WEBVTT 00:02.730 --> 00:05.380 And so we're ready to go. 00:05.500 --> 00:09.020 So I'd like to welcome to the stage our first speaker today. 00:09.100 --> 00:13.300 This is Cyber Queen Meg, otherwise known as Megan Howe. 00:16.000 --> 00:19.420 Megan is a passionate, rising cybersecurity... 00:19.420 --> 00:21.220 Oh, I forgot, sorry. 00:21.300 --> 00:30.380 She's going to be speaking on Building the Cybersecurity Workforce Pipeline, How to Recruit and Educate the Next Generation of Cyber Warriors. 00:30.380 --> 00:37.400 Megan Howe is a passionate, rising security professional who's interested in programming, cybersecurity, and web development. 00:37.400 --> 00:44.720 Megan is attending Grand Canyon University in Phoenix, Arizona, to earn a Bachelor's of Science in cybersecurity. 00:45.120 --> 00:57.960 Megan is currently a threat analysis intern for the Arizona Cyber Threat Response Alliance, as well as a customer success intern at a cybersecurity startup called Trusona. 00:57.960 --> 01:00.620 Megan works as a freelance bug bounty hunter. 01:00.620 --> 01:02.540 Wow, that's kind of interesting. 01:02.540 --> 01:06.640 And is particularly focused on hunting for web security vulnerabilities. 01:06.800 --> 01:11.320 Megan also contributes to open source projects, GitHub. 01:11.700 --> 01:20.200 Previously, Megan has worked as a cybersecurity intern for the Paradise Valley Unified School District and for the Arizona State University. 01:20.200 --> 01:23.740 And I might add that she is an excellent violinist. 01:23.900 --> 01:34.360 Megan is a nationally recognized cybersecurity scholar and has earned industry recognition and certifications through GEAC, ETA, TestOut, and Microsoft. 01:34.360 --> 01:48.920 Megan is a 2021 National Cybersecurity Scholar, 2021 NCWIT, or National Honorable Mention, and two-time state champion in the SkillsUSA's cybersecurity competition. 01:48.920 --> 01:58.140 As a female student in cybersecurity, Megan also shares her perspective on cybersecurity and women in technology with audiences worldwide. 01:58.300 --> 02:01.240 So welcome, Megan, to the stage. 02:01.240 --> 02:02.380 Take it away, Megan. 02:06.250 --> 02:08.470 All right, I gotta figure out how to grab this thing. 02:08.470 --> 02:09.350 There we go. 02:09.830 --> 02:14.150 Thanks for the warm welcome, X-Ray, and thank you all for having me today. 02:14.210 --> 02:24.710 So as X-Ray mentioned, I'm gonna be speaking on building the cybersecurity workforce pipeline to recruit and educate the next generation of warriors. 02:24.710 --> 02:26.110 Next slide, please. 02:29.290 --> 02:31.170 So who am I? 02:31.170 --> 02:32.810 A photo's worth a thousand words. 02:32.810 --> 02:36.510 I've got different pictures up here to kind of illustrate who I am. 02:36.650 --> 02:50.910 I'm a dog lover, a recent high school graduate, a violinist, a public speaker, cybersecurity enthusiast, a conference attender, but most importantly, just a normal teenager who does normal teenager things. 02:50.910 --> 02:53.570 I don't just do cybersecurity all the time. 02:53.570 --> 02:59.530 I also like to have fun with friends and family and hang out with my dogs that you can see pictured. 02:59.950 --> 03:01.590 So next slide, please. 03:03.490 --> 03:08.190 So in the cybersecurity industry, we have a problem. 03:08.190 --> 03:24.510 There's too much demand for incoming cybersecurity professionals and not enough skilled or interested people that even want to go into cybersecurity, partially because a lot of people don't even know that the field exists, especially children. 03:24.510 --> 03:38.730 And this leads to also our education problem is that very few K through 12 schools teach practical cybersecurity content, and most colleges don't have a cybersecurity degree program or a minor. 03:38.730 --> 03:51.890 And even if they do, most of the time it's based on, yeah, the technical, not the technical, the business side of cybersecurity, not the technical side. 03:51.890 --> 03:53.450 Next slide, please. 03:54.510 --> 04:01.610 And so before I go on to my next slide, I have a little disclaimer is that I don't know everything. 04:01.610 --> 04:05.370 I just am a recent high school graduate. 04:05.370 --> 04:09.930 I don't have years of work experience like many of you have. 04:09.930 --> 04:14.130 And this is the end all, end all for cybersecurity. 04:14.130 --> 04:27.050 It's a potential framework for solving the workforce gap and getting more youth interested in cybersecurity that I hope that some of you can find parts of this useful. 04:27.050 --> 04:31.610 And I'm gonna be going over this framework here today in my presentation. 04:31.610 --> 04:35.190 So at the center of everything is community. 04:35.190 --> 04:49.170 Nine C's of cyber has to start with community, and then we build to concrete experience, clubs, coursework, competition, certifications, conferences, rear shadowing, and college. 04:49.170 --> 05:03.730 So each of these points has different things that we as cybersecurity practitioners or as business owners or as concerned community members can do to help boost the cybersecurity workforce and boost interest in the field. 05:03.730 --> 05:05.230 Next slide, please. 05:07.290 --> 05:09.370 Community, next slide. 05:11.210 --> 05:25.230 So before anyone is going to be interested in learning cybersecurity, but especially young people, we have to create environments that are welcoming, safe, fun, exciting, and supportive. 05:25.230 --> 05:42.350 People have to feel safe enough in these environments to learn, grow, try new things, not necessarily good at those new things, fall down, get back up again, and have the support to pursue their passions, whether it's cybersecurity or not. 05:42.350 --> 05:49.610 But in order to find passion, we have to have safe spaces for people to be able to explore those passions. 05:49.610 --> 05:51.130 Next slide, please. 