Discover Network Vulnerabilities using Infection Monkey with Maril Vernon

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host Joe Calantonio.

Hey it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Meryl Vernon all about her lateral movement with Infection Monkey, pluralsight costs and other security related topics. Meryl also is known as she who Hacks and is an IT security expert specializing in pen testing who has helped people start new careers in cybersecurity from a long tenure in non technical industries after entering cybersecurity from the National Guard in 2018. In just over one year, Merrill has achieved seven certifications in Pen testing and security in unprecedented time, including Metasploit Pro Certificate Specialists, AppSpyta Pro Certified Specialist, AWS Cloud Certified Practitioner, Atomic Purple Teaming and Security Plus. Merle's expertise is also featured as a contributor editor of the CIS AWS Foundation, Benchmark v1.3 and CSFI. Closing the gap between enterprise risk and IT security, Merle discovered a need for a new kind of expert who could speak to non technical audiences, which is why she makes a great guest for today's episode. You don't want to miss it. Check it out.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you could start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey Meryl, welcome to the Guild.

Hey Joe, how are you?

Awesome, awesome. Great to finally speak with you. I think you're the perfect guest for this episode or for this show because I think a lot of our audience are newbies and it seems like you have a special knack to actually break down security in a way that I think other people can easily understand. So I'm really excited to dive into it though. Before we get into it, is there anything I missed in your bio that you want the Guild to know more about?

No, although I do need to update it. Thanks for bringing that to my attention because now I have about nine or 10 certifications. I'm also Aviatrix Multi cloud certified and I picked up a few more along the way. So it's been a busy, it's been a busy first year in InfoSec, but tons of good things happening all the time.

Awesome. So that actually leads to my first question. What's the deal with certificates? Do you think it actually helps people with security? You just love learning, like why so many certificates?

So actually this is one of the soapboxes I stand on the most. I think that a lot of people don't understand certifications and the practical application they have to the jobs that people are going to do every day. So. So I'm not a big advocate of having a ton of them, despite that I have so many. And I think that the big ones that people like certain jobs are known for, like my job and pen testing, you know, people want a ceh, they want an oscp and they don't actually know what that means because they want like web application pen tester. And I'm like, neither of those certifications address web application pen testing. So I do think that certifications are good to have for foundational knowledge and you know, giving you contextual understanding to understand higher echelons of more complex ideals and methodologies. But I don't think you need a ton of them under the sun. I think actually nowadays a lot more someone's accomplishments and skills and experience speak louder than the certifications do. But insecurity, unfortunately, certifications can be the gatekeeper Sometimes, you know, HR won't even move your application on unless you have their, their bar entry certification, which is usually a SEC plus so awesome.

So once again, that's my next question was if someone's getting into pen testing or they, you know, trying to move for over from a different field. Like is there one certification you think, no, you definitely should get the certification. It's definitely worth their time and effort because it gives you X amount of benefit.

Yes. So even for someone who's worked in IT for a long, long time or who's been a developer for a long, long time, I recommend SEC because you know, up until now you haven't been a security professional, you've been a development professional or a sysadmin or some other type of professional. But security hasn't always been an aspect of what you're thinking of and there is a security aspect that plays in most business operations. So it really helps to put yourself in a security mindset and thinking of just the aspects of what you might be doing that do apply to information. So SEC is a great IT'S a managerial level cert. So it's a great overview. You're going to get a very wide but shallow breadth of knowledge. So you're going to drink from the fire hose a little bit if you're new, but you can understand everything in SEC and take that forward with you. Everything else is going to make a lot more sense. Great.

So since you have taken so many certs as well, any tips you have for people to prepare for them, to pass them, any hacks you've learned to learn, ramp up quickly.

I actually did used to call myself a process hacker before I was a real one. Like I'm really good at taking something and breaking it down and making it happen faster or better or easier. And I do tell people I'm more of a professional student than I am a professional pen tester. But I would just say honestly, some of my tips are to like flip to the back of the book and memorize the glossary first. Because the more familiar you are with the terms that are being used throughout the book, the less you're going to have to refresh yourself on what something means as they're trying to explain more about it. Additionally, it would be to get yourself some context so don't be exposed to DLP for the first time when the SEC book is talking about it. Understand how a dlp, what it is, how it fits into a corporate enterprise like security program. So understanding security programs in general and like structure and like the various components to a defense in depth setup, all those things will really behoove you as you learn about how to make them more secure.

