Brianne Fahey

Knowledge

Information Security Writing

by

Learn a byte at a time.

About a month into the year, I’ve completed my first planned personal training goals: Chris Sanders’ Applied Network Defense course called Effective Information Security Writing.

This course is absolutely worth the cost!

Write Now, Reference Later

I’m a firm believer in capturing information while you’re attaining it with the goal of ultimately having a polished reference page or standard operating procedure. My process involves creating a lot of short & sweet OneNote pages as things are happening that I can revisit to combine, order, and edit later.

Writing things down is not a popular pastime among my peers. Events come in high volumes and move fast.  Capturing details seems like a luxury. I never regretted having a slick wiki page to reference when I was on-call or entering an incident analysis cold. I figured no one was into using my help pages as much as me until I was contacted via LinkedIn by a colleague from a former job to thank me for writing guides five years earlier for a tool he just inherited without much time to get up to speed.

What worked for me?

The Effective Information Security Course offered a mix of videos, exercises, templates, and online discussion.  I’d recommend it to anyone who is asked to write documentation, even if it is not the exact types of reports this course covers. The course is extremely relevant if you’re already writing reports for pen tests, vulnerability compromise reports, or case notes.

Taking time to see something through another person’s point of view often reveals your own biases and blocks to help you become aware of how you can improve. I learned that the executive summary is typically the last section of a report you write – not the first as I had been doing.  This makes total sense. Get out the long parts first and then condense it down into the highlights.  Seems so obvious but since it was logistically first int he report, it never occurred to me to write it at the end. Simple and impactful.

Completion Note

 

I thrive on courses that are flexible, and that don’t require me to be sitting a a computer the entire duration.  I could take a walk and listen to a few lectures – then settle in at my desk to try the exercises. I finished the course in roughly 10 hours over a month of nights and weekends. I started both EISW and Practical Packet Analysis at about the same time since I knew the latter would require much more attention (and time).  I had no trouble switching back and forth between the two courses while keeping track of the path and the ideas in the lessons.

Find out for yourself!

Check out the course details and consider adding this one to your own personal plan.

Visualizing a Plan

by

Getting Somewhere

When I’m out on a long walk, I orient and motivate myself by saying “if you can see it, you can get to it”. This is particularly useful on a day when all the elements are in your favor, but holds true even when the path is less certain.

Quick, Rough, and Useful

Instead of making resolutions this year, I sketched up a quick visual map of my learning plan. Once everything was out on paper, I could see it was too much to tackle immediately, but by bringing it onto a timeline, I could start to orient and adjust. Duration, priority, and opportunity all play into when and how I can start to address some of the things I want to learn more about.

Visual Map of my Personal Plan

Seeing It is Motivation

I’ve already started acting on it and I’m open to adapting the plan when life and work and time and opportunity start having their impacts. Nothing is set in stone, but I have an idea of where I’m going.  I’m motivated to do something, so let the lessons continue and the skill set evolve.

Learning is Living

by

There are so many things I want to know…

I regularly scan for stories and use cases that will inspire good work and sharpen what I can offer.  As a result, I read about a lot of tools and theories that I am not familiar with.  Knowledge requires information and growth requires experience.  I’ve always been a fan of the idea of writing down any term or acronym you see or hear in use and if you don’t have a chance to ask about it immediately – Google it later.

Today is always a good day to start.

Personally I keep a running list of things I want to lean more about.  That way when I see an opportunity to pick up an ebook, watch some recorded convention talks on YouTube or take advantage of a training deal, I know where to start. Because the list is sometimes overwhelming, I use a priority system that keeps me focused. Chris Sanders offered a fantastic discount on his Applied Network Defense courses at the end of 2017 and I could not pass up the opportunity to learn from him.  I saw Chris speak at BSides Cincy this summer about Curiosity as a necessary analyst skill. He is intelligent and inspiring.  Plus he knows what the heck he’s doing and I love his philanthropy goals for the Rural Tech Fund.

All this is shaping my early 2018 personal learning plan around these 3 Applied Network Defense Courses:

Some of Chris Sanders’ Applied Network Defense Courses

Keep building yourself.

I know I have a lot to learn.  I keep pushing myself to ask questions, admit when I need to do more research, and listen to the inputs of my friends and colleagues.  Listen to the experts and those willing to teach, like Chris Sanders. It will stoke your curiosity and possibly even inspire you.