From Phone Phreaking to Cloud Security: Jason Faulhefer's Cyber Journey

Speaker A: Welcome to the Philip Wiley Show.

Speaker B: Take a look behind the curtain of professional hacking and hear compelling discussions with guests from diverse backgrounds who share a common curiosity and passion for challenges and their job. And now, uh, here's your host, offensive security professional educator, mentor and author, Philip Wiley. If you're planning your summer cybersecurity conference schedule, I'll be at Black Hat USA 2026 and I hope to see you there. Every year, Black Hat brings together some of the brightest minds in offensive security, application security, AI security, cloud security, threat research, and much more. I'm especially looking forward to briefings, meeting with security researchers and vendors, and catching up with friends across the industry and discovering the latest innovations shaping our field. If you've never attended, it's one of the best opportunities to learn from world class experts, build your network, and stay ahead of the latest security trends. If you're thinking about attending, I got a discount code for you to use. Use my code, Philip Wylie, when you Register to get $200 off a briefing pass or $100 off of business pass. I will be sharing the URL to register in the show notes or the description. Thanks to Black Hat for inviting me to attend this year's event and sponsoring my pass. I, uh, look forward to seeing everyone in Las Vegas. Hello and welcome to another episode of the Philip Wiley Show. Today I'm joined by Jason Faulhefer. Jason, uh, and I have been connected on Twitter or X for many years and, uh, part of the cybersecurity community at large. And so this is kind of the first time we've actually had a conversation outside of, you know, social media. But it's, it's an honor to have you and welcome to show.

Speaker A: Thank you, Phil. Glad to be here.

Speaker B: How are things going in your world?

Speaker A: Going pretty good. Besides, uh, I do consulting for energy firms mainly right now through a company called Ampic Cyber. I've been traveling a lot. Last, um, year I was in Texas for six months out of the year. I had to fly there three weeks every month. And then I was only home for one week every month where I was due, where I did a lot of nerc sip, uh, cybersecurity audits, a lot of pen testing, security assessments, uh, security architecture reviews, and I'm also conducting one of the first ever SCADA and OT environments that's going into the cloud. So that's scary and exciting at the same time.

Speaker B: Sounds pretty exciting.