Nice. And as I mentioned in your bio, you have a knack for helping people that may not be in security or non technical industries make a transformation over to this career. What kind of transferable skills do you think folks have that make them or would make them a good fit for a cybersecurity security type role at an organization?

Oh gosh, sorry. There are tons, honestly. So people have been technicians their entire careers, don't have a ton of soft skills and they don't like the soft skill things. So a few of the things that stood out to my first hiring boss that as the reason she hired me into InfoSec. Despite that I told her I had so little technical knowledge that I didn't even know what an IP address was. I was like but I love learning. I learn quickly. I retain information really well. I'm great with attention to detail, I'm really good at documentation and policies and I'm also really really Good at speaking to multiple people because I came from customer service and marketing. So I can take a concept and translate it for any audience and make sure that anyone understands what I'm talking about. And those are all things that technical people inherently lack and like hate. They don't want to work on their public speaking, they don't want to speak in the meeting. So if you can immediately understand even what your team is doing and relate it to the other business managers on behalf of your team, you're going to play an integral part in what they do and they're going to have to involve you in all their projects so that you can understand, so that you can be the face man for them. That's a sweet spot to be in because now you're walking around as the go to face expert for all these security projects and all these things that are happening within the company that senior management really cares about. So there are tons of applicable skills that people from finance or sales or marketing or APAR can absolutely bring with them into information security.

So I guess then what got you into security? It seems like you'd be able to learn anything. So why put all your efforts into learning cybersecurity?

Because I was hitting a knowledge ceiling with pretty much every new industry I tried, I tried a number of them and I would come in, learn it quickly, master it, because I'm really good at learning. And then I would get bored and I said, you know, I really need something where it's, I'm never going to know it all. I will never sit back and be like, well, I'm done now. I'm the epitome of the master of cybersecurity knowledge. You know, everything's always changing, new things are evolving, new things are being combined in different ways. There's so much to learn. It's ever evolving. It's so challenging. The second I get better, the enemy gets better. And then I have to get better to out better them. And it just keeps going like that. And it's just, it's super engaging material. It's material that my brain really loves. I retain it really well without really trying. So you know, that tells you that you're in a good niche spot for your skills. So that was what really attracted me to security from the beginning.

Absolutely. And I love learning as well. I'm always on pluralsight looking for new courses and new things and I actually stumbled across yours. Never heard of it before. So I'm excited to learn more about what is. You actually have a course called Lateral Movement with Infection Monkey. So I guess at a high level, what's Lateral Movement and then what's Infection Monkey? Can we break that down a little bit what that's all about?

Absolutely. So Lateral movement with Infection Monkey is part of the Red Team tool series that pluralsight's doing. There's also a Blue Team tool series. These are short, no more than a half hour bite sized little courses on various tools you can incorporate into your arsenal as you're executing more red or Blue team operations. So the part that lateral movement plays, and we do go over this in the course, we tell you which MITRE tactics it addresses and where it fits into the kill chain in every single Red Team Tools course. So after you gain initial access to a system, which would be your initial compromise, and then you're starting to dump credentials and do network discovery and you're trying to enumerate different shares or users or ports that are open dump credentials, lateral movement is what gets you from your initially compromised host into other places in the network. So other shares escalating to other users would be privileged escalation. That's kind of a part of lateral movement. So you're like, I want to be on the network share where the data lake is, but this basic user doesn't have that. So I have to hop to this server where the admin credential is unprotected. I can then escalate to an admin and now as an admin I can get to the data laser. So that's kind of the part that lateral movement plays. And Infection Monkey is such an effective tool at multiple stages of the kill chain, but especially lateral movement because a lot of something that's very hard to manage from an oversight point of view for IT Ops teams is configuration management. It's one of the number one things I have a ton of findings on in pretty much every assessment I do because it's so hard to stand do configuration changes in a standardized fashion. And so you might have left a port open somewhere. Now there's a hole on port 22 to another host that you really don't want to have port 22 open. You know, something like that. And Infection Monkey because it is not an adversarial emulation tool. It's a real payload. It's fully loaded, just like anything that China uses would be. And it goes after your system, except for its only goal is to propagate itself. It's not going to attack your data or encrypt anything, but it'll find the porthole, it'll Find the service holes, it'll find the admin hashes, and it'll combine all these things to say, hey, I started off on this basic user endpoint over here, and I ended up all the way over here in your data lake. And it'll show you the path of host that it actually took to get there. It'll tell you what compromise it used at each step to hop to the next stepping stone. It'll give you a visual layout, so it'll give you actually a live map of all the things that's compromised. It'll compromise something from one host, talk to another host, compromise that thing again. To show you these all have a path open. So if you want to lock those port down, lock SMB down, make sure you're taking away as many steps from that kill chain as possible. I mean, Infection Monkey is just such an effective tool for doing all of that.

