WEBVTT 00:00.000 --> 00:04.440 I just bumped into Kevin, who was telling me about an incredibly interesting project. 00:04.440 --> 00:08.700 And I was saying, you know, wait till the camera's on and then tell me about it. 00:08.700 --> 00:10.720 So can you repeat some of the things we just said? 00:10.720 --> 00:11.780 What is the project? 00:11.780 --> 00:16.220 Yeah, the project is OpenSBK, or Open Security Body of Knowledge. 00:16.980 --> 00:18.040 What is that? 00:18.300 --> 00:19.900 It's something I made up. 00:20.420 --> 00:24.940 So I'm like, I was bored one day and thought, what the hell, let's register a domain name. 00:24.940 --> 00:26.760 We need more acronyms in security. 00:26.760 --> 00:28.680 We don't have enough acronyms, right? 00:28.880 --> 00:29.680 Absolutely. 00:29.680 --> 00:39.640 So the idea is, in my opinion, we have way too many people trying to get into InfoSec and not knowing how to get into InfoSec. 00:39.640 --> 00:40.500 Like, I want to be clear. 00:40.500 --> 00:42.860 I love everybody wanting to get into InfoSec. 00:42.880 --> 00:50.280 But they look at it and they look and say, okay, the only way to do this is to pay $7,000 or $8,000 for a boot camp, right? 00:50.280 --> 00:51.580 That kind of crap. 00:51.580 --> 00:52.980 And I don't like that. 00:53.100 --> 00:57.020 And I've been in this industry for, shit, too long, right? 00:57.020 --> 00:57.860 I'm old. 00:57.860 --> 01:00.960 And people come to me all the time and say, what do I need to know? 01:00.960 --> 01:02.120 How do I need to learn this? 01:02.220 --> 01:04.640 I want to be a reverse engineer. 01:04.640 --> 01:05.740 I want to be a pen tester. 01:06.040 --> 01:07.440 What do I want to do? 01:07.580 --> 01:26.040 And so what me and a group of people, John Strand, Jason Gillum, everybody else like that, we got together and we've started building out job matrices, which is a fancy way of saying, what do I need to know to be a beginner or apprentice pen tester? 01:26.040 --> 01:31.960 What do I need to know to be an intermediate reverse engineer or whatever, right? 01:31.960 --> 01:36.720 As a question, though, it's like, yeah, immediately my mind goes to training. 01:36.720 --> 01:37.120 Yes. 01:37.120 --> 01:43.300 It's like training, like someone goes, hey, Alex Silk, I want to get into penetration testing. 01:43.300 --> 01:43.920 What should I do? 01:43.920 --> 01:48.020 Often I say, go to TriHackMe or go to Pico CTF. 01:48.020 --> 01:48.600 Yep. 01:48.640 --> 01:50.080 This isn't a training. 01:50.080 --> 01:51.220 No, this is not training. 01:51.220 --> 01:52.580 Because here's the issue. 01:52.660 --> 01:55.840 I love that both of the examples you gave are great, right? 01:55.840 --> 01:57.160 I love that they're there. 01:57.280 --> 02:10.580 But when people go into TriHackMe or, you know, Meta CTF or whatever, they're overwhelmed quite often with the, what are the seven things that I should start with? 02:10.580 --> 02:10.780 Right . 02:10.800 --> 02:15.140 So the idea with OpenSVK is you pick the job you want, right? 02:15.140 --> 02:18.020 It's kind of like dress for the job you want, not the job you have. 02:18.020 --> 02:18.240 Yeah. 02:18.240 --> 02:20.140 That's why I dress like Darth Vader all the time. 02:20.320 --> 02:20.780 Right. 02:20.780 --> 02:21.560 Or a ninja. 02:21.560 --> 02:22.360 Yeah, good. 02:22.360 --> 02:24.460 But if you were dressed like a ninja, I wouldn't see you. 02:24.940 --> 02:30.540 So but then they can go here and say, OK, to be a network pen tester, I need to understand. 02:30.540 --> 02:32.140 And I'm going to make up some examples here. 02:32.140 --> 02:32.380 Right. 02:32.380 --> 02:34.540 But I need to understand subnetting. 