The first time I broke into my neighbors wifi
I was about 12 years old.
Everyone was using WEP encryption at the time,
so cracking the keys took just a minute.
But from start to finish it was actually
a 6 month process for me of study
and fooling around.
Pretty rewarding in the end,
but looking back, it was probably also super illegal
and I wished there were more tools out there
to help me learn easier,
not just hack wifi networks.
That's because one of the hardest things
about cyber security is there's
no formal roadmap and a million different
places that you can start,
that lead you down a million other rabbit holes.
Here's an example.
Let's say you wanted to figure out how
a computer knows what type of a file
something is.
Cause I'm sure you know changing the
extension from PDF to PNG doesn't change
it's actual file type.
You know that, right?
Maybe someone told you about the Linux
file command, so you look it up
in the man pages.
You start to fall asleep reading this until
you see the words "magic tests".
Oh, that seems interesting.
So you search it up on Google and find
a bunch of unrelated results.
Now you've got to figure out how to
customize your search query and start
learning about Google's advanced search operators
which helps whittle away
some of the results, and you finally find
something that looks promising.
Github seems close enough.
But what's Laravel?
There's some code and browser tests...
let me go back and put "file" in quotes.
Ah, StackExchange, everyone's favorite.
We get answer explaining how certain files
begin with certain headers,
but now you're confused why PNG
has backslashes, but a Java class doesn’t.
What is a Java class anyways,
is that a class on coffee?
The guy linked to a Wikipedia article,
but looking at it, you start to wonder if
you should have just read the man pages
in the first place.
By now, you’re burnt out,
and about ready to drop money on that
one-week cybersecurity bootcamp
or crash course.
And even then, you might end up feeling
completely lost and not able to see
how concepts fit together.
I've certainly been there.
Which is why today I want to show you
5 simple things you should start doing
to learn concepts faster and get unstuck
more easily in your cyber security
learning journey.
And at the end of this video,
give you a quick demo on how I’d combine all
these methods to learn something new
for the first time.
Let’s go
The first and most important way to learn
cyber security faster and easier is to focus
on topics related to your existing
meaning structures.
You see all of us come with some level of
background knowledge in a field or
area of expertise.
There’s a lot of things you already know
and understand very well.
The closer and more connected the skill
you’re trying to learn is to the stuff you
already know, the faster it is to acquire.
That’s why it’s much easier to get into
cyber security if you come from an IT or
Computer Science background, fields that
involve working with software, systems,
networks, than if you came from another
field, like being a mechanic,
English teacher, or security guard, where
your existing meaning structures are
much farther away.
Jumping straight into a cyber security
specialty like pentesting or threat intel
because it sounds cool or pays well is so
far removed from what you currently know
that you’ll waste a lot of time covering
missing ground and getting stuck.
Chris Sanders, who wrote a lot of great
cyber security books and courses on
blue team operations explained it like this:
Learning is a complex thing.
It requires approaching information
in different ways.
Things like learning styles where people
prefer like auditory versus visual, whatever,
that's mostly a myth and I haven't really
found that's a true thing in research.
Connecting with people where they are
and their existing experience is a thing.
And that's a very hard thing to do.
For people who describe themselves as
visual learners, sometimes I wonder if it’s
because imagery taps into our existing
meaning structures and makes new ideas more
relatable, compared to someone just talking.
Turn to page 394.
But fortunately, cyber security has a lot of
different related subfields, so you can
always find some niche that connects with
what you already know.
For the mechanic, it could be learning
hard drive repair and data recovery, which
then naturally tie into disk and
memory forensics, useful skills to have on
incident response teams.
For the English teacher, you could start off
learning to be a technical writer on
cyber security topics, documentation for
tools, or security reports.
For the security guard, you might want to
start off by learning more about physical
security operations and access controls
which could then tie into physical pentesting
and software access controls.
Even while you’re studying a topic,
don’t just go in the order that
information is presented.
Find out what concepts are most proximate
to what you already know and take
a nonlinear learning approach.
Following strategy might require you making
a few extra hops, but in the end it’s going
to help you build more knowledge and reach
your final goal faster.
But now you might be thinking
“Okay, what if I found a cyber security
course teaching something that seems
close enough to stuff I already understand,
so does it make sense to pull the trigger
and buy it?
So I don’t like poo-pooing on cyber security
bootcamps and crash courses because I’m all
for more resources and education out there…
but I’m gonna hate on them just a bit.
Here’s why,
Get your six-figure cyber security dream job now
by attending our 5-day Teleseer bootcamp
and become a Cyberspatial-certified
network cartographer.