So I want to dive a little bit more into that. But first, like I said, I think most of my audience. I could be wrong. Mostly beginners. I don't know if we ever define what is mitre? Like, what is a mitre, ATT and ck.

Okay, so Mitre, ATT and CK is a framework. And really what it is is it's a giant repository. It's kind of a library of adversary TTPs, which are tactics, techniques, and protocols. So basically, anything that the enemy is doing to try and accomplish a specific stage of a hack, which is called the kill chain. So a hacking process is called the kill chain. So anything they're using to accomplish initial access, so compromise their first host, move laterally in a network, take data and get it out of your system, that all is combined into one giant kill chain. And all those individual things are TTPs. And so MITRE has basically taken all the TTPs from the public playbooks of the enemies and categorized them so that you can tie the testing and the security controls that you're doing, like the controls you're implementing and the testing you're doing, to specific tactics, you can say, you know, if they wanted to accomplish this on us, they would have had to use this tool right here. And we took away their ability to do that. So now, even if they got this far, they could no longer move forward with this breach because we've removed as many pieces as possible so that they're less likely to be successful. And so Mitre really helps you do that.

Cool. Now, you mentioned Kill chain. Once again, I'm a newbie. So let me picture this. You mentioned Infection Monkey. Lets you look at different ports and then access other resources once it's into other resources. So is that the kill chain? Like eventually you get to the point where you have admin rights and you're able to actually do some damage.

Yeah. So the kill chain would be how I want to accomplish a hack. So let's say in order to compromise my first host, I need to phish somebody so that I can get their password. I would say my initial access is going to be a phish. And once I have them click my link and give me their password, then I'm going to see. I'm going to run netstat and enumerate domain users and all the shares that person has access to and see where I can go. That's my discovery steps. Now I have initial access and discovery and it keeps going like that all the way down the kill chain through credential access and privilege escalation, all the way to exfiltration, which is taking some something of yours and leaving your environment with it. So that I have it on my own over here. Now that makes up an entire kill chain. And so you kind of pick a methodology for each step that you want to combine specific to that network. So if I got in and I saw you had SMB open or port 22, which is SSH, I would say, ooh, I'm going to pick using SSH with this payload, which works over SSH to try and accomplish this. So I can make myself an admin kind of thing from a high level. There's a lot more steps involved, but that's kind of how that would work.

So if someone didn't know those steps. Infection Monkey, does it have like known exploits and known paths? That it does. And that's what it does. It automates those type of exploits where it'll walk through what someone would normally do to get to a certain outcome that you're trying to achieve.

Yes. So versus me having to see all the open ports and see all the users and pick an exploit and craft it. Infection Monkey just does all that automatically. It's doing it all the time. So if it's got 10 payloads it can use on a certain port, it'll try all 10 of them and tell you which ones were successful. And then you can just break that exploit down. You can say, oh, this payload. Okay, if I simply remove this, that won't work done. This one, okay, if I remove this, that won't work. Done. And then you're taking away puzzle pieces for them to play with to try and craft an entire successful Hacking process.

So how come more companies don't use it? Maybe they do use it. It sounds like something you would. It's a quick win almost.

I don't know why people aren't using this. I saw this in a demo at a conference. I can't remember, can't remember which conference it was, but I was like, this is amazing. This is robust. This is kind of scary. I mean, this is good. Like, if I was my IT Ops team, I would be running this on myself every week. To be like, when we change something with this update, did we open a hole somewhere or a path that we didn't intend to, or are we still just as secure as we were on the last update? You know, like, this thing is so effective and it's got so many implications. And you can use it to protect yourself against phishing, against lateral movement, against privilege escalation, against pass the hash, against exfiltration. So I think more people would be using it. That's my soapbox.

