Cybersecurity Tools and Frameworks with Aaron Rosenmund

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Aaron all about team Tools, Red Teams pyspark type security topics. He has I think 33 or so or 27 courses on Pluralsight, so it won't be all over the map, but it's all going to be security related. Aaron is a major expert. He's a cybersecurity operator operations subject expert with a background in federal and business defense and offensive cyber operations and system automation. Leveraging his administrative and automation experience, Aaron actively contributes to multiple open and closed source security operating platform projects and continues to create tools and content to benefit the community. As an educator and cybersecurity researcher at pluralsight, he is focused on advancing the cybersecurity workforce and technologies for businesses and national enterprises alike. Like I said, major expert. Lot a lot of experience here. You don't want to miss this episode. Check it out.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com Apple Security.

Hey Aaron, welcome to the Guild.

Hey Joe, thanks for having me.

Awesome. Great to have you. Before we get into it, is there anything I missed in your bio that you want the Guild to know more about?

No, I mean that's really the gist of it. It's kind of a broad set of experience. I started out like a administrator like a lot of other people, got a lot into automation and PowerShell and VMware and all that stuff and as I made projects kind of got deeper and deeper into how it secure and or insecure things were and got interested in how to protect them and kind of really just flopped back and forth between Red Team and Blue Team activity and slowly made my way to now I do the Director of Research and Curriculum for Cybersecurity for pluralsight and I'm also part time National Guard. So that's kind of a big thing I like to point out. So I do a lot of state response stuff. I work directly for NORAD underneath the AFF north component, doing a ton of cybersecurity stuff with them. And so I get to really keep my toe in practitioner area of like you, my skills, current, that kind of stuff, while also being able to contribute to training and projects and that kind of stuff.

So very cool. So without giving national secrets away, working from the national card, is that a training you received or you went in there as a security expert already? Like, do they have a good program for people that say, want to get into, I'm just thinking out loud, security. Is this a way that they could really learn from top notch experts by joining the National Guard?

Yeah, a hundred percent. I mean there's always, honestly, like in the industry we have a really big gap in cybersecurity skills. I mean we just have the solar wind stuff and everybody's like, yeah, it's a huge problem. But the biggest problem is we don't have enough hunters with the skills to be able to go really figure out the extent of it. Like, I've seen that on a few different articles I've read. And so as much as we would love to have people come in that already have security skills, if you just have an aptitude for it, it's a great place to learn as well. I came in a little bit of a different path. I came in doing kind of system admin stuff, so I was like making users in active directory. Right. So. And then kind of went up through.

Cool. So you did mention also at pluralsight, you're a cybersecurity researcher. So what does your day look like? How do you stay on top of all the security things? It always seems to be changing. So how do you do that?

Yeah, so a big part of it is articles in the morning. While I'm not really wanting to be assaulted by podcast and video. Right. So I'll just kind of see what the newest articles are. And then I like to run a lot. I think I clocked about almost 1,000 miles last year. And while I run, I listen to podcasts. So that helps quite a bit. And then kind of anything that queues from there I can go do my additional research. And really what I ended up doing is try to push myself in anything I do from an educational perspective. Like, yeah, like I really understand this concept. And here's an area of security. And there's so many areas in security where it's not Fully prospected yet. Right. There's still gold to be found, so to speak. And so I'm like, I'm going to spend some time learning how to do this really, really well, advance it a little bit beyond where it already is and then teach everybody that. So that's a lot of the research aspect of it too. And then I get to present that findings at like conferences and that kind of thing.

Cool. So I've noticed over the years Pluralsight really has built up its area on security and security testing. Is that something you help contribute to? Do you help tell them, hey, here's a gap we have. Maybe we should get some speakers or courses around these particular topics.