No experience required, you’ll get all you
need from our world-class instructors
so hurry up and give us your money today,
satisfaction guaranteed.
See the problem with short-term courses is
they don’t fit well with our biology.
People learn best by interleaving small
doses of theory and practice together over time.
Not absorbing massive chunks of knowledge
in just one or two weeks, where you’ll
probably forget most of what you've learned,
versus spacing things out.
Our industry tends to shy away from college
in a lot of ways.
One of the things college does well is they
space things out.
There's a reason when you have a college course,
it's spaced out over several months
and not just packed into a week.
And that's because a lot of magical things
happen when we sleep.
And when we leave a topic for a certain
amount of time.
When you’re learning something new,
oftentimes what you think is a mental block
is actually a physical block that gets
removed when you sleep on it.
Your spinal fluid washes away the plaque
build-up on your neurons, memories and
emotions get solidified, and your neural
pathways change in ways that help you
understand the same thing from
different perspectives.
Spacing out your learning schedule with more,
smaller doses is the best way
to make this happen.
So instead of banging your head against
a brick wall, sleep on it for a few days
and you'll quickly find ways to go over,
under, around, or through it.
I understand bootcamps and crash courses
are gonna be valuable for a lot of people,
but definitely consider the biology of
learning as well if you’re dead set
on doing them.
So what about university?
Does it make sense to go to college to
learn cyber security?
Especially if there’s a teacher you know
and really like who works there?
Here’s the deal.
There’s almost nothing you can learn in
school about cyber security that you can’t
learn outside of school.
Back in the day, knowledge was tied up in
institutions like universities, but now
podcasts, digital books, web content, have
democratized it to the point of being free.
So you’ve got to ask yourself
What’s the value I’m getting for the
premium price I’m paying?
And the answer is usually
access to the teacher.
For IT and cyber security, you’re typically
going to want teachers who are practitioners
themselves, otherwise you’ll just get a
bunch of theory and research.
Which of you can tell me the difference
between an animagus and a werewolf?
No one?
How disappointing….
But too often do I find people asking to be taught,
as if all they needed was to be
shown how to do X in order to learn Y.
And unfortunately, that’s also what a lot of
practitioners do when it comes to teaching.
Most people in information security who do
education are practitioner educators.
So they're practitioner first,
educator second.
The default thing that most people would
think is, okay, I'm good at this thing.
So I will show someone how to do this thing,
and then they will be good at it.
That's not really how humans learn.
It's not just a matter of watching someone
do something once and we've really got it,
particularly for really complex tasks.
And, most of what we do in our world
is pretty complex.
relatively speaking.
What Chris describes is
The “curse of knowledge”,
where once you’ve gotten to a certain skill level,
it’s hard for you to see how others don’t
understand what you know, or that it’s just
a matter of showing someone how
to do something.
I struggle with that bias myself.
To really get that transfer of experience
and skill from someone,
what you should do is
ask teachers to assign projects that they
know how to do, go through the trial and
error process of doing it, while getting
feedback from them during the struggle.
It’s that cycle of deliberate practice
combined with feedback that makes you build
expertise really fast.
Not passive learning, not show and tell.
Which is why most cyber security folks will
admit to you they learned the most
on-the-job and not in school.
So rather than paying tuition to a school,
where maybe a fraction of it goes to the
teacher, you could just pay the teacher
directly for their time, giving feedback
as you’re working through specific,
scoped projects.
If you can’t find anyone or it’s too expensive,
team up with a group of peers
who are a little more advanced in IT
and cyber security than you are,
and pay them instead.
But now you might be wondering,
“What if there’s just a ton of theory and
background info I need to learn to be able
to practice projects in the first place?
It’s kind of overwhelming!
To handle these situations, you’ll
definitely want to be building mental models
and systems for yourself as you’re learning
new things, instead of just memorizing
stuff in isolation.
A mental model is just a way of
organizing information.
How we organize information helps us a lot
more often times than the amount of knowledge
that we accumulate cause we could structure
it better and access it in better and
more unique ways.
A lot of expertise is not so much about
accumulation of knowledge, it's about better
organization of knowledge.
Here’s a few useful mental models in
cyber security I find useful that you can
use to organize knowledge.
The first is the OSI model, which has
several layers describing how close
something is to the physical hardware,
versus application software.
When you’re learning about tools or how
something works, the mental model helps you
think through which layers of the networking
stack they interact with.
Let’s say you try to connect to something
and there’s no connection,
having the model can help you troubleshoot.
Maybe you’re not plugged in or have a bad cable,
maybe there’s access controls in place,
maybe you have a IP subnet typo,
your DNS name servers aren’t connected,
or the remote server is down.
