2024-10-12 22:09:00
I volunteer for Wiccon, a cybersecurity conference here in the Netherlands. Last year I gophered on-site and did a presentation on stage. This year I'm gophering again, I helped in the CFP (call for papers) and I'm in charge of the gopher-planning. I'd also submitted an abstract, which was ultimately not chosen.
A few days ago Chantal reached out to me, if I could maybe do my proposed presentation after all because another presenter became unavailable. After some thinking and puzzling I thought I could make it work. I had nothing but my abstract, but with 2.5 weeks remaining I could maybe make it work. Right?!
Well, it's caused me a lot of anxiety, to be honest! As I said, I had only the concept of what I wanted to present about, but not even a skeleton or a set of research. I'd not worked on that since my CFP submission was rejected.
This morning I reached out to Chantal and Dani to tell them I couldn't do it.
I'm preparing to teach four classes (DevSecOps in October, Linux+ in November and Linux Essentials and LPIC1 in December), I've got family matters and my primary customer. Shuffling priorities would free up some time, but going from zero-to-complete is simply not possible. I can't do it.
It's ironic that I would fall for this trap, even after telling Roald not a month ago that "I want too much, I'm too greedy".
It felt like I was letting down valued colleagues, friends even. I'd promised to help them, but I can't. If I did, my health and sanity would suffer, to the detriment of all other commitments I have. So I won't do it.
And it's okay. I'm telling myself that and so are they. It's okay if you can't do something. If I can't do it.
View or add comments (curr. 0)
2024-10-12 20:00:00
In 2019 I took a class with Russell Eubanks, SEC566 - Implementing the Critical Security Controls.
Lots of people associate SANS with "super-duper-technical" trainings, which SEC566 was not. It was more about understanding the many, many layers of security controls which an enterprise can (should?) apply to properly secure its assets. I learned a lot back then and the group discussions with fellow students were the biggest value-add.
Last week I participated in Russell's LDR521 - Security Culture for Leaders.
If you'd asked my if I'd see myself as a leader, even until a few months ago, I would've said "no". That's crazy, right? I'm just this gal, you know?
I always associated "leadership" with "management". Or even "higher management". But while I've been waxing introspective the past months, I realized that the past three to four years I have in fact been acting in a leadership role. As in: leading by example.
I've helped start two brand new DevSecOps teams, both having common goals:
Heck, a few years ago my team at the time got an in-house award, for leading security culture! So yeah. I guess I am in a leadership role now!
Which is why I applied for a SANS Facilitator role for LDR521, a security culture training developed by Russell and the famous Lance Spitzner.
There's literally no technological learning to this class, it's all about understanding business, management, finance, "selling" to your audience, training and more. All the things you need to understand, to pick apart existing culture, so you can affect change.
The two taglines for the class are on their challenge coin:
As is expected of SANS, it's "drinking from the firehose". There's an incredible amount of information to take in during the four days of class. While LDR521 doesn't have an exam of its own, you could say the fifth day itself acts somewhat as an examination! The capstone project has our teams tackle six challenges in improving security culture at the fictional family-owned Linden Insurance. It's hard work! Every challenge needs you to dig deep and remember the lessons you were taught in class. If not? Culture at Linden remains suboptimal or even suffers!
Coming from a highly technological background, the LDR-series of trainings requires that you drop your preconceptions about "what is right".
I for one hold strong opinions about the Right Course to sail and I have on multiple occassions been frustrated with management not understanding why my team was Right. I have an ingrained allergy to "the suits" and have had a disconnect between "mission, vision, strategy" and what we were doing in tech.
Well. This class helped break down walls which were already cracking.
Thanks to this class I have formalized things I have been doing the past five years. My teams were somewhat successful at guiding security culture, now I know there's actual words for and theory behind what we were doing. And yes, I am now starting to understand why aligining with "mission, vision, strategy" plays such a big role in culture. Heck, now I even know what this "culture" actually is! It's that iceberg-under-the-water, the "perceptions, attitudes and beliefs" that LDR521 so heavily features in its slides, them and challenge coin.
I very much would like to also do the other two classes in this leadership triad, LDR512 (security management essentials) and LDR514 (security planning and strategy). And once 521 gets an exam, I'll jump on it!
For now? My brain is mush. I need to deflate, reconnect with my loved ones after a week of absence and then I'll go over all the materials a second time. I need to solidify my understanding!
kilala.nl tags: work, studies,
View or add comments (curr. 0)
2024-10-12 19:29:00
Five and a half years ago I took my first SANS training, SEC566, which I worked as so-called Facilitator. This week I repeated the experience, for a newly updated training: LDR521 - Security culture for leaders. I will discuss the course in a separate post.