Speaker A: Yeah, it's keeping me busy. Uh, but on the side, you know, my, I have a good friend who I'll Just call him Bill for now, uh, because he wants to stay anonymous right now. But he's my co owner with uh, this new company we started up called threatspire and he's a, uh, CTI analyst. He's a threat analyst for a very, very large company. And he had this idea kind of along the realm of MISP and a couple of the other OSINT tools that are out there, but more geared towards teams in an enterprise with enterprise grade features. Rather than cobbling together something open source, having to pull in news feeds manually or scripting them. Um, I wanted to do. Me and him came up with a solution using AI as well, but not AI in this traditional way that people think of AI. We're using AI on the back end, using AWS bedrock to assist the analyst and make their job a lot faster where the AI does a lot of the data pulling the intel pulling and then presenting it in a way that's actionable, uh, to the analyst or other team members on the cybersecurity team. So for instance we have in the industry for threat intel you have your PIRs, GIRs and IRS, which are all basically intel requirements. And what an intel requirement looks like is something as simple as what threat actors are targeting VPN and remote access as a way to exploit xyz type of company, energy company healthcare or whatever your uh, company context is. And the AI will go out there. Uh, you could specify the timeframe for the news you want to gather. So you go back a year, month, a week, whatever, specify a time frame so that you can get the data that you need. Because you might not care about what happened last year, maybe you're only focused on the last three months. And then it will pull all the news articles having to do with all the threat actors it'll go through. It'll pull out the threat actors that have been attributed with remote remote access sort of breaches and things like that. And, and then it will give uh, a write up for each one of those threat actors. And then it will give you if it collects any ttps, whether it's from MITRE or other sources that it grabs from, from Google News or Ground News or whichever source. It will then present those ttps and then give you the SIEM sort of queries to hunt for them. So your Sentinel queries, your QRADAR queries, your Elastic, uh, queries, things like that. So it'll give you those. I do. One of the milestones in the future is to interact directly with the sims, but we're not there yet. And that's just one piece and how it kind of started was to provide a tool that will uh, instead of like going to Feedly and then pulling out all these blog posts and other going to the hacker news, going to bleeping Computer, Troy Hunt and all these, you know, well known sources that give you apt data, going to Mitre Crossroads, referencing all the data with Mitre attract actors on Mitre. The tool will do that all for you within seconds. So that's, it really saves the analysts a ton of time. Um, and it provides the data and reporting you need to work with your uh, DFIR team, your security engineers, your SMEs into leadership. Other pieces to Threatspire include Ioclytics. Ioclytics is an all in one platform for IOC detection. So and it kind of works in tandem with an add on that I created. And what it is is a dashboard using the diamond model for any ioc. You want to look it up whether it's an IP address, a domain, a URL, a file, uh, an email address that you want to check to see if it's on the RBL or the block list. And you can look up CVEs directly within the platform as well. And you can create cases off of these IOCs. So if you're trying to do actor attribution, threat actor attribution with all the data you're pulling in to try to correlate some of the TTPS and IOCs that you might be picking up from new sources and you're seeing a lot of the same things maybe coming from the logs off your firewall or your siem. You can then basically link it. So you can link it with a known actor or if it's a new actor, you're not limited by what's in the MITRE actor database online. So Mitre will track all the really common threat groups, state sponsored threat groups, you know, your APT42s, your Shiny Hunters team, PCPs, TNT. But you might as a threat intel for a uh, Fortune 100 might be able to attribute a whole new threat actor. And that tool lets you create a profile around new actors as well with the case management that is all rbac. So every analyst gets their own dashboard and they can share case data, they can share um, any uh, of the intel that they're gathering with other analysts on their team or anybody else that you give access to the platform under your tenant. It is multi tenant. All tenants are completely separate, more multi region up in the AWS cloud. And um, so you have main part which is CTI ledger, which is the CTI analyst part. We have IFC lytics, that's the IOC and attribution linking. Then we have the cases where all your cases are stored. In the future we'll integrate directly with ServiceNow. Right now we have a kludgy way like a lot of security vendors kind of do with ServiceNow where you can send emails to create cases with ServiceNow. But I'm working with ServiceNow for an integration. I'm um, kind of in the middle of that right now. Let me double check. Sometimes when you start talking about a thing you're. I also have. We also have a report section to where you can uh, create actor threat actor snapshot reports in the Mitre uh, threat actor report framework. So in the same formatting. And this will give you basically an executive summary about the threat actor, who they're known to target, what industries are known to Target, any recent TTPs associated with the target, and then a gist of the stories that were in the last. Whatever your defined timeframe is, you can set your window for the report and you can export it as markdown, PDF or JSON if you want to ingested into another tool or data visualization. Under Settings we have an. You can configure your. Org context and what that does is it