05:53.290 --> 06:13.610 Mentoring is another key component of getting youth interested into cybersecurity and getting them integrated into a community because mentoring youth allows them to learn from you and learn about the workforce and what your job is and all the cool things to do in your job. 06:13.610 --> 06:15.870 You're also a resource for them. 06:15.870 --> 06:27.410 You can connect them to your network or possibly provide them with an internship at your company or help them with a resume or a cover letter or a job interview. 06:27.690 --> 06:47.070 But you, us adults, will also be learning from the people that we mentor because they can teach us so much about how to support the next generation and how that all works together and how we can best support them and other people like them. 06:47.070 --> 06:50.850 And so mentoring is definitely a two-way street. 06:51.030 --> 06:52.190 Next slide. 06:54.130 --> 07:12.790 Community gatherings, just like this one, are also important because when youth are permitted and encouraged to attend meetups, capture-the-flags, and conferences, they can meet people, do all sorts of cool activities like logging or a capture-the-flag competition where they learn about hacking, 07:12.790 --> 07:15.470 and meet people, get some cool swag. 07:15.470 --> 07:17.330 We all love swag. 07:17.450 --> 07:28.630 And form connections and bonds and spark their interest in cybersecurity, get them really engaged and wanting more. 07:28.630 --> 07:30.230 Next slide, please. 07:31.870 --> 07:33.090 Clubs. 07:33.090 --> 07:34.470 Next slide. 07:35.970 --> 07:42.830 So after-school extracurriculars are a really good first step to introduce youth to cybersecurity. 07:42.830 --> 07:52.410 And I'm kind of gonna go through a logical progression of first steps to more advanced steps throughout this presentation, which is why I have it ordered the way I do. 07:52.570 --> 08:01.170 So the first way I was introduced to computer science first and then cybersecurity through after-school extracurriculars. 08:01.170 --> 08:11.550 I was a member of Girls Who Code in middle school, seventh or eighth grade, about the beginning of my teenage years for those of you not in the US. 08:12.130 --> 08:17.870 And I learned how to code for the first time in a safe and supportive environment. 08:18.650 --> 08:21.390 But clubs can be more than just coding. 08:21.390 --> 08:38.190 There's a person in, I believe, Minnesota who has a Linux club, and he teaches middle schoolers how to use Linux and then do all sorts of open-source community projects and even distribute computers to kids in their classrooms that need them. 08:38.190 --> 08:39.390 It's really cool. 08:39.390 --> 08:41.530 Coding clubs are also cool. 08:41.750 --> 08:46.690 Hacking clubs could be super fun for high schoolers, but not just school. 08:46.790 --> 08:48.850 We need to have more than just school. 08:48.850 --> 08:51.290 We also need to have community programs. 08:51.290 --> 09:16.510 So it's crucial that we have our girls and boys clubs, our big brothers and sisters, all of these community programs that exist all around the world, including and increasing the group of cyber security skills, offering a workshop, or when Boy Scouts and Girl Scouts offer cyber security badges that are pictured on this slide right here. 09:17.630 --> 09:30.270 And when libraries and community centers and all sorts of places in the community put together these programs for kids, they might get exposed to it. 09:30.270 --> 09:32.050 And before they might have not. 09:32.050 --> 09:33.450 And same with adults. 09:33.450 --> 09:49.670 And if we have people that are willing to support and sponsor these types of programs, those, not just older kids, but kids of all ages to the fun of security, I believe that we can start getting people interested in cyber security. 09:49.670 --> 09:55.110 Because honestly, half of the problem is people just don't understand cyber security. 09:56.590 --> 10:00.230 So we have to first by fixing that. 10:00.230 --> 10:01.750 Next slide, please. 10:03.650 --> 10:06.070 Volunteering is also super important. 10:06.070 --> 10:18.190 It allows youth and adults to give back to the community, but also allows us to reach youth that maybe we wouldn't reach through an after school club or a community program. 10:18.290 --> 10:33.990 So I think a really good step for this would be setting up programs to provide cyber security services for small businesses, charities, or houses of worship, like your local church or temple, or whatever house of worship you attend. 10:33.990 --> 10:46.290 Because then you can pull in youth and other people to help run these services and get that benefit as a small business charity or house of worship. 10:46.310 --> 10:55.550 But also maybe get some people interested in cyber security that may not have been exposed to it if it weren't for these programs. 10:55.550 --> 11:00.630 And another cool program that's run is a program called TechCampers. 11:00.630 --> 11:04.490 It's run by the Air Force Association's Cyber Patriot. 11:04.730 --> 11:11.750 And it's all about educating older people, people new to technology on digital safety. 11:11.750 --> 11:15.310 So they have a free certification that people can take. 11:15.310 --> 11:19.130 It's aimed towards youth, but adults can become certified in this too. 11:19.130 --> 11:29.910 And it's all about helping to educate older people who aren't as familiar with technology on how to be in a way that they can understand. 11:30.210 --> 11:35.390 So that could also help recruit some more youth into cyber security. 11:35.390 --> 11:43.470 Say if a school were to set this up as a community service project and kids would be like, hey, this is kind of neat. 11:43.470 --> 11:47.170 These are all the kind of different things that go along and this is how people fall for it. 11:47.170 --> 11:49.810 I wanna be able to help stop that. 11:49.970 --> 11:53.050 So that's another really neat program that exists. 