02:34.540 --> 02:37.640 I need to understand the difference between UDP and TCP. 02:37.640 --> 02:40.900 I need to understand that the OSI model is crap. 02:40.900 --> 02:41.480 Right. 02:41.480 --> 02:42.260 Whatever. 02:42.700 --> 02:53.400 And then when I go look at the training available, the YouTube videos, the blog posts, I can focus on, OK, I know this now. 02:53.400 --> 02:55.040 Let me pick up the next topic. 02:55.160 --> 02:59.000 And it's based on I'm a nerd with lists. 02:59.480 --> 03:06.780 When I wanted to get into security, I came up with a list of 10 things I felt I needed to know. 03:07.220 --> 03:08.780 And I learned one of them. 03:08.900 --> 03:12.980 And then I had a list of 37 things that I needed to know. 03:12.980 --> 03:14.600 And I learned another one. 03:15.060 --> 03:18.000 And I had a list of 53 things I needed to know. 03:18.000 --> 03:21.940 My list is currently somewhere around 8 trillion items. 03:21.940 --> 03:22.300 Right . 03:22.320 --> 03:35.600 And so what we're hoping to do is give people that list, not with 8 trillion items, up front so they can focus where their interest is instead of stumbling around. 03:35.820 --> 03:38.080 And, you know, OK, I got that. 03:38.080 --> 03:46.880 The thing I love about this, too, is oftentimes there's almost like two types of times you go, I want to learn, we'll say, hacking. 03:46.880 --> 03:48.420 I want to learn something. 03:48.580 --> 03:54.260 Usually it's I have a problem or I have a passion and I want to go fix it. 03:54.260 --> 03:58.160 So I want to go learn how to hack websites because I think it would be fun. 03:58.160 --> 03:59.980 And I think that's a great reason just to learn. 03:59.980 --> 04:01.760 I want to learn this because it's fun. 04:01.820 --> 04:04.340 Then there's other times you go, OK, this was fun. 04:04.340 --> 04:05.420 I've learned this hobby. 04:05.420 --> 04:07.580 Now I want to turn this into a career. 04:07.580 --> 04:13.780 In a big problem you're hitting on, this is this whole like common idea of like you only know what you know. 04:13.780 --> 04:13.920 Yep . 04:13.920 --> 04:16.040 If I want to know, I want to go into web security. 04:16.300 --> 04:22.240 I will go, OK, I'm going to learn OWASP, SQL injection, cross-site scripting. 04:22.240 --> 04:26.880 But then you're like, oh, I also need to learn RESTful APIs and I have to learn. 04:26.880 --> 04:27.480 Oh, yeah. 04:27.980 --> 04:29.640 SSL needs to protect those things. 04:29.640 --> 04:31.160 So I kind of need some of the networking. 04:31.160 --> 04:33.480 But that stuff also sits on top of Apache. 04:33.480 --> 04:35.200 So I need some of the infrastructure stuff. 04:35.200 --> 04:40.100 And with your example for SSL, actually, you need to know TLS. 04:40.260 --> 04:44.180 And you screw people up with these acronyms and things they need to learn. 04:44.180 --> 04:45.000 So I'm sorry I cut you off. 04:45.000 --> 04:45.940 No, you're good. 04:45.940 --> 04:46.080 Yeah . 04:46.080 --> 04:56.020 So what I love about this, though, is if that whole concept, if you only know what you know, is this framework idea would help focus you towards a career. 04:56.020 --> 05:01.360 Instead of going, I'm following my passions, I want to learn web testing. 05:01.360 --> 05:10.240 I want to learn how to be a penetration tester or a web application penetration tester, whatever your resources would lead me. 05:10.240 --> 05:12.780 Not necessarily they wouldn't be the resource. 05:12.780 --> 05:13.140 Yeah , yeah. 05:13.140 --> 05:18.740 Matter of fact, we're purposely trying to do this so that we're not releasing training. 05:18.740 --> 05:20.900 And I want to be clear, I'm biased. 05:20.940 --> 05:22.880 My organization does training. 