gives the local AI a way to understand your business from a security posture and from the other moving parts within, within your, within your company. So you can specify what industry you're in. You list your crown jewels, it puts your tech stack any exposed services because the AI will use that data to give you better actionable advice. And then there's a bunch of uh. Actually I'm thinking about turning this next feature into an exportable report because a lot of vendors ask for this information but basically I ask all the security control questions. So is MFA enforced at all remote or external access. And then it gives you booleans for yes, partial, no, planned or na. And then you can comment on why you answered that. So these are uh, very similar to like what you would send out for a third party security questionnaire. But this, but the purpose of this is to give the AI context around your posture, your security posture. And so it goes for can ask questions on identity and access endpoints, network email and web logging and detections, vulnerability and patching data protection, cloud and appsec governance and resilience. And then you can list your geographic regions to give the AI context around whether you're in a area that's, you know like if I'm a company in say Ukraine, the AI is going to give you valid, you know, intel around what's going on in Ukraine and um, and then you can list all the business functions that you have at the company, third party vendors you used and what are your current priorities. That gives the AI sort of the low hanging fruit to take care of first. And then you can put any prior incidences or near misses that you had which will also give the AI even more context. And that's pretty much threatspire in a nutshell. I can share my screen to give quick look at the platform. Oh and one of the other. So this is what you're presented with after you log in and real quick I'll go to system settings, I'll show you all the data that you give to the AI to better give you actionable items. So here, here's where I was talking about all the questions and, and about the uh, like that third party security questionnaire type of questions. But this is giving, this is all for the AI's context and, and then if you go to back to settings, this is where you can set, you can set settings that you uh, if I, you can load up each threat actor that you're focused on. So like team PCP load actor settings and then you can have, the analyst can say why are we tracking them? The mission impact, the. You don't have to use this. This is just a uh, nice to have from some of the companies that I've had testing this over the last few months and so we can have specific intent for different act threat actors and the, the AI will use this as well in its context when it's looking up at threat actors that you're trying to track. If we go down here, um, there's an AI auto drafter um, which you need to, to turn on to do the auto drafting uh for the intel requirements and I'll show you that in a moment. This is where you can create your users. Um, this is all stored within AWS keystore with cognito and I'm um, transparent about that on the app. That might change in the future but that's what we have for now for, for good AppSec. These are the APIs that we're pulling from so Alien Vault and these are for all, all these APIs are for IOC lytics specifically. So we're pulling alien, alien Volat, OTX abuse, IDP, um URL house, uh CSakev, URLscan, IO, gray noise and virus total. We have single sign on with SAML 2.0 compatibility for single sign on. Um, or we can do local or you can do Google OAuth or Microsoft OAuth if you want to go that route as well. Under your user settings, this is where you can change your password. MFA is required. Uh, it supports an authenticator app and a passkey. This is also where you can set up your API keys. One of the things I didn't talk about, which I want to talk about now, is the honeypot. So this is a local honeypot running on my network and it's providing a bunch of alerts and IOCs. This is a uh, next gen honeypot that I created using Go Golang and it allows the threat actor to get lucky, get through to the protocol per service. And so you can kind of see, you know it's trying to log in with these, it's actually a little more clear under alerts you see these usernames and password attempts. I don't have this filterable yet. Uh, when you click on these, that'll uh, be coming probably in the next day or two but you should be able to filter by protocol. And on the SMB service specifically that supports canary token files. So you can add canary tokens to the, to the uh, Windows file sharing protocol for threat actors to later download and try to attribute their actual IP address from. Because you know, a lot of these people are coming off of content delivery networks. A lot of these are coming from Akamai or Google, Google Cloud. A lot of them are coming from DigitalOcean. Uh, um, so these are threat actors sitting in CDNs that are trying to attack. I'm also trying to work with the CDNs currently to have an easy kind of button to where you can report anything coming from that CDN back to that CDN so that they can basically cancel their service, block their IP or reassign their ip. And you can see if I do. Let me see if I go next. My honeypot is very, very active. It collects the user agent when they try to hit HTTP or HTTPs. Trying to find another protocol here, some rdp. So some people trying to hit rdp, uh, with really silly usernames. A lot of these people attacking my honeypot don't look too advanced. I'm not seeing rainbow tables or anything like that. So this is kind of funny. Um, if I go to last, actually I, I ran a sort of a bunch of commands on the virtual SSH protocol. Previous, previous, previous there's somebody trying to see if I have WordPress trying to exploit WordPress. I uh, don't some bad Words just keep going. Wanted to show you it actually it logs all the commands I run in SSH if I successfully get into it and it's not actually. It's just emulating an SSH connection.