11:53.050 --> 11:54.370 Next slide, please. 11:56.930 --> 11:59.290 Competitions, next slide. 12:00.790 --> 12:12.230 So Capture the Flags, I'm sure everyone on this call, at least in the VR space has probably played many of Capture the Flag at DEF CON over the years. 12:12.410 --> 12:23.610 But for those unfamiliar, they're hacking competitions where you get points and rewards for finding virtual flags or solutions to a problem you're tasked to solve. 12:23.610 --> 12:42.010 And these competitions can help teach anyone about cryptography, web hacking, networking, how Linux works, how Windows works, how you hack a mobile application, how you hack artificial intelligence, all sorts of neat computer stuff. 12:42.010 --> 13:01.090 And by integrating these competitions into classrooms or community events or clubs, you can get youth interested in cybersecurity by giving them a creative and competitive outlet to explore in. 13:01.090 --> 13:12.310 It gives them this amazing opportunity to just try to solve a problem and get a bunch of points and rewards. 13:13.830 --> 13:17.170 That's also a really great motivation for youth. 13:18.590 --> 13:27.270 But yeah, Capture the Flags are really great for getting young people in because of the competitive nature of the activity. 13:27.270 --> 13:28.730 Next slide, please. 13:31.030 --> 13:37.450 Cyberstart America is a specific Capture the Flag that I've participated in. 13:37.450 --> 13:48.110 It starts out with this gamified experience where you can learn all about all sorts of different cybersecurity missions, if you say. 13:48.110 --> 13:49.510 You can learn about networking. 13:49.510 --> 13:51.550 You can learn how to use Linux. 13:51.550 --> 13:58.030 You can learn how to exploit an SQL vulnerability in a database. 13:58.030 --> 14:00.590 It covers almost everything. 14:00.590 --> 14:08.190 And then the highest score in this game that's about six months, get invited to this 48-hour competition. 14:08.190 --> 14:11.610 It's a Capture the Flag, runs for 48 hours straight. 14:11.610 --> 14:20.570 And it covers web exploitation, binary exploitation, forensics, networking, and a bunch of other different challenges. 14:20.570 --> 14:29.490 And I did this in spring of 2021 and placed among the highest in the Capture the Flag. 14:29.490 --> 14:35.390 And I won a BIAC certification attempt and a college scholarship through it. 14:35.390 --> 14:45.370 So I earned my GFAST, GIAC Foundational Cybersecurity Technologies certification through this completely free program. 14:45.370 --> 14:58.390 And so it was a really great opportunity to learn not just about cybersecurity, but also the fundamentals that you need to know to be good at cybersecurity, such as networking or Linux or programming. 14:58.390 --> 14:59.810 Slide, please. 15:03.390 --> 15:13.990 CyberPatriot, I briefly mentioned earlier, knowing I was going to come to this slide here, but it's the nation's largest youth cyber defense competition. 15:14.030 --> 15:18.890 So it's not about hacking, it's about how do I secure endpoints? 15:18.890 --> 15:24.330 So Windows machines, Ubuntu machines, and Windows servers. 15:24.330 --> 15:26.010 So it's a team competition. 15:26.010 --> 15:46.070 You work in teams of five and focus on fixing security vulnerabilities on virtual machines in Windows desktop, Windows server, and Ubuntu, but also creating secure networks in Packet Tracer, which is a Cisco program that allows you to model how networks run, 15:46.070 --> 15:49.330 and also taking a networking challenge. 15:49.330 --> 16:07.790 And so there is a special branch for high schoolers in the ROTC program, but I competed as part of another program that I was in, which I will get to later as just a civilian competitor. 16:07.810 --> 16:11.230 And there's a high school program and a middle school program. 16:11.230 --> 16:16.890 You can do these in person or virtually, and there's no skill requirements to join. 16:16.890 --> 16:29.370 And students learn so much through these programs from their coaches and mentors who are both just adults who are interested in cybersecurity and want to help kids learn. 16:29.370 --> 16:35.850 So my teams and I placed gold two years in a row, 2019 and 2020. 16:35.850 --> 16:39.210 It's a really fun experience. 16:39.270 --> 16:45.490 It's long Saturdays of six hours straight of competition, but it's so fun. 16:45.490 --> 16:47.630 I learned so much through it. 16:47.630 --> 16:50.390 I got my first exposure to Linux through it. 16:50.390 --> 16:54.130 It was really, really an amazing program. 16:54.130 --> 16:55.930 Next slide, please. 16:58.330 --> 17:02.550 So SkillsUSA isn't just a cybersecurity organization. 17:02.550 --> 17:20.190 It's what they call a career technical student organization where students taking what they call career and technical education classes, or basically classes teach you things that you can use in the workforce, like woodworking or programming or cybersecurity. 17:20.190 --> 17:47.210 And so they have a competition for cybersecurity students, and it's a two day, eight hours per day, at least nationally competition where there's 10 steps and you have to secure networks, secure firewalls, you have to secure Windows computers, you have to perform a penetration test on a network, 17:47.210 --> 17:58.310 you have to do some digital forensics, and you just have to really exhibit that you know all sorts of things about networking and cybersecurity through this competition. 17:58.310 --> 18:01.390 And so I've competed in it for two years. 18:01.390 --> 18:10.370 It's a partner competition and have done well both years and have learned so much from it both years. 18:10.370 --> 18:15.710 But the other thing about SkillsUSA, which is a program you have to run through a school. 18:15.710 --> 18:22.830 It's a program that a teacher would start, but you learn about workplace soft skills. 