity methodologies of red teaming
and penetration testing. Although many in this profession argue differences between
the two, all will benefit from the information provided herein. In this chapter I explain
provide what red teaming is, how it was tailored to cybersecurity, and the intention for
cyber red teaming, as well as its advantages and disadvantages.
Red team is a term with alleged ties to the Cold War, when a “Red” force was used
to represent the enemy in tests against organizations under attack from the Soviets. The
concept of simulating attacks to test defenses and responses is much older. Although the
term red team can refer to attacks of a military nature, this book focuses on the aspects of
integrating this attack simulation concept into the cyber realm. Unless stated explicitly,
red teaming refers to cyber red teaming—or offensive security engagements in general—
and not those of a kinetic military nature.
I ntentions
The intent of a cyber red team is to simulate attack against an organization to test
information systems and their related facilities. This is an overly broad generalization,
and the term “attack” is often inappropriately aggressive regarding the behavior of
both red teams and the malicious actors they mimic. In many cases, the purpose of
a malicious actor is to gain intelligence or steal information. Such goals are affected
negatively by aggressive attack actions, as the actor in these scenarios is likely intent
on staying unnoticed for as long as possible. Adversary emulation is perhaps the most
appropriate and accurate description of the activity of red teams. The intent of this
emulation is to improve understanding of capabilities and inadequacies in the defense,
detection, and responses regarding threat actors.
Adversary emulation by red teams comes in many forms and can be classified
broadly as a holistic compromise attempt, a specific compromise attempt, or assumed
compromise. A holistic compromise attempt is one in which the red team is going after
the entirety of the target organization’s attack surface, with the goal of compromising
as much as possible (Figure 1-1). Specific compromise attempts are those in which
a certain subset of the attack surface is prioritized for assessment and the rest of the
2
Chapter 1 Red Teams in Cyberspace
3
Chapter 1 Red Teams in Cyberspace
4
Chapter 1 Red Teams in Cyberspace
Assumed compromise engagements are ones that lean toward being more efficient
while giving a potentially less-realistic picture of an adversary. When performed and
scoped correctly, though, this type of red team engagement offers perhaps the best cost
benefit toward improving security posture.
Assumed compromise can be broken down into the types of access from which the
assessment begins and their location within an organization. If holistic and specific
compromise attempts leverage an e-mail-propagated malware campaign against an
organization, assumed compromise assessments simply begin the assessment from the
type of access such a campaign would enable if successful. In this scenario, assumed
compromise engagements save potentially weeks of time waiting for a user to open
malware in an e-mail, and bypasses the potential ethical and legal risks of such operations.
Whether the access given in assumed compromise engagements is a specific user access or
an entire machine added to an organization, it sacrifices some realism for efficiency.
5
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
Chapter 1 Red Teams in Cyberspace
The security training of employees with regard to malicious e-mail may not be tested
in assumed compromise. However, operating under the assumption that someone
will be fooled eventually allows for time to be spent discovering more dangerous and
mitigatable vulnerabilities than the ever-present vulnerability of human error.
Advantages
Red team engagements offer advantages over other methods and technologies in
improving the security posture of an organization. Red teams are the sharpest tool
in the metaphorical shed of information security implements. This is not to say
that it is the best, or the best in any given situation; it is simply the sharpest. As
mentioned earlier, red teaming can identify the capabilities and shortcomings of
an organization’s various security assets, which provides a unique assessment of
the preparedness of an organization to withstand the efforts of a malicious actor.
It is important to understand that this assessment is only as good as the ethical
hackers conducting it, and the assessors are as limited or empowered as the scope
and rules of engagement to which they are held. All things considered adequate to
the situation, red teaming provides a greater cost efficiency in improving security
posture when compared to addressing security concerns reactively—after they are
leveraged by malicious hackers.
Red teaming is considered a sharp tool because it is surgical in its application
and can be extremely dangerous in untrained or unethical hands. Conducted by a
competent team, it is the only proactive precompromise tool available. Where many
security technologies are built around the concept of reacting, red teaming allows an
organization to pursue securing and mitigating issues before compromise attempts
are initiated, not after. It may be argued that activities such as vulnerability scans and
good patch management are proactive as well. It is important to note, though, that
although not based on a reaction to a security event within an organization, both are
reactions to security events elsewhere that provide details for new vulnerabilities for
which to scan or fix. One other tool is considered by some to be proactive in nature—
threat hunting—which aims to identify indicators of compromise from actors already
within the organization that may or may not already be known aggressors. Unlike red
teaming, though, threat hunting is a postcompromise activity.
