Favorite Security Resources
Here’s an ever-changing list of some of my most frequented websites, blogs, twitter accounts, YouTube channels and Podcasts for Security information and news. If you have any recommendations, please let me know!
I use Feedly as my RSS reader.
Websites & Blogs:
Dark Reading: https://www.darkreading.com/
Bleeping Computer: https://www.bleepingcomputer.com/
ThreatPost: https://threatpost.com/
Troy Hunt’s Blog: https://www.troyhunt.com/
The Hacker News: https://thehackernews.com/
Security Week: https://www.securityweek.com/
Schneier on Security Blog: https://www.schneier.com/
Naked Security: https://nakedsecurity.sophos.com/
Malwarebytes Blog: https://blog.malwarebytes.com/
Krebs on Security Blog: https://krebsonsecurity.com/
We Live Security – Eset Blog: https://www.welivesecurity.com/
Security Boulevard: https://securityboulevard.com/
Good subreddit’s:
https://www.reddit.com/r/netsec/
https://www.reddit.com/r/cybersecurity/
https://www.reddit.com/r/AskNetsec/
Twitter Accounts:
https://twitter.com/NahamSec
https://twitter.com/gynvael
https://twitter.com/TinkerSec
https://twitter.com/bad_packets
https://twitter.com/LiveOverflow
https://twitter.com/campuscodi
https://twitter.com/binitamshah
https://twitter.com/tiraniddo
https://twitter.com/thegrugq
https://twitter.com/RobertMLee
https://twitter.com/briankrebs
https://twitter.com/jaysonstreet
https://twitter.com/hacks4pancakes
https://twitter.com/troyhunt
https://twitter.com/evacide
https://twitter.com/k8em0
https://twitter.com/MalwareTechBlog
https://twitter.com/HackingDave
and of course, Taylor Swift https://twitter.com/SwiftOnSecurity
YouTuber’s:
https://www.youtube.com/LiveOverflowCTF
https://www.youtube.com/RootOfTheNull
https://www.youtube.com/NetworkChuck
https://www.youtube.com/hackersploit
Podcasts:
Darknet Diaries
CISO Security Vendor Relationship Podcast
Cyber
Heavy Networking (networking)
IT Career Energizer (more general)
Threat Wire
Pfsense Router from old gaming PC
Ideally, I would sell these parts for profit and just buy a Netgate router to configure… but what’s the fun in that. I’ve always wanted to build my own, so I used some old gaming pc parts I had lying around, threw in a 4 port Intel NIC and installed pfsense. Part 2 will cover how I configure the device and use it in my home network.
Security+ Certification
Previous Experience: Very basic networking/security, SCCM engineer, Windows Administrator, 14 years of building computers
Study Time: ~2 weeks daily after work (I work full time) and weekends. Started seriously studying on 12/31. Took
Materials Used:
- Professor Messer videos on YouTube – watched the videos once through, passively but didn’t retain much info. Realized using videos for studying may not be for me unless I need additional explanation on a topic. https://www.youtube.com/playlist?list=PLG49S3nxzAnnVhoAaL4B6aMFDQ8_gdxAy
- Professor Messer Study Notes – $20 for the notes he uses in his videos. Was good for cross-referencing material a few days before the test to see details from a different source. https://www.professormesser.com/sy0-501-course-notes/
Comptia Security+ SYO-501 Study Guide on Kindle – Probably my top resource for studying. Good explanations. Good practice questions. Made flash cards of all the acronyms, ports, and key concepts from the book. So. Many. Flashcards. https://www.amazon.com/CompTIA-Security-Get-Certified-Ahead-ebook-dp-B07652KDXM/dp/B07652KDXM/ref=mt_kindle?_encoding=UTF8&me=&qid=1549133276Darril Gibson’s website for additional practice questions. I did not purchase the additional study guide, but I’ve read good things about it. I only used the free questions to get an idea of what to expect for theperformance based questions. https://gcgapremium.com/performance-based-question-demo/- The list of Security+ 501 objectives directly from Comptia’s website. I printed the list and reviewed it often starting a few days before the test to verify I knew each of the objectives and acronyms for the cert. https://certification.comptia.org/docs/default-source/exam-objectives/comptia-security-sy0-501-exam-objectives.pdf
- Udemy’s Mike Meyers Security+ 501 course – I only watched the videos on cryptography to get another angle on the topic. His videos are great and if I had time I would have watched more of them. https://www.udemy.com/comptia-security-certification-sy0-501-the-total-course
- Udemy’s Security+ Cert Practice Tests – good source of extra practice for the test. I found the questions in the
Comptia Study Guide fromDarril Gibson more like the questions on the actual test, but these tests from Udemy were still good to go through once. https://www.udemy.com/comptia-security-cert-sy0-501-practice-tests