18:22.830 --> 18:24.890 So how do you be professional? 18:24.930 --> 18:30.210 How do you apply for a job or write a resume or do an interview? 18:30.210 --> 18:38.870 So it integrates all of these other skills in along with allowing you to get experience in the cybersecurity realm. 18:38.870 --> 18:40.410 Next slide, please. 18:42.840 --> 18:57.600 So Trace Labs, those of you in person at Def Con or just following all of the Twitter buzz about Def Con have probably seen some stuff about Trace Labs in the past week because they're having their quarterly Capture the Flag competition today. 18:57.800 --> 19:12.240 And it's an open source competition where competitors and judges kind of team up to help find open source intelligence about the whereabouts on missing persons. 19:12.360 --> 19:17.440 And so competitors, whether individually or in teams, work together. 19:17.620 --> 19:24.360 They have a list of about four to six missing people and a little bit of starter information. 19:24.360 --> 19:35.620 And they're given four to six hours to go find as much information about their whereabouts, their contact information, who they're associated with and where they may be located. 19:35.980 --> 19:48.220 Then the judges screen these results and flag the ones that could be helpful for law enforcement to submit as tips to help find these people and reunite them with their families. 19:48.220 --> 19:52.020 So I have judged two times now for Trace Labs. 19:52.020 --> 19:58.480 I won't be judging today as I'm speaking with you all because it's next. 20:02.640 --> 20:09.080 And judges and contestants have the opportunity to go through open source intelligence training. 20:09.080 --> 20:15.760 And it's a really great hands-on way to learn about this specific niche of cybersecurity. 20:15.880 --> 20:25.380 So I highly recommend getting involved with Trace Labs even if you aren't a student as it does amazing things for the community. 20:25.380 --> 20:27.020 Next slide, please. 20:28.940 --> 20:30.140 Coursework. 20:30.140 --> 20:31.920 Next slide. 20:32.440 --> 20:33.500 Thank you. 20:33.500 --> 20:43.840 So one thing I found is that in high school, not many high schools have cybersecurity specific coursework. 20:43.840 --> 20:53.060 So I was lucky enough in that I got to go to a high school with a computer science program, but I never had to take a cybersecurity course. 20:53.060 --> 20:56.100 It wasn't even an option for me to take. 20:56.320 --> 21:16.180 And my instructors did an amazing job of integrating cybersecurity into the curriculum, but I think it would be insanely helpful to integrate cybersecurity and the technical aspects of cybersecurity, not just digital citizenship, into our high school. 21:16.180 --> 21:21.400 So a program I used a lot for other computer classes is called Tucked Out. 21:21.400 --> 21:27.280 It's a certification company that has online virtual labs. 21:27.280 --> 21:31.580 And I have taken and passed three of their certifications. 21:31.580 --> 21:38.280 They have one called PC Pro, which is all about building PCs and Windows operating systems. 21:38.280 --> 21:41.560 It basically prepares you for the CompTIA A-plus exam. 21:41.560 --> 21:46.380 I've taken their Network Pro, which is all about computer networking. 21:46.380 --> 21:49.120 It prepares you for CompTIA's Network Plus. 21:49.180 --> 21:57.220 And I've taken their Routing and Switching Pro, which prepares you for the CTNA certification by Cisco. 21:57.220 --> 22:04.820 And so they provide, it's an online sandbox for students to learn, and they offer several cybersecurity courses. 22:04.820 --> 22:18.420 And so I think integrating this into a high school elective class would be a safe way for the school district, also a super beneficial way for youth interested in computers to learn about cybersecurity. 22:19.220 --> 22:24.420 It's really great that I'll talk about more in depth later is called TriHackMe. 22:24.420 --> 22:48.300 It's an online sandbox that allows you to essentially just do these challenges that teach you not just about hacking, but defensive security, physics, how to set up firewalls, and yes, web hacking, and mobile hacking, and more of the technical hands-on aspects of cybersecurity. 22:48.540 --> 22:55.200 And another really great way to integrate this is through a secured and isolated lab environment that students have control of. 22:55.200 --> 23:08.760 They get to decide what goes in it, they get to decide how it's set up, and they get to implement skills from a networking course, or a program course, or PC course on how to best set this up. 23:08.760 --> 23:17.360 And they also get to integrate skills on how best to secure that network and try to bypass those defenses. 23:18.020 --> 23:19.640 Next slide, please. 23:22.200 --> 23:29.520 Outside courses are also really great for people already kind of itching with the cybersecurity bug. 23:29.660 --> 23:38.460 I don't know any teenagers that are gonna be like, I wanna go take a random course on cybersecurity, I've never heard of it. 23:38.460 --> 23:44.760 There has to be some sort of fun, cool exposure to it before you get to this point. 23:44.760 --> 23:53.380 But once youth are interested in something, what I found is they'll do a lot to explore that. 23:53.380 --> 24:08.960 And so there's several resources where you can take outside courses, and this is not an all-inclusive list by any means, but edX and Coursera have a lot of really general cybersecurity courses, which is good for someone kind of just starting out and like, 24:08.960 --> 24:11.760 hey, I wanna see if this is something I'm even interested in. 24:11.760 --> 24:14.540 Do I wanna take a class at my high school on this? 24:14.540 --> 24:19.160 I don't know if I wanna commit to that elective block yet, I just wanna see. 24:19.300 --> 24:24.040 And TCM Security and Udemy have more specialized courses on. 24:24.040 --> 24:26.560 Okay, this is how you run a penetration test. 24:26.560 --> 24:30.280 This is how you code malicious scripts in Python. 