Is it hard to set up? Is there overhead with it that maybe people may not use it or just not. It's just. It's not well known.

No. I do walk you through this in my course. It's either a very simple open source download. Gardacore offers, gives it away for free, you can totally see the Python source code running behind it, or you can subscribe to an AWS instance. That's what I did. I just went into the marketplace, click, click, click, subscribe, launch and then can use it, ready to go.

So I know a lot of times people, when they use tools, can get in trouble if they turn on their network like a metasploit or something, and they're messing around to learn it. It doesn't seem like it does anything malicious. It just walks through and gives you information without actually doing anything bad. Right.

This is the kind of tool that if you were to use it, it's going to send off a bunch of flags and alarms. Hopefully, hopefully your IDS or your MSSP is going to be like, what is going on over there right now? I do warn people before I set it off. Otherwise a lot of people get their feathers ruffled. What you have to keep in mind is even though it's not a malicious payload, its only goal is to replicate itself. The monkey's an agent. So it'll replicate and then try to move and replicate and try to move, but it's still doing all of that with real payloads. So your antivirus is going to say, I detect this payload, this payload, this payload. Those are bad payloads and I know that. So it's the kind of thing where you do have to turn your firewall off to download it. And you do want to warn some people or at least tell your boss. Maybe you don't warn everyone because you want to see how well they do, but at least tell your boss before you do it because it'll set off some flags, ideally.

Cool. And it sounds like the end result is something very actionable where if someone sees the report, they know what to do or how to fix it or resolve it.

Yes. It actually gives you a MITRE report, a security vulnerability report and a Zero Trust report so that no matter what you're using, can make remediations based on the information it gives you. And like I said, it gives you a really lovely little live network map. And see, senior management people love visualizations like that. You give them a network map saying I started down here on my computer and they made it all the way to the CEO's computer and they go, oh, okay, now we know how bad that is.

So have you actually used this in your day to day organization where you work or have you got good results from it?

Yep, yep, Very cool.

So I guess another thing you cover in your course is something called Zero Trust model. And once again, I apologize if it's a newbie question, but now what is a Zero Trust model?

So Zero Trust is just, it's another alignment framework. It's something you can align your testing program to. So when you start out with a new security program, the thing you're going to be trying to, the level you're trying to achieve is basically compliance for some reason or another PCI compliance, ISO compliance. So you have a governing framework that's actually, you can be audited to that thing or has a regulatory body and you're trying to get compliance to that thing so that you don't get fined. Once you have that and you're operating in a reasonably secure manner. Now you want to take your security outlook to the next level and make sure you're being proactive with it and make sure you're not letting it go stale. That's when you're going to implement things like Zero Trust or mitre, which are reference frameworks and not compliance frameworks. There is no MITRE compliant anything. These don't replace ISO or NIST or anything else with mitre. It's not like that. But you're gonna take these other reference frameworks that people develop and you're gonna see if your security is standing up to that. And if not, that'll give a really good roadmap on places where you can improve your security even far. So Zero Trust is just one of those. It basically says there are no trusted relationships. Like if you have a TLS set up with a vendor, which is like a trusted tunnel at the data transfer layer, then if someone was to compromise one of your vendor's users, let's say yours are too secure, so they compromise your user, your vendor's user, they let themselves inside your tunnel and now everything is going good because you trust that vendor. Don't check all those requests and all those source IPs. You say anyone in the tunnel is good to be in the tunnel. Zero trust as you verify every request, every source, every time, no matter what. Because we don't trust anybody. So it's not a bad place to be in here.

Nice. Now, the multiple areas that make up what is a Zero Trust framework, once again, I think this is. I pulled this from your. Your course.

Yes, it's in my course too. I kind of go over at a very high level what goes into the Zero Trust framework. So it's basically just, you know, doing data verification every single time. It's got some pillars that are make it up and like each pillar breaks down into certain controls. So like if you have this, then you're. This pillar is 50% good. If you have these four things, this pillar is 50% good. And like you can kind of gauge how well are we doing Zero trust. If we want to do zero trust really well, we have to have all these things. So again, it's a reference framework. It's just how high do you want to build the walls? But eventually when your walls get high enough, then you kind of want to hire someone like me. You want to hire a pen testing firm or a red teamer to come in and actually launch some catapults at your walls and see if they stand up or if you've missed something. And Infection Monkey is a really great tool for doing that because it's basically harmless and it's free.