6
Chapter 1 Red Teams in Cyberspace
Evaluating Preparedness
The unique advantage of these proactive and precompromise attributes is that red
teaming provides an understanding of preparedness whereas other information
security tools are attempts to prepare better. Other security tools may better prepare
organizational defenses to thwart malicious actors, monitoring to detect them or aid
in the effectiveness or resilience of response. Red teaming identifies whether those
technologies are effective in increasing an organization’s preparedness. It also helps
identify wasted or redundant resources within the organization via missed detections,
or unnecessary duplication of security event detection and recording from different
technologies.
Evaluating Defenses
A successful red team campaign tests the many defensive facets of an organization
via interaction with systems, users, and applications, and identifies the ability of these
objects to impede the actions of the assessors. An example of a defensive system in an
organization is a firewall. This system is meant to stop unsolicited or malicious traffic
from traversing from one point to another. The red team tests the firewall in both direct
and indirect manners. Indirect testing of a defensive object such as a firewall results from
scanning and other reconnaissance activity with systems or services that were intended
to be stopped but were allowed through the firewall for one reason or another, such as
misconfiguration or a flaw in the system itself. In either case, the defensive preparedness
of the firewall system was tested without the assessor having specific knowledge that
their actions were supposed to be stopped. Directed testing is when the assessor
knowingly tries to get past a defensive mechanism. This type of attempt falls into the two
subcategories of subversive exploitation or direct exploitation.
Subversive exploitation is when the assessor knows of the device and attempts
to bypass its defensive capabilities by leveraging flaws specific to it or by probing for
misconfigurations that allow assessor to get past them. Direct exploitation is when
the assessor leverages a flaw or misconfiguration in the system to gain remote code
execution in an effort to change the defensive settings of the device to get past it.
Other types of defensive security objects may be evaluated in the same manner.
An operating system may have a defensive setting that prevents scheduled scripts from
executing with a certain privilege. A flaw in that setting’s implementation may allow a
red team to run the script at that privilege. Or, the red team may actively pursue a bypass
7
Chapter 1 Red Teams in Cyberspace
to the defensive mechanism by using an execution method the operating system cannot
address or by compromising the operating system in such a way that the setting may
simply be changed. This is also the case at the application level. Input validation for a
field in an application may be bypassed wittingly or unwittingly by an assessor, or the
assessor may gain administrative command of the application through other means and
remove the input validation to perform a needed action. These same principles of testing
the preparedness of defensive mechanisms within an organization are not limited to the
technological security objects. The personnel of the organization should be considered
defensive security objects and be included in red team assessments when appropriate.
With effective training and procedures, they are capable of providing defensive actions
toward stopping the opening of malicious e-mails or thwarting activities such as
“shoulder surfing” valuable information off a coworker’s screen or tailgating through a
badge-accessed door. Identifying shortcomings in the preparedness of personnel-based
defensive security can be one of the most valuable findings in an engagement.
Evaluating Monitoring
The ability to evaluate how an organization monitors for malicious activity also
contributes toward understanding an organization’s security preparedness. Monitoring
for malicious activity within an organization is a two-step process of detecting and
alerting. Red teaming provides the ability to address and understand where delinquency
is taking place in the monitoring apparatus. Delinquency within the monitoring
apparatus can be technological and/or procedural, and may involve both the actions
of devices and personnel. Determining whether monitoring is failing to detect or alert
adequately and whether that delinquency is based on a technology or procedural gap
are required to mitigate monitoring issues correctly.
Detection is the identification of a security event within an organization. Security
events can be as vastly different as a security camera snapshot of an individual entering
a building, to an e-mail leaving the network to a particular address. Different red team
engagements create different security events and thus evaluate different detection
mechanisms within an organization. Similar to defensive security objects, detection of
security events can be tested in the same subversive or direct nature.
Alerting is the second portion of the monitoring apparatus and it focuses on what
happens after a security event is detected. Alerting may be as negligible as discarding the
security event and logging nothing, or as involved as escalating the activity of defensive
capabilities based on an alert triggering follow-on activity. In addition to being subject
8
Chapter 1 Red Teams in Cyberspace
to the same testing as previously mentioned detection and defensive capacities, alerting
adds a new wrinkle to the evaluation process. Alerting can be evaluated using direct and
indirect testing; however, it can also involve a third type of purposeful testing. Subversive
exploitation allows an assessor to avoid a detected event from causing an appropriate
alert. Direct exploitation could enable the assessor to disable appropriate alerting.
The third type of purposeful testing is evidence exploitation. This is when an event
was detected successfully and the appropriate alert generated, but the integrity of the
alert or evidence of the alert is altered. In some cases, this involves direct exploitation
of the system to delete the alerts, whether they be system logs, pop-up windows, or
entire files. The reason this activity does not fall completely within direct or indirect
exploitation is that, in many cases, alerts are part of a greatly distributed monitoring
apparatus, and direct exploitation of a given system may not remove all iterations of the
alert evidence.