Yeah, I mean, so that's really interesting. I don't give any pluralsight secret sauce away or anything. But really they recruited me as an investment, me and others. But a lot of my recruitment to come work for them was an investment. And hey, we're really going to take a big stance source tiered security. So really we started with, and you probably know this with the other speak I've seen on Test Guild, but really heavy in development. Right. Like if there's a, there's a lot of development push for pluralsight. And then almost in the same way that I came up through system administration, Pluralsight's like, okay, here's the other gaps that we have in it. This, this model works for training people in development, which is another high, high pace of change area. Right. Like, so every time a language changes that you need to be updated on that. And so there's a lot of high pace of change there. And that's something they're good at. And so now let's make a heavy investment into security as well. So I kind of came into that really full time with them a few years ago, almost three years now, I guess time. Covid year went really quickly, but. And so yeah, I've helped them build that up over time. Absolutely.

Nice. So is there anything on the horizon you see with 2021? I like to do like trends with security that you think, oh, we definitely need to probably get this covered in the year, this year because it seems to be a gap in knowledge in this particular area of security.

Yeah. So, you know, we, there's a lot of competitors in the space that want to come to training for cybersecurity. Right. Mainly because of the skills gap in general and there's a lot of want to convert. So like if Covid year hit and you're like, hey, maybe I need to kind of train up in the area. Well there's a lot of gap in cybersecurity so we if you have the aptitude and come train to do it, then great. And so as far as like training competition, a lot of spun up but there's not a lot of extremely high quality competition. And so that's really where I see the biggest gap and it the easy answer, the like T ball. Right. Is the Solar Winds situation. That's it's still ongoing now. Right. So I mentioned it's been said multiple times by many different agencies we don't have enough skilled up threat hunters to be able to identify the extent of this attack. And that's just really, really true. There's very few groups that can provide training past like okay, I got my ceh. Now how do I go figure out where Russia went after they compromised the Solar Winds server? I don't really know. Right. And so that's the stuff that's missing. So security operations, advanced security, behavioral analysis to identify lateral movement and just things that are strange in your network. It makes it sound easier than it is, but that's what's missing. I think there'll be a big shift of that after we see this big gap that I guess everybody missed. Right.

So I just heard a little bit about SolarWinds and just reading headlines. I think it had something to do with an IDE that's really popular. Is that, is that how it happened or is that not?

You know, I haven't seen that that was fully confirmed yet.

Okay.

Yeah, it certainly could have been. There's also talk of maybe it was insider still and so that'd be an easier way to gain direct access to that source code. Right. But really I think my concern and when we look at supply chain attacks and whether it's a hardware supply chain attack, we've seen those occur in the past like a chips on a board that shouldn't be there or whether it's a software supply chain attack. This isn't the first time we've seen it. CC Cleaner is a good example. Once that gets compromised. Yeah, it's signed code. It's really hard to figure out if it's bad. But executables like cc cleaner and SolarWinds still shouldn't be harvesting credentials and talking out the C2 domains that don't have anything to do with that executable. So if we have monitoring in place as a standard that can detect that kind of thing, then we're ahead of the game and it doesn't take us a year and a half. To figure it out, Right.

I mean, it seems almost impossible to do because you rely on other countries for chips and everyone does it, I'm sure. But how do you prevent something that. Like an unknown, an unknownable unknown kind of thing?

So if you ever listen to my talks, I'll usually bring up. It's the quantum effect of cybersecurity, right? If you don't look, you just don't know. But in the case of cybersecurity, if you're not looking, it's probably bad, right? And so the cat's likely dead. If you know, the Schrodinger cat equation, right, is that the cat's either dead or alive in the box, but you don't know until you open it up. It's the probability theory. And so really for cybersecurity, unless you're monitoring, unless you have active security operations that are actually looking, then you just have no idea whether you're compromised or not. And all of the risk management and all of the policy and all of the locally sourcing hardware and equipment and all of that in the world doesn't matter because you're right. I mean, you can't. We don't make every single chip here in the US or in Japan. Doesn't make them all in Japan. Internationally, it doesn't really matter. And same with software. It's becoming more and more of a global economy and you can't really monitor all of that, but you can control what you control, which are your assets. Right.