My experience as Facilitator in the SANS Work Study program echoes my 2019 trek: highly positive.
To remind you of what the Work Study program entails: if accepted by SANS as "Facilitator", you will participate in a SANS training while at the same time helping SANS staff run a successful event. Primarily you are there to help your teacher with things they may need (call it a gopher, a runner, an errand person).
Secondarily you will also help classmates with questions and you may end up helping them setup their lab system. Aside from that: you act as SANS rep to welcome all guests during breaks, to ensure everyone's feeling good and happy.
In return, you gain a big fat discount on your training package. You are also given access to the on-demand class and (if applicable) you receive an exam voucher.
In my case, LDR521 does not include an exam, so I got the training, the on-demand and access to NetWars Core. Normally that would rack up a bill of around €12.000. As Facilitator, my company paid €2.300 on the final bill.
As I said: big fat discount.
What did I do for this?
Since five years ago, a number of things have improved! Changes from 2019:
Now, after the full week I am absolutely drained.
Twenty years ago, I described PCD: post-convention depression, after coming home from AnimeCon. Coming home after a week of SANS is very similar! My brain is mush, my social battery is dead and the sudden switch back from "150 cool people all working hard at learning" to "my usual routine" is harsh.
Working with my co-Facilitators was a joy: they were a great group of people, I thoroughly enjoyed their company. My class was good, properly "drinking from the firehose" as is behooves SANS. The legwork and social interactions left pretty tired by Thursday already!
Is it worth it? Absolutely. Working with these awesome people is the best, the discount is just a bonus. I'm shooting for LDR512 or LDR514 in May.
kilala.nl tags: studies,
View or add comments (curr. 0)
2024-10-08 10:14:00
This morning I made a difficult choice: I left a community I'd been a very active part of for years.
The /r/comptia study group on Discord was a highly active community when I joined in 2020. Dozens of people would chat every day, while preparing for one of many CompTIA certification exams. My original goal of joining, just like with joining the /r/comptia sub-Reddit, was to offer mentoring and coaching.
Per the start of this year I volunteerd to co-moderate the group on Discord. Despite dwindling activity over the years, trolls and spammers were still very active and the moderation team could use the help.
What also changed over the last years, is that some community members got more vocal in their political discussions in the #breakroom channel.
At times I would contribute to the discussion, offering a left/socialist/progressive point of view in a discussion that was very much right/conservative oriented. At other times I would attempt to steer the channel towards halting the discussions as I felt they were drifting further away or even discouraging the actual, intended purpose of this Discord community: providing a welcoming studygroup for anyone and everyone.
With the upcoming elections in the United States, I have noticed an uptick in the conservative diatribe in the breakroom including exchanges which could be characterized as "dog whistles": sentence of ambiguous and figurative language which make hide the sometimes extreme points of view under a veneer of deniability.
I feel that this situation not just detracts, but goes against the goal of our community. I feel that many students would be actively dissuaded from participating in the studygroup, because of these messages.
I decided this morning that I have two choices.
I can remain part of this community, trying to provide a counterpoint to these messages. Or maybe I could try to moderate more heavily, steering away from these discussions. But given that one of the active contributors to these extreme discussions is a co-moderator, I don't feel this stands much chance.
Or, I could leave the community because staying implies that I tolerate or even support these points of view being ventilated so openly in a shared space. Tieing my name to such a community, implies that I'm okay with scaring off a large group of students.
I chose the latter.
I publicly announced why I left, also sending a private message to the people involved. With one person I also decided to unlink on LinkedIn, clarifying again why I felt the need to do so.
What I didn't expect to happen was that someone whom I'd trusted and mentored for two years, whom I'd help complete their master's capstone project, unlinked and blocked me in return (though without sending a message as to why). That was a big punch to my gut.
It was to be expected that I would be accused of being intolerant myself, of not "reaching across the aisle", of not "welcoming open discussion and respecting each others opinions", of not "looking beyond the message to see the person".
All of this is part of the Paradox of Tolerance. To quote the Wiki article:
If a society's practice of tolerance includes the intolerant, intolerance will ultimately dominate, eliminating both the tolerant and the practice of tolerance
Or to put it differently: simply by associating with people who utter extreme points of view, to an outside audience it implies that I endorse their message.
So I left. It cost me a community and someone I considered to be a friend. But I do not wish to be in a group where the rest of the moderation and admin team abide others creating an unwelcoming atmosphere.
kilala.nl tags: life,
View or add comments (curr. 1)
All content, with exception of "borrowed" blogpost images, or unless otherwise indicated, is copyright of Tess Sluijter. The character Kilala the cat-demon is copyright of Rumiko Takahashi and used here without permission.