24:30.300 --> 24:39.820 All sorts of niche skills that professionals and students alike are trying to learn through these platforms. 24:40.020 --> 24:41.660 Next slide, please. 24:42.860 --> 24:44.640 Concrete experience. 24:44.640 --> 24:45.960 Next slide. 24:46.240 --> 24:47.420 Thanks. 24:47.420 --> 24:51.960 Oh, I promised I'd talk about TryHackMe, and the time has come for that. 24:52.060 --> 24:58.440 So TryHackMe is unique in that it is a freemium program. 24:58.440 --> 25:08.200 It has a free tier that really has a lot of features, but also a paid tier that allows you to access modules that are available in the free tier. 25:08.200 --> 25:12.400 And that tier, I believe, is only like $10 or $15 a month. 25:12.400 --> 25:19.180 So it doesn't require a lot of financial commitment, and you can also gift this to people. 25:19.180 --> 25:24.940 And it's a really great way for people who don't know how to hack to learn how to hack. 25:24.940 --> 25:35.060 They have Kali Linux and parent security boxes up in the cloud that you can use to hack stuff on their website. 25:35.060 --> 25:36.300 It's all set up. 25:36.300 --> 25:40.620 There's a whole virtual private network connected into it. 25:40.620 --> 25:42.340 It's a really neat program. 25:42.340 --> 26:06.350 And then there are tackle box, which is for, once you have some of those basic hacking skills and you want to practice taking over a machine and using techniques that you've already learned, it's basically vulnerable machines that you have to try different techniques to own or take over the machine and hack it to make it yours. 26:06.410 --> 26:16.610 And so these programs are really great for helping youth and adults alike get the hands-on experience that they need to be successful in cybersecurity. 26:17.130 --> 26:18.650 Next slide, please. 26:19.950 --> 26:21.450 Thank you. 26:21.450 --> 26:26.630 Secure hacking environments are also really neat. 26:26.690 --> 26:41.690 There are many cyber ranges here in the United States where they have several machines kind of like hack the box, but you can kind of just do whatever you want on them because they're isolated. 26:41.710 --> 26:50.370 And you can try a bunch of different techniques and try to, hey, I tried this, but I want to see if this will also work. 26:50.390 --> 27:04.550 And there's also, I believe, some isolated online servers, kind of like there's the vulnerable web application that you can download locally. 27:04.550 --> 27:12.850 And there's one by Google, it's cheese themed, where it's intentionally vulnerable. 27:12.910 --> 27:20.410 And your goal is to try to hack it and just play around and find all these cool vulnerabilities. 27:20.410 --> 27:21.830 Next slide, please. 27:23.890 --> 27:27.570 Homelabs are definitely for more advanced users. 27:27.570 --> 27:30.070 I am still in the process of setting up mine. 27:30.070 --> 27:55.430 It's a long process, but once you get it set up, I believe it's totally worth it because it's about creating a model production environment where you can hack your own stuff, practice setting up firewalls and practice bypassing that firewall or have a bug machine and set up a web server that you can try to hack stuff through. 27:55.430 --> 28:11.150 And you're not just learning about hacking here, you're learning about vulnerabilities, Windows, Linux, virtualization, blue teaming or defense mechanisms, red teaming or attack mechanisms, networking, you know, how do all these corporate networks work? 28:11.150 --> 28:13.190 How do you set up Linux? 28:13.190 --> 28:17.110 What makes Debian different from Fedora Linux? 28:17.110 --> 28:19.870 It's the way you install applications. 28:19.870 --> 28:27.410 Really, if you want to learn about something with computers, a homelab is a really amazing way to do that. 28:27.410 --> 28:44.250 It just requires a lot of time on Google and a lot of experience, but it's something that I think we need to promote more to people interested in cybersecurity because it's really easy to set up in just some virtual machines. 28:44.250 --> 28:49.110 It can be as big or as small as your computer can manage. 28:49.130 --> 28:50.330 Next slide, please. 28:52.630 --> 28:54.030 So bug bounties. 28:54.030 --> 28:58.050 I mentioned that I am a freelance bug bounty hunter. 28:58.130 --> 29:04.230 What I forgot to put in that bio is I'm also a freelance AI bias bounty hunter. 29:04.370 --> 29:16.730 There was a program that Twitter did last summer where they had their AI cropping algorithm and researchers tried to find biases in that program. 29:16.730 --> 29:26.150 And so that was a program on something called HackerOne, which is a really nice program for beginners because they have so many things you can hack. 29:26.150 --> 29:31.270 And also you can get invited to private programs really easily. 29:31.270 --> 29:33.370 Bug Crowd is also nice. 29:33.370 --> 29:35.650 Any of these programs are on the screen. 29:35.650 --> 29:52.630 Hunter.dev is for open source vulnerabilities, but basically bug bountying, there's the incentive of getting paid for finding a bug in a company, legally hacking them, and then getting money for it and learning all about cybersecurity in the process. 29:52.630 --> 29:56.090 And it's just an amazing process. 29:56.090 --> 30:22.950 It's very, very frustrating at times, but once you get the hang of, and I had to get the hang of, hacking an actual production environment, it's a really great way for older youth to explore their skills and do things ethically, not just go like, I want to go down Twitter today, 30:22.950 --> 30:36.190 but like, hey, there's a company that invited me to their private program, and I want to see if I can find SQL injection vulnerability on their website and forward it to them. 30:36.950 --> 30:47.370 So I think bug bounty is really neat, especially for older teenagers or college students looking to make money, all that kind of stuff. 