The more experience you have with this
mental model, the easier it is to
troubleshoot problems and figure out
how apps work.
A second mental model is defense-in-depth,
which basically means instead of just
having a on the front door of your house,
maybe you’ll have locks on every other door too,
with multiple security zones inside.
And then you’ll layer on cameras, guards,
lights, attack dogs everywhere,
not just the perimeter.
When you’re learning about a network,
device, or app, defense-in-depth helps you
think about all the areas that can be
exploited and need security controls.
Two other mental models are timelines
and minefields.
Timelines are useful for blue team ops,
where you pivot from discovering one
security alert to uncovering all the other
events that happened on your timeline for
a full story of what happened.
On the other hand, for red team ops,
treating your target network like a
detection minefield can help you think about
which areas have honeypots, endpoint
protection, or extreme monitoring, which can
then help you know which tools and techniques
you should use to avoid getting caught
by the blue team.
As you learn more about cyber security,
you’ll acquire a bunch of mental models and
personalized frameworks that can help you
handle any new topics or ideas you come across.
But what if you don’t even know where to start
or feel smart enough to build mental
models in the first place?
Like… you don’t even have a
good research process for gathering information?
At that point, you should probably
just give up.
I’m just kidding.
When you’re dealing with a lot of dense
complex topics, what I like to do is to
decompose the pieces using a mind map,
which can become its own model.
Kind of like how you’d need house blueprints
to build a house or a network map to
understand a network.
The key thing is to be in divergent thinking
mode, where you’re thinking of all the
possibilities from a single data point,
versus being in super focused
analytical mode.
When you come across a word or topic,
write it down on a piece of paper, then
connect it to other pieces and related topics.
Continue connecting everything together,
until it’s mostly mapped out.
Then highlight the areas you don’t know
very well, then do a focused deep dive to
tie everything together.
Just make sure you’re updating the mind map
every now and then, to keep track of how you
arrived at a topic.
During a job interview when you’re asked to
explain how something works, it’s gonna be
really valuable to showcase everything
you know on the spot by retracing your
mind map or mental model.
So if I wanted to learn about file formats,
like at the beginning of the video, here’s
my process starting with mind mapping.
I’d begin by drawing some bubbles for file
formats, maybe a few like PDF, PNG.
Then maybe think through what scenarios
knowing about them would be important,
maybe data recovery, forensics, carving
files from PCAP.
I’d like to figure out the tools used to
detect file formats, and different tests
those tools use.
The man pages for the file command use
filesystem tests, magic tests, and language tests
which we need to go read more about.
There’s also different flags I can use for
the file command to explore.
During a Google search for a magic test,
I might realize the need to learn about
advanced search operators, Laravel,
Java Classes, and different header types.
I’d have to look up text formats for
backslashes and what looks like hexadecimal
characters, and learn about how data gets
encoded and stored as a file, and maybe how
files are stored on a filesystem.
After building the mind map, I can then skip
topics I’m not really interested in because
they don’t relate to any existing meaning
structures for me, and then highlight the
topics that do, like how files are stored on
a filesystem, because I know a bit about
formatting hard drives and USB sticks.
If I have access to a teacher, I might ask
them to give me some project ideas for
carving files from disk or PCAP using a tool
like Scalpel, then ask for feedback when
I explain my workflow and process.
If I didn’t have a teacher, I could find a
forensics Discord server or Slack channel
and ask people for resources they know of
that have guided practice labs.
I’d set a schedule to spend an hour every
day going through my mind map or practice
projects for an entire month.
This way I’m interleaving theory and
practice, spacing things out over time.
As I’m learning more about the relationship
between file formats, a mental model I could
use is thinking of them like food in a
grocery store, with the type of packaging
used indicating the contents that are inside.
I know it seems like a lot, but believe it
or not, you’ve probably done all of this
before in one way or another, even if just
playing video games.
Mind mapping ideas, picking the easiest and
most relevant topics to learn first,
practicing something and getting feedback
from someone, and doing it in
small doses over time.
It’s how we as humans learn, and you just
need to apply them to other fields like
cyber security.
Are there any learning tools or frameworks
you really enjoy using and wanna share?
Let me know in the comments below.
If visualizing abstract ideas with simple tools
is something you find really helpful,
check out teleseer.com.
We’re building a network mapping tool
for cyber security and IT practitioners
just like you, so sign up to get notified
like you, so sign up to get notified
when we launch.
But that’s it for this video on learning
cyber security faster and easier in
5 simple steps.
Like subscribe, and share it with
others you know.
Thanks so much for watching,
and I’ll see you soon.