05:23.340 --> 05:32.260 So we don't want this to be a training resource because what we've found over time, and I'm not going to name ISC Square and EC Council and SANS out loud. 05:32.260 --> 05:32.780 Yeah, of course. 05:32.780 --> 05:33.960 Yeah, no, not going to name them. 05:34.080 --> 05:42.860 What you see is companies, none of them named, go out there, they start with really good missions, right? 05:43.120 --> 05:45.040 And then it's $8,000 for a class. 05:45.200 --> 05:47.760 Or they plagiarize a class. 05:48.260 --> 05:51.300 So the goal is let's not compete there. 05:51.300 --> 05:54.180 Let's support whoever wants to train. 05:54.180 --> 05:55.300 And I'll give you an example. 05:55.520 --> 05:57.000 Tim Tomes, right? 05:57.000 --> 05:58.820 You may know him, right? 05:58.820 --> 05:59.580 Practice Sec. 05:59.580 --> 06:01.880 He's got this course on web pen testing. 06:01.980 --> 06:03.820 Frigging awesome, right? 06:03.860 --> 06:08.300 But how do you know that his course teaches you to be a pen tester? 06:08.300 --> 06:10.500 Now, I'll tell you it does because I know Tim. 06:10.760 --> 06:16.520 But this framework, you can look at the framework and say web pen testing, dump, dump, dump, dump. 06:16.520 --> 06:18.500 Tim Tomes' class, bump, bump, bump, bump. 06:18.500 --> 06:19.660 They match. 06:19.660 --> 06:24.300 That means this course is hopefully, it doesn't guarantee it. 06:24.300 --> 06:25.520 It doesn't, you know what I mean? 06:25.520 --> 06:27.000 Like it's not absolutely. 06:27.000 --> 06:32.280 What's interesting about this is it's very similar to something like a NIST or an ISO framework. 06:32.280 --> 06:37.680 Because you go, just because you're NIST compliant doesn't mean you're secure. 06:37.680 --> 06:40.260 Just because you're ISO compliant doesn't mean you're secure. 06:40.260 --> 06:44.040 But it's the framework that drives you towards security. 06:44.040 --> 06:45.480 Again, you have a control. 06:45.480 --> 06:47.040 Those controls dictate policies. 06:47.040 --> 06:48.880 Policies dictate procedures. 06:48.880 --> 06:50.140 Procedures need evidence. 06:50.140 --> 06:56.900 But it's a framework because that framework is going to lay out, you should know these concepts and these concepts. 06:56.900 --> 06:57.680 Absolutely. 06:57.700 --> 06:59.140 So we've been talking this whole time. 06:59.140 --> 07:02.920 And I'm fascinated because I talk about this for hours now because it helps. 07:02.920 --> 07:08.740 This actually satiates a need in the industry, which I think has been there for a long time. 07:08.740 --> 07:13.220 Because oftentimes you go, go to TriHackMe, go to PicoCTF. 07:13.400 --> 07:15.900 But you lose some of these other skills. 07:16.300 --> 07:27.260 Out of curiosity, when you're designing this framework, how much of it do you also, I would say, encapsulate things like the soft skills, communication, writing skills, and things like that? 07:27.260 --> 07:32.720 Because, God, I'm blanking on the guy's name that just did a talk that was amazing. 07:32.720 --> 07:34.560 Jason Haddix shared it with me. 07:34.860 --> 07:38.100 I'm saying that because I'm trying to think of the, okay, I'm not going to remember it. 07:38.100 --> 07:43.780 But he did this awesome talk about how, you know, it's great that you know how to pop shells. 07:43.780 --> 07:45.420 And that's awesome. 07:45.420 --> 07:47.580 But can you talk to an executive? 07:47.620 --> 07:50.780 Can you, you know, communicate in the report? 07:50.780 --> 07:52.040 Can you write a report? 07:52.040 --> 07:57.480 I have argued this point previously, saying that is the most important. 07:57.560 --> 08:00.760 It's the only thing that stays after you leave. 