30:47.370 --> 30:48.810 Next slide, please. 30:50.990 --> 31:09.270 So X-Ray also mentioned I have contributed to open source software, and I think this is really good for the next generation to do because not only does it teach them how to program and how GitHub and source code... 31:16.870 --> 31:18.010 I apologize. 31:18.350 --> 31:18.810 Am I still 31:22.290 --> 31:22.650 on? 31:22.650 --> 31:27.890 Sorry, my kidney decided to recap for a moment. 31:29.770 --> 31:32.390 Your audio is very, very quiet now. 31:33.250 --> 31:34.730 Microphone is not active. 31:35.610 --> 31:37.170 All right, let me try something. 31:40.150 --> 31:42.030 You need to pick up the microphone. 31:43.330 --> 31:44.830 All right, I will. 31:49.560 --> 31:50.300 Better? 31:51.480 --> 31:53.340 Nope, still the same. 32:00.660 --> 32:02.900 You need to pick up one of the microphones. 32:02.900 --> 32:05.940 That'll give you a megaphone, and then everybody will be able to hear you. 32:06.020 --> 32:07.940 I thought I had one of the microphones. 32:09.020 --> 32:13.320 You accidentally must have dropped it because I can see them both on the podium there. 32:18.360 --> 32:19.520 How about now? 32:19.520 --> 32:20.380 There you go. 32:21.020 --> 32:21.720 All right, perfect. 32:21.720 --> 32:23.480 Thanks for that help, X-Ray. 32:25.440 --> 32:27.380 Anyways, open source software. 32:28.920 --> 32:39.740 It's really good for our youth to explore and learn about programming, but also find vulnerabilities to these projects and help to patch them. 32:40.520 --> 32:51.740 These maintainers who are working so hard on all these projects that Google are scared of, and they may miss something. 32:51.740 --> 33:08.840 And it's really a community of security researchers in OSS helping to kind of plan for this and fix it and I think it's a really good place for youth to serve in this field. 33:08.840 --> 33:24.440 So I created two open source projects, GeekFest.Linux was a senior project I did, all about making it a lot easier to build HomeLab and also a log-forging scanner in December of 2021. 33:25.040 --> 33:31.360 I've contributed to the Beef Project, which is a web application testing app. 33:31.360 --> 33:33.420 I've contributed to BlackArchLinux. 33:33.420 --> 33:35.400 Yes, I use ArchLinux. 33:35.400 --> 33:36.800 I love it. 33:37.560 --> 33:44.280 And RaspAP, which is a access point that you can put on a Raspberry Pi. 33:45.580 --> 33:53.320 It's a very supportive community of programmers, security enthusiasts, and just other people. 33:53.320 --> 33:58.660 And there's also a background you can do for open source on a site called hunter.dev. 33:58.660 --> 34:08.960 So that's also a good resource to look into when you're talking to youth about getting cybersecurity and three ways to do it. 34:08.960 --> 34:10.240 Next slide, please. 34:13.080 --> 34:14.600 Certifications. 34:14.880 --> 34:16.140 Next slide. 34:17.320 --> 34:27.180 So cybersecurity certifications are a really great way to tangibly show what someone knows about you. 34:27.180 --> 34:35.760 Because you can pass a test or finish 11 online labs successfully. 34:36.060 --> 34:39.080 You clearly know something about that subject. 34:39.080 --> 34:57.080 And it's a really great way for schools to show off their student knowledge, but also as a resource for students learning individually on their own or for community centers or libraries to offer sessions for. 34:57.380 --> 35:10.040 And so I think those certifications that pass a number of formats, ATA, GIA, MPT, MTA, all kind of test in a multiple choice format. 35:10.060 --> 35:13.500 I'm going to be taking security plus here in the next couple of weeks. 35:13.500 --> 35:23.400 That's a mix of multiple choice and free response, but kind of like drag and drops or maps. 35:23.940 --> 35:27.940 And then there's test out certifications, which are 100% hands-on. 35:30.160 --> 35:35.220 And they're insanely hard to pass, but it's also insanely rewarding. 35:36.600 --> 35:46.280 So if a student isn't a great taker, but they're really good at doing hands-on activities, maybe test out certifications are better for them to show off their knowledge. 35:46.280 --> 35:54.420 But if they're a really good test taker, maybe they should take something like the ETA ITS certification or the CompTIA security class. 35:54.420 --> 35:55.740 Next slide, please. 36:05.180 --> 36:08.000 Ready for the next slide, whenever they're done. 36:08.200 --> 36:09.040 There we go. 36:09.040 --> 36:11.740 Conferences, next slide, please. 36:12.360 --> 36:22.400 So why are conferences like this, like DEF CON, so important to expose youth who are getting interested inside your security exam? 36:22.400 --> 36:35.140 They can learn new things, do all sorts of fun workshops like block picking or capture flag or a trace labs capture the flag or also car hacking. 36:35.140 --> 36:37.780 I believe there's an aviation village at DEF CON. 36:37.780 --> 36:43.380 I'm not in Vegas, so I'm seeing everything that's going on and it all looks really cool. 36:44.120 --> 36:48.140 And you can learn about all these neat areas of cybersecurity. 36:48.200 --> 36:54.520 Also network professionals and hobbyists and enthusiasts like everyone here. 36:54.660 --> 37:02.300 But students can also learn about professionalism, be a good professional in a professional manner. 37:02.300 --> 37:13.540 Also, once they get some knowledge, practice some public speaking and get their public speaking skills up to par and be really good. 37:14.700 --> 37:28.580 And conferences are just a great way to learn both the soft skills that are needed in cybersecurity, but also learn new skills and teach others about skills that you already have. 37:32.570 --> 37:35.550 Career shadowing, next slide. 