Very cool. So once you have your report from an infection monkey, is there anything else you do as a pen tester? Do you say, oh, wait a minute, now that I know this part is open, I'm going to do this type of attack with another tool?

Yes. So a lot of people will take an automated tool like Infection Monkey or Atomic Red Team, and they'll just launch it and get the results and say, well, we're done now and it's like, well, this is one of the things I explain to people. I don't stop there. Like when I have those results, that tells me other things I can try other things, I can do that. And I never give a raw report to anybody because they generally don't know how to read them and they can be pretty scary. Scary. So as a pen tester, I take all my findings and I give them some organizational context and I put them into a report. So I say, you know, we don't have maybe this, but that's actually not bad for us because we have this and this and this to compensate for that. So whereas the tool might say this is high for us, this is actually low. We're actually doing a pretty good job here. So I do try to give some context, I do try to give some actionable feedback. Like if you wanted to make this more secure, you could do this. If this is operating as intended and your risk appetite is pretty good with this operating how it is, then you're fine. You know, it's really important to know that in security we operate as a reporting body, we simply tell you this is how bad this could be. This is how you're operating. We don't tell you you can or cannot do something. We say if you do that, this is how bad it gets. But if you take our advice, this is how less bad it gets. So a lot of people insecurity get frustrated because we don't call the shots, we just advise for advisors. But yeah, I absolutely take those results and I would absolutely see, you know, is there anything metasploitable I can do from this? Is there anything cobalt strike I can do with this? Oh, you have this port open. I'm going to. I already have a payload crafted for that. I was going to send it to your IP address and see if I can get you to click it. And then I'll say it takes your finding a step farther because it goes from, in a perfect hacker world, this might be bad if the hacker could theoretically to I already did it. I took this thing and I made it happen. And it's already happened. And now that takes its likelihood up a notch from possible to already happened once in the last year. Which makes its risk rating go up and risk as a business function. So everything in security translates to business risk.

So did you give people a heads up before you do an engagement? And does that kind of. I guess you have to. But does that kind of make it so people can be prepared and so you're not getting real results or Let.

Me tell you, we don't always tell people, but even when we do, does not often change the results.

Wow.

Sadly, there have been times. So I participated in Cyber Shield 2020 recently, which is a huge purple team exercise for the National Guard Bureau as a Red Teamer. And so we had a blue team and we had our red team over here and we weren't allowed to talk to each other, but we had a Purple team coordinator who was kind of saying, okay, don't launch your next thing yet. They haven't even found the first thing you, you know, don't start dumping credentials. They can't even tell that you've scanned their network. So it was kind of a live engagement. But eventually the blue team was really not finding anything we were doing. They weren't seeing the indicators of compromise. So we had to open up our books and say, okay, see me. I'm gonna hit enter and launch this payload. You should go over here and see if you can see that. If you can't see that you configured something wrong. You know, like I know I just password sprayed you. Can you see it? If you can't see it, that's bad. So we don't always tell people. Sometimes we do give the highest up, a heads up. Like if your chain of command tells you something's going on, it's not actually bad. Don't wake up the CEO. You know, we know our response process is functioning as intended, but you know, it's not actually bad. However, sometimes we don't. Sometimes we want to see if our mssp, who is our third party security provider, is awake and on it. If they're telling us before we tell them that something bad has happened. We want to see if not only are our tools like our antivirus, but our people process is working. You know, did you wake up the right people? Did you send an email or did you phone call? Like if this had been an actual breach, we need to know that our incident response is functioning as intended. That's part of of security. So it really just depends on if we're going to tell someone or not.

So since I saw my podcast, you have people talking about red team or blue team. Do you notice people spend more time on one than the other or is there like a breakdown people should be spending their time in? Is it mostly just red team people are focused in on rather than blue teaming type activities?