So I guess we're getting ahead of ourselves. If we were talking how to cover unknown unknowns, but I've seen, is there a gap? People even just covering known knowns, like insecurity?

Yeah, I like to look at that as everybody's got a pyramid. There's like the pyramid of pain, there's the pyramid of this or that. I look at it as the pyramid of attackers or adversaries, right? So at the bottom level, you have a lot of really unskilled attackers, just like we have a lot of people in the workforce that are scaling up as well. What you want to do is slowly raise your security to the point where you're at the top of the pyramid, where it's like, now that's the unknown unknowns, right? So all the known stuff, that's your base of the pyramid, that's what the stuff you should be able to get rid of. It's also the most frequent stuff. It's at least targeted, but it's the most frequent. So until you get your security program past A point where you're not worried about those known knowns, then you can, you're not really worried, you're not really ready to start worrying about zero day attacks or whatever, the unknown unknowns that we hear about all the time, because there's no way you'll get there. You really want to start with, hey, let me just make sure that people can't get in with a simple SQL injection, that kind of thing.

So it's a good point about the pyramid of pain. Actually this is one of the things you brought up, I think in your blue team course. I've heard of the developer pyramid of testing. Can you talk a little bit more about this pyramid of pain? Is this something you made up? Is this an industry standard? Like, is it someone people should be following?

Well, the adversarial pyramid, I mean, I don't know. I don't really want to claim that I made it up. Someone else has probably made that up before. I just don't know where I could claim that I saw it. Pyramid of Pain specifically, I did not make that up. Right. So Pyramid of pain is referring specifically to. So if we're looking at blue team operations, we're concerned with finding IOCs. So if we're talking about Solar Winds, where update was compromised with malware, an IOC would be the hash of the file of the malware. Right. Indicator of compromise is what we call those. And so another IOC would be. Okay, when it talks out, it talks to this specific domain. It was the AVM something something domain. Right. That's the indicator of compromise. And so when you talk about the pyramid of pain, we can basically bring pain to the adversaries by moving up the pyramid. So the IOCs that are easy for them to pivot across. Right. Or if we look at things like an ip so you can register a domain and you can very quickly pivot between IPs. So if you're blocking an IP on your firewall, that really isn't stopping the attackers. It's a little bit of pain, but it's not a lot of pain. Right. It's something easy to pivot from. So if you move up and you instead say, I'm going to block the domain, that's more pain. So it's more difficult. I have to register really more domains. I have to make sure they're clean and not getting popped on like a behavioral analysis or a domain. They're not getting blocked on something that has reputation, like a domain reputation. I can't buy like F rated domains because you're going to automatically block those with like your Cisco kind of total solution. So that's more pain. Now if instead I look at your C2 activity, your command and control activity. So when a malware starts to execute, it has to talk back out and you probably want it to talk back out frequently so that as adversary you can give it commands back to do stuff. Right. Bad things. Now there's characteristics of that and there's lots of ways. This is a constant sword versus shield or armor versus weapon maker situation. Right. But one version of that would be frequency analysis. I have something that's talking with small conversations at a very specific or a machine frequency over HTTP. That's not the same as how users browse the Internet. We make long connections that are very random in nature. Right. So sometimes they're longer and shorter and then I'll browse over here and I'll browse over there. But if you see HTTP full sessions like closing very quickly and happening every five to six minutes, that's a way that you can do a behavioral analysis. That's the top of the period of the pain. It delivers the most pain to the adversary. It's very difficult. They have to change their entire programming infrastructure to be able to get around that. Right. So that's what the pyramid of pain refers to.

Nice. So I guess if people start focusing on the lower levels, it sounds like the more pain. Maybe if it's someone that's not too serious, they'll back off because maybe you hardened the easier to get 8020 type rule. I don't know. I don't know if that's true or.