Test Experience:
Since this was my first certification ever, I didn’t really know what to expect. I scheduled mine at a National Polytechnic Institute where they do a lot of medical training and testing of all sorts. I arrived at the testing center about 30min early (LA traffic is unpredicatable at times), and looked over my flashcards one last time. I went into the testing center about 10min early to sign in, fill out some documents and provide my 2 forms of identification (Drivers License and Passport). The receptionist then took my keys and passport (I was allowed to keep my DL, and I had left my phone in the car) and walked me into the test room. The test room is a small classroom size space with a closed door and about 30 computers. When I arrived the room was about 80% full of people sitting at the computers, typing away. I felt it was kinda odd having staggering test times, with people coming and going from the room throughout the process. The room was also very very loud from all the typing. I don’t know what type of tests they do in there, but some people were definitely writing essay’s. Thankfully, they provide earplugs. I didn’t put them in at first, but once the test started I quickly shoved them in my ears so I could think clearly. The computers themselves were definitely old and not in the greatest shape. They also provided a few pieces of laminated paper to write on and a sharpie.
As for the test, Comptia definitely loves their wordy, 5 sentence questions.. phew. Some questions I had to read multiple times just to figure out what they were asking. I did skip all of the performance based questions until the end. The first 10 multiple choice questions all seemed super tricky to me as well and halfway through the test I was convinced I was failing. After the multiple choice questions I went back to the PBQ’s (which were surprisingly easy). I reviewed other questions I was on the fence about until about 10sec left in the 90min test. After submitting it, they have you complete a quick survey on your study time, experience, gender, etc. Then they show you pass or fail and amazingly I passed. I then stared at the screen for a good 60sec in pure disbelief that I had done it. A great feeling and a great way to start 2019! Nice to see the hard work over the past 2 weeks paid off.
Passed with a score of 797/900. Not great but I’ll take it for only studying a limited amount!
I hope this helps some of you out there looking to take the Security+ certification. It’s a great one if you work in IT or just want it for the resume!
New Position: Information Security Threat Specialist
As of November 1,
A brief history. I started in this firm in January 2014 in the Charlotte office as an Application Analyst and Trainer. The role consisted of level 2 support tickets (outside the Help Center) in the local Charlotte office along with 4 others with similar roles and also training the new hires on all of the hardware and software. It was a great office and fun role that taught me a lot about corporate IT, a far cry from the world of Geek Squad and Apple Support where I worked previously. I held this role until August 2015 where I accepted a new role, Application Specialist and Developer, in the main office in Atlanta. This was more a Systems Administrator role than developer with a primary focus on building and managing the SCCM infrastructure. SCCM is a fun tool, but it can be a bit.. annoying.. at times.
When the Threat Specialist was presented to me as a possible next move, I jumped at the opportunity to interview. I’ve long been interested in Information Security, but always feared my deficiencies in the area, and it’s not exactly the easiest area to ‘jump’ into. Most employers want previous experience and it can be hard to find companies willing to train. Thankfully, my firm was willing to take the risk on me and in turn I’ve spent a lot of post-work time trying to catch up and fill in the gaps in my knowledge. I took Security+ certification on January 12th 2019, after about 2 weeks of studying, and passed. Now that I can say i have one cert, I feel a bit better about my new role in security. Next I’ve started studying for CCNA Routing and Switching which is a bit more of a daunting test. While not necessarily directly related to my role, networking is an area I have not worked in and don’t have much experience. I’m hoping studying for this cert and building a homelab will help rectify this.
While the focus of this blog has primarily been on my hobby in computer hardware and PC building, I plan to add more Security/IT related experiences and information henceforth.