Speaker B: Very cool. I like. One of the things I like too is that how you have like some of the hooks or integrations into. Into news because a lot of the software and resources you hear out there usually doesn't that I've heard of really doesn't ever really take in consideration news you know some of the Miter type content but I think that's pretty good extra a piece of information to be

Speaker A: able correlate well yeah thank you. Um, I am going to be adding GeoIP lookups for these. I. I got a list of things to do and that's. That's a really easy change. I just. Just I. So the honeypot itself has its own dashboard locally so where we install the honeypot it has its own dashboard and I do have GeoIP look up on that and when I created this dashboard and this is using that API. So in the uh. The honeypot runs on any version of Linux I'm going to have uh, images in AWS in case you want to run the honeypot in aws. Do the same thing with um Azure to where it's just one click install and it does all the rules uh security rules and everything around that and and then you have to add the. You have to create an API key to add to your honey pot on parameter in the cloud so that it can send the events into. Into your tenants console. So if we go back to CTI ledger this is where you put in your intel requirements. So like an example which emerging CVEs are relevant to our environment which ransomware active actors are actively targeting organizations in our sector. So if we review and this is going through a, a decision trace so we have the actor activity, the intel requirement and then we're at the decision layer and this has a high priority uh the AI draft was enabled for this one and so what I can do now is I can if I want to refresh maybe I haven't refreshed um the threat actors news and blog posts and things like that Intel. In a week or two I can go in here and specify you can do custom um but we'll do the last one week then I'll refresh it. So I have an ingest script that runs and then the AI reviews it and presents the data which gives the current judgment confidence that it got from the intel the Recommended action escalation triggers and your decision trace is, is waiting for the analyst's review. This is, these are all the linked actors and you know there's going to be a lot and here are all the evidence that it linked to it. Well this I want to clean up a little bit to give you more of a gist underneath here with like a summary of the story. Just to give the analyst a little bit more than just the title. That's one thing I need to update and then we can pick, we can pick up open intelligent gaps, we can refresh this. I still need to uh, work on this workflow. This one's a little bit behind but if we go back down. Yeah, see it's saying that the ttps are known but that's, that's actually false and it's using the wrong model. So that's something that I need to fix. But basically it'll take everything your, your organizational context, anything in the news and tie ttps to the devices or platforms you use and if there's any CVEs associated with those. So it's kind of a light sort of vulnerability tool but more in the focus of threat actor intel rather than just patch management which if you're not doing patch management. Right. So let me think we also have go to edit. This is what the edit looks like. This is where you can do the auto. You can also set most a lot of intel requirements usually have an always on cadence where you want to track it for a long time or forever. Uh, some intel requirements you might be focused on a new threat actor that is targeting you and you have evidence that they are targeting you. So let's say you're you know Rockstar Games and Team PCP is you know obviously it, you know you have evidence that they've attacked you in the past and they continue to try to attack you. You may have temporary intel requirements for specific things that you're trying to track. We can also um, approve source tiers. I'm going through mostly the Google News API and they go by tier A, B and C and then unranked. So like unranked would be like your 4chan posts and stuff like that or Reddit. Tier A would be like the stuff you generally put into Feedly as a threat intel analyst. So like your, your bleeping computer, your, the hacking news, stuff like that. Uh, tier B will be some of the suede news industry. So like Fox News, cnn kind of more tier B. Tier C is like more or lesser newer blogs. So um, you Know, if I start up a blog tomorrow, that would come up as a tier C. And then, and then the AI will filter whichever, whatever you set there. You uh, can put matching criteria, you can leave this blank and it will just use the information in your organizational context. But if you're say an MSP and you have multiple. I'll get to that actually later in a little bit. And then these, this is the auto fill with AI and then you can go ahead and edit it later. And it's drafting it from these six new intel sources. And this is basically giving you advice on to, you know, next steps you can hit save changes and then that'll add it here. So we have threat actor management here. I'm combining actortractor Tracker and Threat actor Management. There's some coding stuff that I left over for debugging where I'm trying to combine these two. And this is where you can go in and show the, all the threat actors that you're that are currently being tracked. By default, it will track all MITRE threat actors that are in their database and then it'll pull all the TTPS and IOCs that are associated with those threat actors that gets fed into a, uh, cached database and so that the data generation and data pulling is much faster and much more performant. And you can see what ttps are associated with each threat actor here as well. This is all coming, most of this TTP information is coming from mitre, but it's also coming from any stories, recent stories that mention new ttps that uh, the threat actor might be using that MITRE might not have in their database yet. And one of the things I need to add here is, and then it'll show you some priority review queue information here, which I'm probably going to get rid of that because it's already in CTI Ledger. If you go to Actor Tracker, this is where you can track a new actor. But it's not limited to what's in the MITRE database. So I can just say Iranian threat actors. And when the AI goes and pulls news stories, it'll use that query Iranian threat actors for news and it'll associate any of the APT groups that's based on