08:00.880 --> 08:01.680 Exactly. 08:01.720 --> 08:03.660 That's the only product the client gets. 08:03.660 --> 08:07.840 If you're the best tester in the world, but the report's crap, overall, the test was crap. 08:07.940 --> 08:09.160 Yep, absolutely. 08:09.160 --> 08:10.100 So keep going, I interrupted. 08:10.100 --> 08:10.880 No, no, no, it's okay. 08:10.880 --> 08:11.360 That's the shit, man. 08:11.360 --> 08:13.580 It's what I do, right? 08:13.580 --> 08:17.680 So this is, the idea is to encompass all of that. 08:17.680 --> 08:19.720 And then we work with, like John Strand. 08:19.720 --> 08:21.780 I don't know if you know him from Black Hills, right? 08:21.780 --> 08:23.920 He runs the anti-siphon training system. 08:23.920 --> 08:26.620 And he, what I like about this, not pimping something. 08:26.620 --> 08:28.140 Well, okay, maybe I'm pimping it. 08:28.140 --> 08:29.120 But it's okay. 08:29.120 --> 08:30.100 Not sponsored. 08:30.180 --> 08:30.820 Yeah , yeah, yeah. 08:30.980 --> 08:38.040 But with John Strand's anti-siphon, what John has done is he's gone out and grabbed the best of the best instructors. 08:38.040 --> 08:39.780 Doesn't matter who they work for. 08:39.800 --> 08:42.100 Doesn't matter if they compete with him, whatever. 08:42.100 --> 08:43.320 And he's brought them together. 08:43.320 --> 08:46.980 He'll say, he's brought the best of the best and me, right? 08:46.980 --> 08:54.440 So, but he's brought all of these people in to give practitioner training. 08:55.080 --> 08:57.120 He's got instructors, right? 08:57.120 --> 08:58.260 And that's awesome. 08:58.920 --> 09:02.320 We see that come out of lots of people, like Tim Tomes. 09:02.360 --> 09:04.540 He's not, as far as I know, he's not part of anti-siphon. 09:04.540 --> 09:05.400 He does his own training. 09:05.400 --> 09:06.400 He does great. 09:06.400 --> 09:10.640 You see stuff like, you know, Chris Sanders' training classes, right? 09:10.640 --> 09:14.520 How do we get, and Chris Sanders has the soft skills training that's awesome. 09:14.740 --> 09:18.900 How do you get that type of stuff to fit a framework? 09:18.920 --> 09:20.160 We got to have the framework. 09:20.460 --> 09:22.520 Yeah, so that's what I think. 09:22.520 --> 09:25.320 The funny thing you said is you're like, he has amazing people. 09:25.320 --> 09:26.540 And me, I have cracked up. 09:26.540 --> 09:29.640 This has happened twice since I started a YouTube channel. 09:29.640 --> 09:29.740 Right . 09:29.740 --> 09:34.940 Someone goes, I just want to thank, just these people have just had, you know, taught me so much. 09:34.940 --> 09:39.260 And they're like, Network Chuck, John Hammond, Alex Chevre. 09:39.260 --> 09:45.120 And it's like, this great person, this awesome person, and this guy. 09:45.120 --> 09:47.120 And it's like, what are you doing? 09:47.120 --> 09:49.220 Yeah, totally, right? 09:49.220 --> 09:50.960 So where is the framework right now? 09:50.960 --> 09:51.740 Is it finished? 09:51.740 --> 09:52.940 Is it version one? 09:52.940 --> 09:54.480 It's not even version one. 09:54.480 --> 09:56.820 We've just started making it public. 09:56.820 --> 10:00.440 We've been working on building a structure. 10:00.780 --> 10:03.820 It's on GitHub, is where the projects are. 10:03.820 --> 10:08.880 You can actually reach out to me at Kevin at OpenSBK.org. 10:08.880 --> 10:09.280 Excellent. 10:09.280 --> 10:11.260 I'll include these links in the description below. 10:11.260 --> 10:12.180 I appreciate that. 10:12.180 --> 10:16.660 Or, you know, at Kevin at secureideas.com, which is actually my real email address. 