Not, but yeah, yeah, absolutely. So if you're looking at I don't know. So the hacktivist is a good example. Or we call them script kitties or, or whatever level you want to call it. I don't want to say the hackivist can't be advanced, but the script kitty would be the kind of similar reference for someone who's just like a good example is voting. Right. So I don't know how much you heard about different groups trying to get voter registration information. So groups attributed to Iran attributions, one of those weird things. You don't really know who did anything on the Internet. It's very difficult. But let's say it was Iran or maybe it was just other activists trying to stir up trouble. They're using Curl, right. So Curl makes get and post requests and they're not doing anything particularly crazy. Voter registration information is free. It's just we only kind of Let one record happen at a time, right? So they can automate that and then get a bunch of records really, really quickly. And so what some groups would do to try to mitigate that is they would block curl. Right. And the way you block curl is if you look at HTTP traffic, there's a user agent. That user agent defines what browser you're using or in fact, if you're using Python or if you're using Curl, it'll say Curl in the version. And so at a kind of a WAF level or a application firewall, you can block curl using the user agent. Now if you don't realize as an attacker that there's a switch where you just say dash user agent and you can make it whatever you want it to be, you can make it the thing it's supposed to look like. It can be Internet Explorer with Gecko, you know, Mozilla, which is what they all look like now, then that completely bypasses that firewall rule. So however, those rules really stopped a lot of that activity. And so that's, that's where we talk about a script kitty is like they probably just don't know that's blocked by user agent and they don't know that they can change it. And so you, you thwarted them. So. Yeah. Whereas like another actor, maybe a more advanced hacktivist group or like a ransomware group, that they're going to blow right past that.

Absolutely. And I thought was also interesting, you made another, a good point here. When you talk about the parent of pain, as you go up, it gets more difficult, more pain. So I would think that a lot of enterprises, someone working for enterprise might say, oh, we have enterprise wide security software, so it doesn't matter, we're covered. But you brought up a point that there's. Because it's always changing, that there's always going to be tools and new methods that hackers are using to try to attack your software. So you need open source tools as well. Can you talk a little bit more about that? I know if that rings a bell because you have so many courses but had something to do with open source tooling, it's still needed even if you have enterprise type tools. Tools.

Yeah, that's a really good question. Thanks for asking that because that's something I would really like to start being a broader conversation really is when you look at having an enterprise tool. So in that context, what I mean is. And nothing against Cisco sourcefires is the thing I could think of. Or if you have Palo Alto Azure Firewall and usually they have a whole suite implementation. If you buy Palo Alto, you also got their endpoint thing and you have their internal network monitoring and their threat reputation scale and all this stuff that's a suite together and that's all really, really great. But there's a few things to that where you're going to have gaps. One, it's really expensive, right? So am I going to pay for that whole suite? Maybe not. Maybe as an agency or a smaller company, or even a larger company, I already have other solutions. I don't have budget for that this year. I'm going to not get the endpoint detection response portion of it. So I don't have any endpoint detection at all. I just have a firewall, right? In that instance there's a gap. And that gap, especially if you're looking at like something like edr, if you look at EDR match to like mitre, ATT and CK techniques, if you use it correctly to its fullest potential, you can catch 80% of adversary activity just with an endpoint agent. So if you don't have edr, that's a really big gap. But there's open source tools and it's hard because I was trying to have this conversation with somebody else today is when I say enterprise tools, it's because you have to pay enterprise license for them. It doesn't mean that a open source tool can't be used as an enterprise solution. So if you use something like osquery, right? It's an open source tool from Facebook, essentially turns OSs, whether it's Mac OS, Windows OS or Linux, into a relational database and you can query against it as like as if they're relational databases. So you can say like select processes from all and you'll get all the processes running. That kind of thing makes it really fast. And then you can also tie that back into like an elastic stack, which is also free, right? And now you have your own EDR solution and that's scalable as the enterprise solution as well. You said to have people that you invest in who understand the technology well enough to implement it. But the good news is that if you have people that you've invested in that can implement that technology, they're also probably really good at detecting bad guys. And so it's kind of a dual win there and you fill that gap until you're now ready to pay for an enterprise solution or you decide, hey, we're good, this solution's working really well for us, and you keep that and you save yourself the money and you Just continue investing in your people, which is really my preferred version of it. But I know there's different reasons to have enterprise solutions support. So that's not always the solution. The second thing is really that say that Palo Alto endpoint detection is there or the Cisco endpoint detection or whatever you want to call it. Endgame's pretty good, so I'm probably not going to pick on them. Hopefully Endgame's not there if I'm the adversary and hopefully Microsoft ATP is not there because they're both excellent. But let's say I'll pick on McAfee a little bit. Let's say McAfee's on there. I test everything as an advanced adversary. Say we're a bank, we have lots of money, we're a big bank. I know who my adversaries are and they're going to be nation state level or equivalent. Some criminal organizations are just as good as Iran, North Korea, Russia, US. They're very, very good. So they're well funded, they operate as smooth as a business would operate. They're very intentional about their attacks. And so if you have groups like that who are after you called fintech groups, they're going to buy McAfee knowing that you have McAfee and test their attack chain against McAfee. Right. What they won't do is test it against your custom OS query deployment. Right. And so if you have continuous monitoring and you're fully looking at things with your enterprise deployment, that's great. Maybe now your gap fill is. Let me go ahead and deploy these frequently as a threat hunting solution. Or maybe this is my incident response method because it's a different kind of tooling that if I have an advanced adversary that's targeting me, they're not going to have tested their techniques against this enterprise tool. Right. So kind of removes that crutch that it can sometimes be a false sense of security.