Consider a system that contains a certain number of logs before it begins to
overwrite the oldest entry, or a system that can handle logging only a certain number
of events at the same time. Either system is susceptible to evidence exploitation.
The assessor could create so much noise that it prevents a specific alert from being
created, or may overwrite the alert in log form because of the volume of entries created.
Evidence exploitation can also occur from activities that cause the alert to document
false information, such as spoofing a source address of malicious traffic. Evidence
exploitation can also involve creating a much more serious false-positive alert to detract
the monitoring apparatus procedurally from heeding alerts related to the actual assessor
purpose and activity.
Evaluating Responses
The last portion of preparedness evaluated by red teams is the response of the
organization to the assessment activity during the engagement. A response is carried
out to varying levels of completion based on the intent and scope of the test. In some
red team scenarios, if the activity of the assessors is detected, the first step of the security
staff is to check with the head of red team operations to find out whether the activity
is related to a real malicious threat or the red team itself. After being informed that the
red team is the perpetrator, the security staff may end its response and let the red team
carry out the rest of its engagement unhindered. This is the easiest implementation of
response analysis a red team engagement can provide, but it is also the least intensive.
The detection of the threat by the security staff, and the subsequent knowledge that
9
Chapter 1 Red Teams in Cyberspace
the red team was responsible does not result in an end-to-end understanding of the
organization’s response preparedness regarding that type of malicious threat.
The most complete scenario is when, upon being alerted to potentially malicious
activity, the security staff carries out its response as if the treat was real. In this instance,
the red team tries to outmaneuver and evade the activities of the security staff, which
includes both defensive efforts to remediate infected machines as well as attempts to
thwart threat hunting mechanisms. The risk here is that the presence of the red team can
introduce security concerns by distracting from legitimate malicious activity within the
network. The medium between immediate stop of response and complete uninformed
response to red team activities is the optimal evaluation of an organization and should
be tailored to the specific needs of the assessment.
Beyond evaluating an organization’s preparedness to respond to malicious threats,
the red team provides the advantage of aiding the organization improve its defenses.
Not only do red teams identify issues in defense, monitoring, and response, but also
they aid in remediation, mitigation, and hunting efforts. A proper red team assessment
identifies findings for the client organization and supplies potential remediation for
given vulnerabilities, misconfigurations, or procedural shortcomings.
Many offensive security professionals began their careers as systems engineers,
administrators, or developers in some capacity, and they apply their experience and the
hacker mind-set to providing remedial guidance. It is extremely useful for these experts
to discuss remediation with the implementing parties from the organization such as
administrators or security personnel. Oftentimes, their ideas at fixing a problem do not
consider the way an attacker thinks or acts. Involving the red team in determining remedial
action saves time and addresses security findings more efficiently. Furthermore, on
completion of remediation efforts, it is often useful to bring in red team assessors for a short
engagement to identify whether the changes have addressed previous findings satisfactorily.
Mitigation of threats can also benefit from input from the red team—whether in its
report or in discussions with security staff. It may be that, although remediation exists
for a particular finding, the risk it poses can be addressed more efficiently or cheaply by
other mitigating circumstances, such as changes in settings or configurations that nullify
the impact of a current vulnerability. The findings of the red team are invaluable to the
security staff in other ways. For example, a vulnerability scan may identify findings on
certain low-cost machines used by an organization, but management may not allow
the security staff to address those findings. As a result of the low cost of the vulnerable
machines, the organization may decide to replace or reformatting these same devices
10
Random documents with unrelated
content Scribd suggests to you:
judgment of values (such as it is) gleaned in the college of hard
knocks and nine danged slaving years of schooling in that institution,
slaving and heart-rupture. But in beginning, books on writing and
even courses certainly have their value. I've had the correspondence
drill—with editors who've stood me up and knocked me down. But
that's rough on the editors, if everybody does it.
That is where the beginner is always trying to get to. About the
hardest thing he has to learn is how to weigh, select and subdue
thoughts. Memorizing all the rules and learning all of O. Henry's
tricks by heart won't help him. But access to information such as
your third query will bring out will help him. So will the news that he
must discipline his imagination and make it obedient. Think how we
run wild and waste ourselves in the beginning.
But after all the only way to learn to write fiction is to write
fiction. I am of that number who contend that fiction writing can't be
taught. It must be learned. But first of all one must have talent for
it. That talent can't be acquired, though, given that, it can be
cultivated. If one hasn't a talent for writing fiction all the teaching of
all the teachers won't make one a writer of fiction. Education alone
will not suffice, though I have had people say to me, "He should be
able to write stories, he is so highly educated." It is to laugh. I say
that the man with the gift or knack for writing fiction will turn out a
writer in the end if he applies himself, regardless of schools and
books teaching the method and art.
The best text books on the subject are to be found on the news-
stands—Adventure, American, Saturday Evening Post, Harper's, etc.