I would say that everyone on a red team came from a blue team originally. The red team never conceptualizes itself. It always comes from a blue team because again you want to build up your defenses and get your walls and your defense pretty good or the red team will come in and just obliterate you. It's like a non value added test. So you want to make sure you've got everyone in a defensive mindset. You know, every red team exercise I do is to improve security. I do it with the goal of improving security, not just to break it really, really well and walk away and say, well, I broke that. That's your mess. A lot of Red teamers don't like that part. They just want to come in and break it and have fun and leave it for the blip team. But really you need to give them something to go off of. So I would say I spend actually maybe 10 to 20% of my time in the red teaming world. And everything else I'm doing is a defensive standpoint. It's a lot of advising it ops, putting a improved security spin on all the breaking stuff that I've already done. Or it's purple teaming. It's saying, hey, I am myself using a team server, which is a red team tool, and I'm using a monitoring tool, which is a blue team tool, defense. And I am actively watching to see if I can see my own activity. If I can't even see it, then how is my real blue team? I'll purple team myself, I'll red team myself. But I do spend a lot of time like everyone else in my department is blue. The ciso, the architect, the infosec program manager, security awareness. You know, they're all defensive people, so I have to be able to translate what I do into blue team or I'm not affected.

So obviously Infection Monkey should be in everyone's toolkit. Are there any other tools you use as a go to pen tester that you like or that maybe doesn't have enough love out there that people should know more about?

Well, a lot of them are pretty straightforward. You know, Burp is something that I use a lot. Everyone uses Metasploit. Who doesn't? However, some of the ones that I really love that I don't think get enough attention are Atomic Red Team by Red Canary. Shout out to them. Amazing tool you've got out there, guys. Another one is Silent Trinity. Silent Trinity is a great. If you're not familiar with Cobalt Strike, Cobalt Strike is a team server type setup. So you basically host your own server that you're compromising systems and you're getting sessions to all your compromised hosts and you can see them and interact with them and Send more stuff at them inside Cobalt. Right. Silent Trinity is kind of a boiled down bare bones version of that. It's very cool. Yeah, I like a lot of the automated testing tools. I actually don't use a lot of Kali. People are going to hate me for saying that I don't drive my Kali machine a lot. I don't really need to. You know, I kind of pick out the bits and pieces that I like. You know, I have an NMAP script that I run that gives me some text outputs and that tells me my users, my shares, my open ports and I go from there. So, yeah, I don't really use a ton of Kali, but I do use a ton of the other open source automated red teaming tools. I think they're really effective because when you get to my point, you want to do targeted testing, you don't want to keep throwing the kitchen sink at it and having all those results to go through. And, you know, if you're. If we're improving everything at once, we're improving nothing. So let's pick one thing. We're going to improve our initial access vectors. We're going to take care of as much of that as we can. Okay, moving on. We're going to address as much lateral movement vectors as we can. When that's reasonably secure, we'll move on. So I really want to boil down and laser focus my testing to specific ttps and not just keep throwing the whole tool at it. It's not effective.

Okay, Mar, before we go, is there one piece of actionable advice you can give to someone to help them with the security testing efforts and what's the best way to find or contact you?

The best way to find or contact me is probably going to be on LinkedIn. I spend a lot of time in discord now. The LinkedIn DMs got pretty overwhelming when I got to about 40 of them. So I'm always happy to answer questions. I have a team of experts that I work with very closely, colleagues of mine and we're all over in a Discord server. So I'll try and get you in a Discord. Pick an alignment framework on top of your compliance framework. You know, whatever you do to have to not be funded by the government, do that. But pick a compliance framework because it will get you all speaking the same language. Business risk and internal audit and senior management and IT ops. Those are all people that get different reports of mine. You know, one is highly technical, one is strictly an overview, one is, you know, strictly the business impact and none of these people have the same job function and speak the same language. So when you use something like MITRE or Zero Trust, people are using the same terminology, they're referencing the same thing across their reports. It's not, well, we call your thing this and you call our thing that, and now things don't make sense. You know, standardization is one of the keys to security. So standardize as much as possible. Document everything. Document, document, document. However, you spin up an EC2 instance however you want the canned responses to phishing tests to go. Document everything because documentation saves lives. And then pick a reference framework and get everyone using it. Get everyone thinking on the same page so even when they're speaking their own language, you have something common to go back to.

Thanks again for your security testing awesomeness. For links to everything of value we covered in this episode, head on over to testguild.com S41 and while you're there, make sure to click on the Try Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. And if the show has helped you in any way, why not rate and review it in itunes? Reviews really do matter in the rankings of the show, and I read each and every one of them. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.