So speaking of false sense of security, you also spoke about a framework, like I said, I'm a newbie, the NIST Cybersecurity framework. And the reason why I bring it up is you also showed or talked about how to find gaps in tooling that could help you with each of those functions. So I was thinking maybe can you go over a little bit what the cybersecurity framework is and then maybe how we find tools that match the different functions within the framework.

Yeah, certainly. So the NIST Cybersecurity Framework is provided as a tool to essentially check off is my business fulfilling the functions that are required as part of the security circle, so to speak. And so it starts with, do I have policy? And that policy feeds all the way through to is my policy informing my risk strategies, my risk strategy properly informing how I have implementation of continuous monitoring? Does my detection properly detect things so that I can then flow into an incident response motion? And each of these are defined as functions. When I do respond to something, can I recover from it? And when I recover from it, and this is actually a part that's missing. So if you watch that course, you'll see me. I consistently say this is a cybersecurity framework. And then here's what it should be. It's Aaron Rosenman's version because I add back in adversary emulation as an additional function as well as some intel. And the reason I do that is because after you recover, you're going to have mitigations that you implement. So say it was ransomware and they got in through. What's one of the responses I did this year? They got in because of a weak RDP password. Like you had RDP open and a concentrator, and they got it and they were spraying it. So if that's the case, then you're going to, I don't know, if you're smart, you'll probably do a VPN with certificate based VPN instead of doing RDP password into your internal network, right? So if you did that, that's great, you probably now should test that you can't still access that same RDP service or whatever that initial access vector after that. If they continued to bounce around exploiting SMBV1 with like EternalBlue, then you probably need to have someone come test that. So your incident response should find whatever the root cause was of the initial access as well as their ability to access whatever stuff they stole or encrypted. And then when you get into your mitigation motion, you say, your team will say, yeah, we mitigated, we checked the boxes, whatever we're supposed to do. We put firewall rules in. Maybe we implemented a vpn, maybe they did, maybe they didn't, maybe they didn't do it all the way. Right? You don't really know unless you now emulate that adversary attack and test it. And so that's why I add in the emulation function to this is once you get through that motion, you want to test it. Now you can 100% check the box and say, yeah, we're mitigated against that risk. And then you flow back in and that continues to be a circle. Maybe that Event influenced your policy and now we're right back around. And I really like the framework because the verbiage that it uses is at a level at which you can inform executive leadership. Hey, this makes sense. This is laid out in a business manner. These functions aren't. I'm not telling you. I need to do network behavioral analysis with population based differentiation to figure out. I need you to give me a solution for that. That doesn't mean anything to anybody. What you're saying is as a business function we can't detect malware. It's that simple. But it's not so simple that it doesn't also mean something to the technical teams. So it's a really good in between level CISO at a small company or maybe a director of cyber at a larger company where they can say here's all the functions I should be performing. NIST says so this is agreed upon by federal organizations. This is agreed upon by the collection of private industry that also supports nist. Everybody gets this. I'm not fulfilling this whole business function. I need money, I need people, I need headcount. And then you can go to your team and say, we're not fulfilling this function. You guys need to figure out how to do that. As a technical manner, I'm not going to tell you how to detect the malware, but it says we need to detect malware.