10:16.660 --> 10:23.960 But , you know, and what we're doing right now is we're trying to get people to help us build this. 10:23.960 --> 10:31.820 Because what I want to make sure of is, and my biggest fear for this project, is that it becomes some corporate bullshit. 10:32.040 --> 10:37.100 We're pimping this class through this framework, and it can't be that. 10:37.100 --> 10:38.460 Yeah, it has to be. 10:38.460 --> 10:40.980 You don't want to have the high trust problem. 10:41.380 --> 10:41.780 Exactly . 10:42.120 --> 10:50.080 For anyone who doesn't know, you have NIST, you have ISO, and then you have these people who made a great framework in some ways. 10:50.080 --> 10:52.080 I was going to say, I don't know if I agree. 10:52.080 --> 10:52.720 Arguably. 10:52.900 --> 10:53.700 Arguably. 10:54.460 --> 10:59.920 But then they go, oh, and it's a good framework that you have to pay a remarkable amount of money for. 10:59.920 --> 11:01.580 But have you actually read the license? 11:01.900 --> 11:02.700 I have not. 11:02.700 --> 11:05.620 Actually, I have another person on my team who probably has, but I have not. 11:05.620 --> 11:09.100 So what you're going to want to say right now, because I believe you're a consultant like me, right? 11:09.100 --> 11:09.460 Yep. 11:09.460 --> 11:18.560 So you're going to say right now that a guy on my team has never purchased that framework because the license forbids consultants from buying it. 11:18.560 --> 11:20.800 I can honestly say he has not. 11:20.800 --> 11:22.420 We do virtual CISO work and stuff like that. 11:22.420 --> 11:23.540 Good answer, good answer. 11:23.540 --> 11:25.960 Because what the hell? 11:26.300 --> 11:34.820 They build a framework that they're going to enforce on people, and then they say, yeah, you people who help companies get there, you can't read it. 11:35.380 --> 11:38.460 Yeah, it's utterly ridiculous. 11:38.660 --> 11:39.920 How many frameworks out there? 11:39.920 --> 11:43.300 How many of those standards, ISO, that cost money to even see the framework? 11:43.300 --> 11:45.100 This is like an XKCD comic. 11:45.100 --> 11:46.860 I love that comic. 11:46.860 --> 11:51.500 I love the comic where it's like, there are 15 standards to be able to do this thing. 11:51.500 --> 11:53.340 And someone goes, this is so stupid. 11:53.340 --> 11:54.440 There's 15 standards. 11:54.440 --> 11:56.480 I'm going to make one standard to unite them all. 11:56.480 --> 12:00.260 And the next frame is, there are now 16 standards to do this thing. 12:00.260 --> 12:04.740 And that's what we're afraid of, is we don't want those types of things to happen. 12:04.740 --> 12:05.700 So that's what we're working on. 12:05.700 --> 12:06.980 I love this idea. 12:06.980 --> 12:08.240 I really do. 12:08.240 --> 12:15.320 Because if you want to dive into this field to be able to say, incident response, pen tester, what other ones is there? 12:15.880 --> 12:27.200 So we're doing like malware analyst, we're talking reverse engineer, we're talking secure software developer, we're talking SOC analyst, threat team, threat hunter, threat modeler. 12:27.200 --> 12:32.420 We're using the NIST NICE job descriptions is what we're basing it on. 12:32.420 --> 12:36.160 And that's actually trying to not have another standard. 12:36.160 --> 12:38.480 Let's not make up new jobs. 12:38.480 --> 12:42.340 Let's use one that people have blessed somehow. 12:42.760 --> 12:44.060 I love this. 12:44.060 --> 12:45.740 Thank you so much for coming on. 12:45.740 --> 12:48.500 This is actually a legitimately cool project. 12:48.500 --> 12:49.320 I appreciate that. 12:49.320 --> 12:50.040 I appreciate that. 12:50.040 --> 12:51.880 The whole concept I love. 12:51.880 --> 12:53.440 Thank you for coming on. 12:53.440 --> 12:55.080 Thank you for watching. 12:55.080 --> 12:57.980 And as always, HACK ON!