Iran. And if we open the geography map, you can see if it's known where a threat actor group is attributed to. So here we see Israel, you got a hexane, APTC 23 and wyrite, of course in China got all these buggers and then, and then you can just start tracking and it'll add that and then it'll start bringing in data for just all iradiant threat actors, for instance. And then here's IOC lytics just playing around, doing some debugging earlier. Actually, let me do this. What are cases? This is where I have a colleague of mine, Carl, uh, who is testing a lot of this functionality with me. And you can see he shared an IOC he did a search on and came up with on his honeypot and then shared it with me. And so these are all my cases that I created. And then you can also filter by all shared. And then you have all cases that are shared or yours on here or anything that the AI generated as a case. Uh, we have a decision trace in here as well, so you can keep track of where you are at in your investigation. Brings up the diamond model analysis. It'll connect basically the adversary information. If there is attribution that it can gather, it will put the attribution. So if it does detect that, huh, this IP is associated and known, associated recently with Lazarus Group or something like that, it will put the group name here, it'll put all the ttps that have been associated with it. Anything in purple is from mitre, anything in gray came from News stories infrastructure. Uh, it shows you this is coming off of Linode, which is owned by Akamai. Like I was talking about before, a lot of these threat actors are leveraging CDN networks to launch their attacks from. This is proof of that. And this is from a US IP address. And uh, here you can put your analyst notes, it shows you the results from the different API API sources that are. There are four specifically IPs. And then you can put any comments associated, like just a comment saying, hey, next week do this, look this up or whatever you need to do. This is where you can also, if you have attribution on your own, you can link it to an actor here. So you can search for say Lazarus Group added here. And then it will connect it, this IOC to that threat actor. Excuse me. And then under reports, this is where you can create a threat actor snapshot. And this is where I was mentioning. You can specify a window here. I'm going to add a custom field for this as well. But like I can pull down say team pcp last 7 days load report, download the PDF, this takes a couple seconds to generate and we'll pop that open. And here we got that threat actor profile for Team pcp. It's your executive summary. Any key points recently attributed to team pcp. The assessment with confidence levels, the threat Actor summary. Any key intelligent gaps that has been detected within uh, your environment. Excuse me, any name changes or any other aliases associated with the threat actor, any current activity, last known attacks, and then all time activity. So these are all the news sources for all the, all the activity around, uh, within that threat window. I need, I do need to change that for it, that's not all time. It's within your. When I, when I went in here and I did the window, it's actually for that window. It's not for all time. So I do have to update that, that template. But, but yeah, that's, that's pretty much uh, threatspire in a nutshell. I want to say one of the, one of the other quick things, real quick is when you're in CTI Ledger and you're refreshing this specific requirement, it doesn't refresh all threat actors, it will only refresh recent news and then attach any new threat actors. I would recommend refreshing all threat actors maybe once a week just so you have some like more recent fresh data to use for the AI to give its wonderful responses. If you go back to CTI Ledger again, I think I broke something in a recent update. Let me just see if I am. Yeah, it broke. So, so there's another card that's supposed to be right here. Of course this is very agile right now with the DevOps. There's supposed to be a card here, but it gives you all your SIEM queries. So your KQL stuff like that for Sentinel and your stuff for, for threat hunting in your specific sims that are the most common sims out there. And I don't know why that disappeared. It's interesting uh, but yeah, I get to read. I gotta add that back. And ioclytics, you can see it here. So when you look up an ioc, you can see here on the left, it gives you recommended actions. You can check these off as you go and then these are your query logics for each one of the different uh, SIEM tools that you have. And then any MITRE, ATT and CKTPs that are associated with this, I just, I just put in a random Vanguard.com and, and then if you do hunt and sim, it gives you an easy copy paste of everything here for all your different queries. You can Export this as Stix, uh 2.1, you can download a report and then this is going to be a soar button that'll interface with next gen firewall. So your Palo Altos, your Ciscos, your Ubiquitis, that'll work with The API for each one of those vendors that you'll end up configuring under your organizational context. Excuse me, allergies. So if you just want to quickly block this domain, you could do that. And that'll come, that'll be coming. This also pulls, when you do domain lookups, it will also pull the fab icon. So say you put in a, you get an, like somebody sends you a phishing in your org, sends you a suspected uh, phishing email and you pull out the URL from that. You pop the URL in here and it's some puny code garbage. And then you do analyze and it comes with like an Amazon favicon. You'll know it's definitely phishing, right? Because you're, it's not, you're not connecting to that, you know, it's not that URL, but it has the Amazon, you know, favicon. So another good indicator for threat intel. The one thing I do need to add again is the geolocation. It does pull in the geolocation when you add it to a case and that's the only way you can get the geolocation with it right now. But I'll be adding that to the, the information here. Right now I have the placeholder for it, but I haven't implemented the uh, feature yet for that, uh, which I'm just recycling from the other feature. But this is a uh, threatspire platform. The Honeypot is an add on feature. This has its own maintenance associated with it but everything else is included. So that's the base, the base platform as of right now with a bunch of milestones planned coming up.