In some cases the vagueness is a bit bland, but I think that's because it really shoots the gap there.

Awesome. So frameworks and everything are great to have in place and how we started the show was unknown. Unknowns I would think. Every time. A lot of times I hear about breaches, it's always like they found out about a year after. So it seems like there's probably a lot of data in our logs and everything that may be being overlooked. So I guess the reason why I'm going there is you have a lot of courses on Pyspark and I don't know, you talked about elasticsearch. So do you usually feed a lot of your logs into elasticsearch and do you use a tool like Pyspark then to try to figure out if you have been breached or. I guess the whole point is what is Pyspark and how does it fit into security?

Sure, yeah. So Pyspark in itself is just a Python module that allows you to use a open source library called Apache Spark. Apache Spark enables you to do machine learning. I'm not going to say AI because it's not true, but it allows you to do Machine learning and kind of more advanced statistical algorithms. Right? The machine learning is statistics over time, essentially. Right. So it allows you to do that stuff on large data sets by integrating with Hadoop or whatever your big data platform is. So it can also be elastic, it can be databricks, it can be whatever it is. You just kind of set up a connector through Python and then now you engage with that connector. I use a Jupyter notebook to do it. Right. So I'll use a Jupyter notebook to load all the platforms in and I can use any other Python modules you like as well. But Apache Spark will kind of query that data and make data frames and allow you to do, among other things, one thing that's really nice. It's called graph analysis. So graph analysis using graph frames is a component of Apache, Apache Spark. Graph frames allows you to look at without getting into the math. Right. It essentially says these records are related in some way. And whether that. And you can differentiate with Pyspark, like I only want to look at these columns from these records and are they related? A really good example is if you're looking at Windows logs and you want to understand process execution, right? So if you write malware, you can. One thing you're going to want to do is really quickly spawn from process to process because it's hard to track. And so if you see a bunch of processes spawn each other, like command exe spawn in command exe three times or then did PowerShell and then did something else, right? Or calculators spawn command exe which spawn PowerShell. That's really hard to chain together because all you got is parent and child process in one log. But if you're looking at all of the logs and can use like graph frames, you can say, oh, how are these records related? You can start to chain those process chains together using PySpark in really large sets of data. So that's, that's like a really easy example for graph frames. Allow me to see. Oh, PowerShell shouldn't have been spawned from Calculator. That's probably bad, right? That kind of stuff.

I love Python. It's actually always on my top trends. I do a top trends every year about automation in general. And Python's always there because it has all these cool libraries. You did mention something interesting though, about AI. Compared to machine learning in the automation, functional automation space, AI is a big buzzword of what it can do. So do you see AI? It's 2021. This is going to be released one of the first few weeks in the new year. That's something cybersecurity experts need to actually learn more about. Is it just a buzzword or like, what do they need to know about AI and machine learning? I guess as we go into the new year and beyond now, that's a great question.

Way to set me up to have to make some predictions for 2021 about AI. You didn't put that in the ad.