These should come first because they show the finished product of
people who are actually succeeding at what the student aspires to
do. It is the whole machine that can be taken down to learn how it
was assembled in the first place.
Summary
Of 113 answering, 55 have used neither class, course or book, 56
have tried one or more of these, and 2, saying only that they took
no course, are probably to be included with those having tried none
of the three.
Add the fact that if the remaining 16 of the 56 who have used
one or more of the three derived any benefit they did not take the
trouble to say so, which would indicate that, if there were any
benefit at all, it was not a considerable one. Add the additional
damning fact that of the 113 answering the general question 55
(probably 57) have not found it necessary to success to use any of
the three. Out of 113 writers only 15 claim any benefit, in even the
elementary stages, from classes, courses or books purporting to
teach the writing of fiction! Ninety-eight against fifteen!
That testimony fills me with joy. Yes, I've written a book myself
on fiction writing, but it had not been published when this
questionnaire was answered, it was written largely as an earnest
protest against present methods of teaching fiction and a chief
purpose of this questionnaire and of this present book giving its
results was to get proof in facts from a final source that present
teaching methods, as practised in all but a tiny handful of cases, are
badly in need of revolutionary revision.
QUESTION VI
Answers
Walter Richard Eaton: Nobody can say for me, I'd answer. One
learns much of his "craft" (in both senses!) from a study of his
market, the magazines. That is, he adapts the size (length) of his
story, etc., to the editorial demands.
A. Judson Hanna: I can not say that reading the classics has
helped me to write a story which will sell to an American magazine. I
have received much valuable help by reading current authors. For
instance, a story appearing in —— has passed the test. By studying
it I get an idea of what makes a short story. However, the most help
I have ever received I gained from criticisms, by magazine editors,
of rejected stories.
Nevil G. Henshaw: I've got a lot from both, possibly more from
current authors.
Lloyd Kohler: I think that it's safe to say that I've learned a
good half of my craft from reading and studying current authors and
the classics. There is a danger in this, especially if one follows a
certain current author too closely. It's best to read them all. As to
the classics, there is little danger of ever getting too much of them—
I'd venture that the average of us don't get enough of the classics. I
know that I don't.
Eugene P. Lyle, Jr.: Can't say, but doubtless I've learned a great
deal from reading current authors (for technique in current fiction)
and from the classics for the basic fundamentals.
Helen Topping Miller: I read all the classics when I was very
young. How much of my ability to write I owe to those early
associations I am not able to judge. Of late I have naturally studied
the craft of successful current authors. From modern novels I do not
feel that I gain anything; indeed it is very rarely that I am able to
finish a book without being dismally bored. On the other hand,
scientific and historical works, especially ancient history and religious
history, fascinate me. Travel also forms a large part of my reading.
Frederick Moore: I can not gauge what the classics have done
for me. There is some "bunk" about classics. But I believe that
behind every writer there is the inherited tendency to write. This
trait seems to well up, even if several generations have been skipped
in the art. The creative urge does not always show itself in the same
metier—for instance, it will crop out as music in one generation, as
painting or sculpture in another, or as invention.
Kathleen Norris: The best modern authors, and all the classics
one can assimilate, seem to me indispensable. But unless one can
read them in their own languages it is obvious that the only gain
would be in plot, construction and character work. But every one,
from Milton to Galsworthy, for style.
Anne O'Hagan: I can't answer this, but I should say that I had
learned most of my craft from reading the English classics.
Creative power is low and I have been a great reader; there you
are! May be all of me is somebody else. Can you unravel that?
Chester L. Saxby: The classics are mainly barren stuff for me—
labored writing, involved presentation, devious and unnecessary
description and reference, slag-heaps of introspection. I've learned
from them—what not to do. But from current authors I have gained
everything. I could say I have my little saints: Mary Johnston, Booth
Tarkington, Jack London, Margaret Deland, Ben Ames Williams,
Richard Harding Davis.
G. A. Wells: What I have was gained both from moderns and the
classics in about equal proportions. I would say that the classics
taught me style, the moderns structure. The two writers most
responsible for what style I may show are Macaulay and Emerson,
though I would feel guilty did I fail to mention Lowell, Stevenson,
Addison, Carlisle, Fenimore Cooper. There are others I can't call at
the moment. To me, Macaulay is the peer of all writers, whether
modern or classic, and I attribute my style to him.
For structure I would earnestly recommend Post, O. Henry,
Kipling, Mrs. Rinehart in the novel, and De Maupassant; and more
intimately, Gordon Young, Mundy, Solomons and Pendexter, to
mention a few. A student should not study the classics for structure,
provided he wishes to write modern fiction. And to even matters, he
should not study the moderns for style. Moderns have style, but it is
not the quality of the classics.