Security Books

Favorite Security Resources

Here’s an ever-changing list of some of my most frequented websites, blogs, twitter accounts, YouTube channels and Podcasts for Security information and news. If you have any recommendations, please let me know!

I use Feedly as my RSS reader.

Websites & Blogs:
Dark Reading: https://www.darkreading.com/
Bleeping Computer: https://www.bleepingcomputer.com/
ThreatPost: https://threatpost.com/
Troy Hunt’s Blog: https://www.troyhunt.com/
The Hacker News: https://thehackernews.com/
Security Week: https://www.securityweek.com/
Schneier on Security Blog: https://www.schneier.com/
Naked Security: https://nakedsecurity.sophos.com/
Malwarebytes Blog: https://blog.malwarebytes.com/
Krebs on Security Blog: https://krebsonsecurity.com/
We Live Security – Eset Blog: https://www.welivesecurity.com/
Security Boulevard: https://securityboulevard.com/

Good subreddit’s:
https://www.reddit.com/r/netsec/
https://www.reddit.com/r/cybersecurity/
https://www.reddit.com/r/AskNetsec/

Twitter Accounts:
https://twitter.com/NahamSec
https://twitter.com/gynvael
https://twitter.com/TinkerSec
https://twitter.com/bad_packets
https://twitter.com/LiveOverflow
https://twitter.com/campuscodi
https://twitter.com/binitamshah
https://twitter.com/tiraniddo
https://twitter.com/thegrugq
https://twitter.com/RobertMLee
https://twitter.com/briankrebs
https://twitter.com/jaysonstreet
https://twitter.com/hacks4pancakes
https://twitter.com/troyhunt
https://twitter.com/evacide
https://twitter.com/k8em0
https://twitter.com/MalwareTechBlog
https://twitter.com/HackingDave
and of course, Taylor Swift https://twitter.com/SwiftOnSecurity

YouTuber’s:
https://www.youtube.com/LiveOverflowCTF
https://www.youtube.com/RootOfTheNull
https://www.youtube.com/NetworkChuck
https://www.youtube.com/hackersploit

Podcasts:
Darknet Diaries
CISO Security Vendor Relationship Podcast
Cyber
Heavy Networking (networking)
IT Career Energizer (more general)
Threat Wire





Pfsense Router from old gaming PC

Ideally, I would sell these parts for profit and just buy a Netgate router to configure… but what’s the fun in that. I’ve always wanted to build my own, so I used some old gaming pc parts I had lying around, threw in a 4 port Intel NIC and installed pfsense. Part 2 will cover how I configure the device and use it in my home network.

Security+ Certification

Previous Experience: Very basic networking/security, SCCM engineer, Windows Administrator, 14 years of building computers

Study Time: ~2 weeks daily after work (I work full time) and weekends. Started seriously studying on 12/31. Took test on 1/12.

Materials Used:

Test Experience:

Since this was my first certification ever, I didn’t really know what to expect. I scheduled mine at a National Polytechnic Institute where they do a lot of medical training and testing of all sorts. I arrived at the testing center about 30min early (LA traffic is unpredicatable at times), and looked over my flashcards one last time. I went into the testing center about 10min early to sign in, fill out some documents and provide my 2 forms of identification (Drivers License and Passport). The receptionist then took my keys and passport (I was allowed to keep my DL, and I had left my phone in the car) and walked me into the test room. The test room is a small classroom size space with a closed door and about 30 computers. When I arrived the room was about 80% full of people sitting at the computers, typing away. I felt it was kinda odd having staggering test times, with people coming and going from the room throughout the process. The room was also very very loud from all the typing. I don’t know what type of tests they do in there, but some people were definitely writing essay’s. Thankfully, they provide earplugs. I didn’t put them in at first, but once the test started I quickly shoved them in my ears so I could think clearly. The computers themselves were definitely old and not in the greatest shape. They also provided a few pieces of laminated paper to write on and a sharpie.

As for the test, Comptia definitely loves their wordy, 5 sentence questions.. phew. Some questions I had to read multiple times just to figure out what they were asking. I did skip all of the performance based questions until the end. The first 10 multiple choice questions all seemed super tricky to me as well and halfway through the test I was convinced I was failing. After the multiple choice questions I went back to the PBQ’s (which were surprisingly easy). I reviewed other questions I was on the fence about until about 10sec left in the 90min test. After submitting it, they have you complete a quick survey on your study time, experience, gender, etc. Then they show you pass or fail and amazingly I passed. I then stared at the screen for a good 60sec in pure disbelief that I had done it. A great feeling and a great way to start 2019! Nice to see the hard work over the past 2 weeks paid off.

Passed with a score of 797/900. Not great but I’ll take it for only studying a limited amount!

I hope this helps some of you out there looking to take the Security+ certification. It’s a great one if you work in IT or just want it for the resume!

New Position: Information Security Threat Specialist

As of November 1, 2018 I accepted a new position on our Information Security team as a Threat Specialist, however, I prefer the title ‘Threat Hunter’. It’s just more fun 🙂  And while I’m extremely grateful to my company for allowing me to apply with zero security experience, it was still an understandably grueling process consisting of an essay on fileless malware, 3 online tests and multiple rounds of interviews.

A brief history. I started in this firm in January 2014 in the Charlotte office as an Application Analyst and Trainer. The role consisted of level 2 support tickets (outside the Help Center) in the local Charlotte office along with 4 others with similar roles and also training the new hires on all of the hardware and software. It was a great office and fun role that taught me a lot about corporate IT, a far cry from the world of Geek Squad and Apple Support where I worked previously. I held this role until August 2015 where I accepted a new role, Application Specialist and Developer, in the main office in Atlanta. This was more a Systems Administrator role than developer with a primary focus on building and managing the SCCM infrastructure. SCCM is a fun tool, but it can be a bit.. annoying.. at times.

When the Threat Specialist was presented to me as a possible next move, I jumped at the opportunity to interview. I’ve long been interested in Information Security, but always feared my deficiencies in the area, and it’s not exactly the easiest area to ‘jump’ into. Most employers want previous experience and it can be hard to find companies willing to train. Thankfully, my firm was willing to take the risk on me and in turn I’ve spent a lot of post-work time trying to catch up and fill in the gaps in my knowledge. I took Security+ certification on January 12th 2019, after about 2 weeks of studying, and passed. Now that I can say i have one cert, I feel a bit better about my new role in security. Next I’ve started studying for CCNA Routing and Switching which is a bit more of a daunting test. While not necessarily directly related to my role, networking is an area I have not worked in and don’t have much experience. I’m hoping studying for this cert and building a homelab will help rectify this.

While the focus of this blog has primarily been on my hobby in computer hardware and PC building, I plan to add more Security/IT related experiences and information henceforth.

Categories