37:36.770 --> 37:44.430 Awesome, so a program I was in when I was in high school, it's called Paradise Valley Women in Information Technology 84. 37:44.430 --> 37:49.710 I will call it PBWIT for short because that whole long phrase is very long. 37:49.710 --> 38:01.530 So it's an internship where young women around my school district came together to learn about different tech, such as artificial intelligence, these things and cybersecurity. 38:02.030 --> 38:11.310 And to learn about these fields, we did hands-on projects, communications to district leadership and other IT leaders around our state. 38:11.310 --> 38:17.670 And we got mentored by our district's IT director and we had guest speakers come in. 38:17.670 --> 38:23.910 We had an ethical hacker come in and it was a really great program. 38:24.070 --> 38:29.950 If you are setting up a program similar to this, it doesn't even have to be in a school district. 38:30.450 --> 38:32.810 It doesn't have to be exclusively for women. 38:32.810 --> 38:36.470 It could be for anyone that is interested. 38:36.470 --> 38:42.270 A library or a community center could set something up like this that meets during the summer. 38:42.270 --> 38:57.750 It could be part of a summer camp held somewhere where youths just come together and learn things collaboratively in a safe environment and do projects and present their work and get mentored by industry professionals. 38:58.110 --> 39:00.030 Next slide, please. 39:02.740 --> 39:13.740 So, I've done a number of security internships and just to note, this is not an all-inclusive list of what security internships are like. 39:13.740 --> 39:18.100 These are just a few I've done and what my experiences were like. 39:18.100 --> 39:24.580 These can be very different or similar or anything like that. 39:24.640 --> 39:36.600 During the fall of 2020 and spring of 2021, I worked at Arizona State University as an information security intern with one of my very good friends. 39:36.600 --> 39:42.220 And we worked there for nine months helping to improve their security review process. 39:42.220 --> 39:51.300 So, when an administrator or professor wants to add an application that can be used, they had to go through this process first. 39:51.440 --> 39:54.100 And that was a really wonderful internship. 39:54.120 --> 39:58.500 And at one point, we were learning about instant response. 39:58.680 --> 40:03.560 This was in December, 2020, when solar was hit. 40:03.620 --> 40:09.200 And that was one of the biggest issues of all time. 40:09.200 --> 40:18.500 And Chloe and I, my fellow intern, were kind of thrown into the mix of this big, giant catastrophe. 40:18.500 --> 40:29.880 And this is where I saw everything going on and all of the people rushing to help and trying to solve these problems. 40:29.880 --> 40:33.780 And I said, this has nothing to do with the rest of the world. 40:34.300 --> 40:38.300 I want to help cybersecurity. 40:38.300 --> 40:40.300 I want to help prevent these breaches. 40:40.300 --> 40:47.020 I want to help move our society forward and be safer and more secure for everyone. 40:47.020 --> 40:52.100 And so that ASU internship for me was really instrumental. 40:53.300 --> 40:55.620 Awesome for me on that. 40:55.620 --> 41:02.300 And then after that, I worked at my school district called PV Schools for a cybersecurity internship. 41:02.400 --> 41:04.000 I helped manage students. 41:04.000 --> 41:06.400 I helped wipe old computers. 41:06.560 --> 41:09.760 I worked on several data governance initiatives. 41:09.760 --> 41:16.220 I did some customer service, and I also helped get ready for a cybersecurity audit. 41:17.340 --> 41:19.220 Next slide, please. 41:21.700 --> 41:29.560 After I finished with PV Schools, I went to Trusona, and my last day there was actually Monday. 41:30.540 --> 41:39.480 But when I was there, I was a customer success intern for a cybersecurity startup getting a password in favor of biometric authentication. 41:39.740 --> 41:52.120 I was a member of the team, and I helped provide a perspective of a younger person or a teenager, because let's face it, a lot of teenagers are not very good with cybersecurity. 41:53.260 --> 42:00.300 I helped make videos and documentation on how our project integrates with the customers of Trusona. 42:00.300 --> 42:03.000 That was a really wonderful experience. 42:03.000 --> 42:09.020 I met a lot of awesome people there, and I was just so blessed to have that opportunity. 42:09.800 --> 42:13.440 I grew up in Phoenix Chamber of Commerce. 42:13.500 --> 42:14.920 I did an externship. 42:14.920 --> 42:28.020 It was a two-week experience where we learned from cybersecurity professionals, practiced networking and screening skills, and also created a project with the team and presented that. 42:28.260 --> 42:38.700 And most recently, I've been a bright intelligence intern for the Arizona Cyber Threat Response Alliance. 42:38.700 --> 42:42.400 I'm a member of the first student group to go through this training. 42:42.400 --> 42:51.060 I've learned about cybersecurity and threat intelligence and networked with students and professionals in industry and created a capstone project. 42:51.060 --> 43:02.520 And the other students and I will be the founding members of a university intelligence club that focuses on open-source health as a result. 43:03.220 --> 43:04.520 Next slide. 43:08.890 --> 43:09.610 Awesome. 43:09.610 --> 43:10.770 College. 43:10.930 --> 43:12.250 Next slide. 43:12.690 --> 43:31.230 Look, cybersecurity degrees are very important, in my opinion, because if you don't gain the knowledge in an educational setting or just anywhere to be a practitioner, how are we going to find people with the technical skills to hire? 43:31.310 --> 43:53.550 And what I found from many universities when I was college hunting was they either didn't have a cybersecurity degree, only had a cybersecurity minor, or had what they called a cybersecurity degree, which focused on auditing, which is helpful, but our shortage is mainly in the technical ground right now. 43:53.550 --> 43:59.470 I have some statistics on that that I can share later on if anyone's interested. 