Speaker B: Very cool. So when do you plan to publish it or um, go public with it?

Speaker A: Right now it's available for anybody that wants to partner with us to test for and get maybe something like, hey, help us test this for XYZ months and then you can decide if you want to keep it after that. And we're looking for kind of partners, uh, in that space. I have about a team of six people that I have testing and doing QA on it. But I am willing to work with other organizations as well that maybe want to just kick the tires and give it a good, good spin.

Speaker B: Yeah, that's good. Pretty impressive.

Speaker A: Thank you.

Speaker B: So we're getting down towards the end of the episode. Is there anything you'd like to share before we end?

Speaker A: No, I think, I think that's good. Uh, for now. Thank you for letting me show it off, Phil. It was been great being on your show.

Speaker B: Yeah, Great to have you on. Always great to, to chat with folks from the community and uh, always interesting to see cool new tools and so it was kind of cool to be one of the first few people to get a first look at it and now the audience will as well.

Speaker A: Yeah, thank you. Yeah. And you know, I do come from a storied red teamer background so my friend's blue team, my partner and um, he's the one who came up with the initial idea and I, you know, looked at his napkin and said actually I think we have something here. So, so, so yeah, it's um, he's kind of the visionary and I'm, I'm the, the appsec dev guy. So. Side of the side of the house.

Speaker B: Very cool.

Speaker A: Thanks again Phil.

Speaker B: Thank you. Thanks everyone for joining and we'll see you in the next episode. Make sure to share and uh, until next time, take care. If you wouldn't mind sharing your hacker origin story kind of how you got started up until the type of work you're doing today.

Speaker A: Sure. I think I was fortunate growing up with the Internet at the age I did. I grew up in the 70s and 80s as a young kid and I think I was bit by a whole computer thing at around six years old. And I had my first, got my first Commodore when I was actually before that I had a Trash 80, it was a Tandy color computer three I think, uh, TRS 80 clone but in color. And that's where I learned basic stuff like that, Fortran, uh, coding languages and um, but. And then since that point I upgraded to Commodore 64 and then the 128 and the whole line of Amigas that was programming and in C and a whole bunch of other fun languages that don't exist anymore. And, and then at about 12 years old my best friend Mike, his dad, they lived across the street of my backyard and we were both big into BBs' ing at the time. I think I was, I had just connected my Commodore 128 to. It was a 300 baud modem little cartridge you plug in into the back and uh, and I dialed up into this local BBS called Argus where started to learn like, had forum posts on like hacking. They had the Jolly Rogers Cookbook and the Anarchist Cookbook and all that fun stuff back then, blue box diagrams, you know, to get free long distance stuff like that. And I think that's kind of where what bit me early on. And then by the time I was 12 years old I, I set up my own BBS with a amiga, uh, 4000 tower. It was a 4000, yeah. And uh, I ran uh, renegade BBS software, I think it was, and I, I opened up 12 lines. I went down to that big green box at the bottom of the street kind of late at night and um, my friend, let's say, grabbed a bunch of unused numbers from the punch panel and assigned it to my grandmother's house so that I could get extra 12 lines in a hunt group. So if a hunt group meant that if the first line was busy, the second line would automatically pick up and so on. And so I ran that BBS with the 12 lines. Uh, my, my best friend's dad worked for Zoom Telephonics, uh, modem manufacturer at the time. That's how I got a lot of the modems at 12 years old. And uh, so I ran that for, for years. And I had the forum connected to the cultivated cow in Texas. So I was getting all those hacker forum posts from the CDC's BBs as well as other BBSs around, around the country. And I think that's really what just kept me in, in tech, kept me in networking, cybersecurity in general. It was doing all the gray hat, sort of fun, sort of gray area in the law at the time stuff, then getting more into the legal side of things where I became certified, became an ethical hacker, worked for a bunch of different ethical hacking boutiques as it were. And then during the dot com era I was primarily a, uh, developer in web development. And it's kind of when you wore a lot of hats. So I was doing a web dev, I was doing cybersecurity from an architecture standpoint. So this is right around when firewalls became a thing. IPS's were kind of still new. And when that dot com bubble burst, I decided to join the Navy and I became a CTR or a cryptologist where I learned code breaking and advanced cryptography. Uh, and that's what gave me the skills after the Navy to get more into the purple teaming side of, of things. Uh, which I had been doing for the better part of now, 12, 12 years, since I got out of the Navy to where now I am mainly consulting for energy and municipal and water companies on compliance. And I'm doing, I wear a lot of hats with, uh, the consulting where I either assist with compliance auditing, trying to audit them before they get fined, getting all the findings so that they can fix them. And, and I also do a lot, I still do a lot of pen testing, I do a lot of architectural security Reviews for cloud on prem ot, scada, hipaa, uh, pretty much all your compliance titles and all your organizations that are out there for the most part, but mostly right now it's energy critical infrastructure. So that's my hacker origin story in a nutshell.