Yeah, so. Oh man, someone's going to play this back to me in like 10 years and be like, see how wrong you were. AI took over the world. Just like Elon Musk said.

The thing about AI in the way that we describe it, I'm not saying it's not real. Right. AI certainly exists. It's really cool that computers can recognize dogs and pictures, that kind of stuff. I think that's great. In the same way those same models can be applied to recognize malicious traffic versus non malicious traffic, or patterns and logs that are bad. Or if you think about it from, especially at the level say like Microsoft and Azure, they have to monitor all of their logins. We're talking a massive amount of data. When you look at that, that's really where we want AI to say, hey, expose these patterns that are bad that we wouldn't otherwise see because we just can't process that much information. That's awesome. What it isn't yet is something that a practitioner can use from the day to day. Right. So I can't say. So like you asked about Elastic, I brought it up. Cause it's fun. But that's. I use ELK to monitor my own website. Right. So that's like my own website data up there. It's easy to do. It takes like four commands on Linux and now you can monitor your own stuff. So just as a ode to how easy open source monitoring is. But the thing about that is, am I going to now make a neural network to monitor that traffic just to have it give me the wrong answer because it doesn't have enough data in the first place? No, I'm not. That's not functional for me. Will I use statistics to look for outliers? Absolutely. If we talk about means over time or we're looking at a z value as it changes and I can say, hey, is this 10% different from the mean or is this 50% different from the mean? Is that weird or is that not weird? Like that's useful information. I think that's where machine learning starts to shine. Right. Graph algorithms are great. Some of the game algorithms are starting to be kind of cool just in making behavioral insights, but I still haven't seen a ton of I'm going to do detections on things that are new. Right. So if we look at AI, one thing we get really well is we can feed it information and train it what's good and bad, but if we don't know what the unknown unknowns are, we can't tell it what's bad. Right. And those models can be poisoned. So that's the other concern. Now there is unsupervised learning. Right. But that gives us results we don't always understand. And I think for in our space, at least for 2021, I think I'm probably safe for 21 to say. I don't think that's a practitioner's concern yet. Right. That's still stuck in deep engineering space. It's probably stuck in buzzword land for sales architects. Right. And appliances that say we use AI to detect things. But I don't think it's going to be the savior this year that's going to start detecting stuff before it happens.

Cool. Okay, before we go, is there one piece of actual advice you can give to someone to help them with their security testing efforts and what's the best way to find or contact you?

Yeah, okay, absolutely. I would say if you want to get better at testing specifically. Right. And testing your environments, all you have to do is look up one of those frameworks or look up Mitre, ATT and ck. Right. Mitre, ATT and CK framework will. They're excellent. You can go and say, what attack should I be concerned about? Like, do I have Windows boxes? Yes, I do. Okay, so let me look at Windows things. Right. And then kind of vector yourself towards do I have a Java based application? Certainly. Well, here's a list of things that you may be vulnerable for and then here's a list of tools that can emulate them. And then you just start looking for resources. Right. And so yeah, I have courses, I obviously support Pluralsight 100%, but there's a ton of other resources all over the Internet, especially in this area, that are free and open and available for you to find. So if you just want to look up how can I test JavaScript based applications for command injection? Right. The first three pages are going to be absolutely useful for you. And if you're the type of person that is really concerned about it and you start to build it, that's the best way to learn. That's that answer. Best way to contact me is to shoot me an email.

Right.

And or I mean email sounds really old fashioned, but I actually respond immediately on Twitter so I think that's a pretty common cybersecurity thing, right? So just a Rosenmund, which is my last name. If you just google me it'll pop up. There's also a ransomware variant that pops up totally unrelated. I just kidding. But yeah, you can find me there.

Thanks again for your security testing awesomeness. The links to everything of value we covered in this episode. Head on over to testguild.com S44 and while you're there, make sure to click on the Try it Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. And if the show has helped you in any way, why not rate and review it in itunes? Reviews really do matter in the rankings of the show and I read each in every one of them. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.