43:59.470 --> 44:06.350 So I found it's important that we have a technical cybersecurity degree. 44:06.350 --> 44:19.090 And there's a couple of schools I found that have really good technical programs, one of which is Grand Canyon University, that's where I will be attending fall in Phoenix, Arizona. 44:19.090 --> 44:23.290 Another one is Dakota State University in South Dakota. 44:23.350 --> 44:27.170 Both of these have really good technical programs. 44:27.330 --> 44:29.010 And how do we implement them? 44:29.010 --> 44:47.910 Well, we need to implement classes that teach forensics or teach ethical hacking and do all of this in the college space so that college graduates, once they're out of college, they can take a job that they graduate and be extremely successful. 44:48.230 --> 44:49.770 Next slide, please. 44:52.060 --> 44:57.020 And another thing that's important is requiring security coursework in computer science majors. 44:57.020 --> 45:06.880 It shocked me when I learned that three of the top 10 computer science programs in the United States don't even offer a center-study class. 45:06.880 --> 45:10.340 It's not even an option for people to take. 45:10.460 --> 45:30.500 And I believe there's only a few, I believe it's three of the top 36 degrees require a cybersecurity course to graduate, meaning that a vast majority of computer science students, they don't get any cybersecurity training in college. 45:30.500 --> 45:33.760 And so they're in the workforce and making all these programs. 45:33.980 --> 45:36.040 They don't know how to do it securely. 45:36.040 --> 45:37.700 It's just an afterthought. 45:37.880 --> 45:39.020 So how do we do this? 45:39.020 --> 45:40.520 I think there's two ways. 45:40.980 --> 45:49.860 I think we can set up a general cybersecurity course in university that students have to take to graduate in computer programs. 45:49.960 --> 46:07.160 And I think we possibly also add a secure coding course that students can learn how to be secure in their programming and how to build programs that are secure so that we don't have these problems in as many of these fields in the future. 46:07.160 --> 46:08.980 The next slide, please. 46:11.360 --> 46:13.600 So what are the takeaways from this? 46:13.600 --> 46:16.200 Obviously, yeah, go back to the takeaways. 46:16.200 --> 46:17.020 Thanks. 46:17.900 --> 46:19.000 Thank you. 46:19.240 --> 46:21.300 So what are the takeaways from this? 46:22.280 --> 46:26.420 Essentially, they're not going to be able to do everything I've talked about. 46:26.420 --> 46:31.500 And that's okay, because every little effort makes a huge difference. 46:31.500 --> 46:35.620 So just a reminder that this is just a framework. 46:35.620 --> 46:37.580 It's a possible solution. 46:37.580 --> 46:46.760 I may have some really bad ideas on here, and there are probably some really good ideas that I left out and I didn't know existed. 46:46.760 --> 47:05.960 This is based on my very limited 18 years of experience in life and how I see the world and I'm sure there are other really amazing resources and ways to solve our workforce gap and get youth interested in cybersecurity that I did not mention, and for that, 47:05.960 --> 47:07.460 I'm sorry. 47:07.900 --> 47:14.640 But I'm sure that if we all work together, we can find the best solution for this problem. 47:14.640 --> 47:23.660 I am around to speak to anyone that has questions or just wants some ideas. 47:23.660 --> 47:33.700 I can also refer some other people that I know that are also really good and better than me at recruiting youth into cybersecurity. 47:34.520 --> 47:39.000 And so now, can you go to the next slide, please? 47:40.420 --> 47:44.060 Thank you so much for coming to my presentation. 47:44.060 --> 47:48.100 Do we have any questions? 47:48.900 --> 47:53.640 And contact information you can find on the screen. 47:55.800 --> 47:57.800 Any questions? 48:05.090 --> 48:07.470 Thanks for the class. 48:08.970 --> 48:10.610 Great talk. 48:11.250 --> 48:12.530 Thank you. 48:12.530 --> 48:14.490 Yeah, just more of a comment. 48:14.490 --> 48:19.050 I'm really impressed with your experience, specifically with that age. 48:20.050 --> 48:20.890 Thank you so much. 48:20.890 --> 48:22.330 There's a lot of experience there. 48:22.330 --> 48:23.530 That's awesome. 48:24.810 --> 48:26.550 Yeah, thank you so much. 48:26.550 --> 48:27.270 Great. 48:32.250 --> 48:36.250 And I'll be hanging around the VR space. 48:36.530 --> 48:43.510 If you have any questions, if you're on Twitch and you have questions, you can find my email in my link. 48:44.170 --> 48:46.450 You can email me. 48:47.150 --> 48:48.290 I'm also on Twitter. 48:48.290 --> 48:49.950 You can message me there. 48:49.950 --> 48:51.990 You can message me on LinkedIn. 48:52.430 --> 48:54.510 Just send me a text request. 48:55.690 --> 48:58.010 Relatively soon, I'll probably accept it. 48:58.010 --> 49:06.030 I don't know, but I'll be happy to answer any questions you have. 49:08.130 --> 49:11.310 Thank you all for your time. 49:12.010 --> 49:14.170 I appreciate y'all being here. 49:25.430 --> 49:29.310 Thank you, Meg, Cyber Queen Meg, for an excellent presentation. 49:29.330 --> 49:31.510 There's a lot of useful information in there. 49:31.510 --> 49:37.710 I will probably contact you later to talk about some of this stuff because I'm interested in the same topic. 49:38.570 --> 49:39.750 Everybody hang out. 49:39.750 --> 49:42.610 In about another six minutes, we'll have our next speaker. 49:42.770 --> 49:44.270 So take a break. 49:45.370 --> 49:47.150 Take a bio break, that sort of thing. 49:47.150 --> 49:49.410 And we'll see you back here in about six minutes.