Speaker B: Very cool. Yeah. It's kind of interesting that you got into the pen testing kind of, kind of earlier on because you mentioned that you kind of went in the Navy after the dot com bust. Uh, because you know you did. There wasn't. That wasn't a very widely known of known about field at the time because I remember I didn't find out about pen testing until I moved into Cybersecurity about 2004 because I was managing, I was working at AppSec and I was managing our third party pen test. And that's where I found out about pen testing, took some courses and then when I got laid off in 2012 I applied for a consulting role doing pen testing and kind of how I got started. But there weren't as many because I remember going to like Dallas Hackers association back like in 2013 and some of the other cybersecurity meetups. There'd only be about 2 or 3 of us pen testers there. And now you go to these meetups and stuff and there's a lot more compared to back then. And so when you were starting out it was even more rare.

Speaker A: Well, yeah, we were black sheep too, you know. It's fun. I actually started the first cybersecurity company in I think in Boston. I'm not sure if it was in the US but it was around 2002. 2000? Yeah, 2001. 2002 where I started. Stupid name because you know, the 90s, so it's called in the zone technology. I was young, okay. Uh, but what I, what I did was I set up a website that automated one free authenticated scan of an external IP address using at the time it was Nessus, when it was still open source before it forked to openvas and it was before Green Bone Security, all that overlay with OpenVAS and all that. And that was all done with um, I think, I think I was using Perl at the time, pre Python stuff. And um. Yeah, so a company could add a domain record to prove who they were. Similar to how it works today, it would automatically fill in M, they would validate the record and then they could add an IP address or URL and scan it for vulnerabilities. And so they'd get just a report of uh, the one one URL or one IP for free, and then they could hire us if they wanted us to complete a full assessment for them. And that was. Yeah, that was around 2002, I want to say. And I did that. We, we had that company. We got bought, but we had that company for about four. No, two and a half years. Yeah, two and a half years because we got bought right before the dot com boom crashed. And, um, I joined the Navy in 2004.

Speaker B: So it was good, good timing on, on selling your company then.

Speaker A: Oh, yeah, it was. Yeah. Yeah. My best friend bought a house out of it and I think most of it went to him, uh, unfortunately. But, uh, but, uh, yeah, rest in peace. He passed away about six years ago.

Speaker B: Yeah, sorry to hear that.

Speaker A: Oh, no, it happens. We're. Yeah, it happens. But thank you.

Speaker B: Yep. Oh, you're welcome. Yeah. The older we get, the more common that is. I had three friends within a frame of a week that had passed away recently. One of my former co workers from, uh, one of my longtime sysadmin jobs, the company where I moved into cybersecurity. She passed away last week, which was kind of a shock. She was several years younger than me, like probably early. Early to mid-50s or something.

Speaker A: That's sad.

Speaker B: Yeah, it's pretty sad to see that. We just. Sometimes you don't think about, you know, how fragile and how life is and you just, you know, it just kind of comes as a shock when you see those folks.

Speaker A: Yeah.

Speaker B: Pass away so young.

Speaker A: Yeah. Especially when it's hexametensil.

Speaker B: Yeah.

Speaker A: You know, that's the worst. I mean. But yeah, it is, it is what it is. It's part of life. Yeah.

Speaker B: Very cool hacker origin story. That's. It's always like hearing the stories where folks got in, in the phone hacking, BBS and phone freaking kind of stuff, because that was kind of before it ever came on my radar, before I ever learned about it.

Speaker A: Yeah, that was like the cap, they called it the Captain Crunch days. Right. With the, uh, 2600 Hz and all that kind of. I remember doing that at a payphone and just hearing that ching, ching, ching for every time I thought a quarter got inserted.

Speaker B: So, yeah, actually not locating it, but I've actually got someone at I think a DEFCON or something, some security conference gave me a 3D printed Captain Crunch whistle.

Speaker A: Nice. Yeah, that's awesome. Cool.