Getting Started with AppSec with Tanya Janca

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Tanya Janka all about getting started with infosecurity, AppSec and more. Tanya is also known as the Shehax Purple, is the founder, security trainer and coach@shehackspurple.de VR specializing in software and cloud security. Her obsession with security software runs deep, from starting her own company to running her own OWASP chapter for four years in Ottawa, co founding a new OWASP chapter in Victoria and co founding the OWASP Deb Slot Open Source and Education project. With her countless blog articles, workshops and talks, her focus is clear. Tanya is also an advocate for diversity and inclusion, co founding the international women's organization Wooset, starting the online MentoringMonday initiative, and personally mentoring, advocating for and enabling countless other women in her field. As a professional computer geek for over 20 years, she's a person who is truly fascinated by the science of computer science. It's an honor to have her on the show. You don't want to miss it. Check it out. It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security hey Tanya, welcome to the Guild.

Thanks for having me.

Awesome to have you. We spoke a while back on my other podcast in the Test Guild Automation Podcast, but today it's really great to have you on the security podcast. Before we get into Tanya, last time I spoke to you I believe you worked at Microsoft. Could you just give us a quick update what you've been up to since then?

It might not be quick, but I'll do my best. I started a startup company with a friend and we were creating a security product, however that dissolved. It's really hard to find a co founder where you both want to run the business the same way, it turns out. And so now because I'm addicted to starting companies. I started a second startup company and now I run shehax purple.dev for developers and essentially we create content online that you can subscribe to to just receive regular updates. Learning about software security and cloud security. And then we're going to be releasing courses soon that you can do from home at your own pace with the idea that, you know, you learn the theory behind whatever it is and then you go do it hands on with various products. And then I also do coaching of companies. So I have a basically a handful of companies where they call me and I help them with their appsec programs or whatever it is like their devsecops or planning an incident response process and things like that. And I find that really satisfying. And it also helps me figure out what things I need to make courses about if that makes sense. Like if all my clients ask for the same thing, a course is definitely required. So yeah, so far it's really, really exciting to run my own company and just help lots of people.

That's awesome. When you live in Microsoft. I was really inspired. I was like, oh that's awesome, I wish I could do that. And then like a month later I was laid off so I was forced into doing it. So yeah, I don't know why I went there, but you were an inspiration to start with, so thank you for that. Co quick question. Top of mind nowadays is coronavirus and I'm just curious to know, as a security expert, when you do coaching, are companies calling you lately asking, hey, a lot of our employees are working remotely. Are there certain things that they need to worry about from a security perspective for the apps when that type of model changes from on site to off site employees, security wise?

I have had people ask, but mostly that specifically like the idea of VPN and things like that. I don't mean to sound insulting but like if I'm working with a team that really, really, really knows what they're doing in regards to AppSec and cloud security, like turning on a VPN from home is like really simple for them. So most of them, they're already had things like that and they're already ready. They're more concerned about how it's going to affect their business or if for instance they have, you know, if they have business units where they have to come in. For instance, someone I know works at a company where they develop medical devices and so they physically must be there and they can't just stop doing it because then, you know, in six months from now there won't be pacemakers. Right. And so they are asking for help, but it's more like how to sanitize things and things like that, which aren't my area of expertise. So I do know that this is a big area of concern. I'm part of this alliance called Cobalt alliance, and we've been issuing guidance to give to clients that aren't as technical as the ones that I usually work with. And so I share that out. But because the people I work with are usually, usually so, so, so, so, so technical. The idea of like, oh, you have to use a VPN or whatever, they already know that if I sent that them, they'd be like, yeah.

But yes, I know that a lot of people are. This, this is top of mind and working from home. As a tech person, I can't say how grateful I am that this is an option for me and for so many people because, yeah, it's keeping a lot of us safer, that's for sure.

Absolutely. So what are the different areas of security? I know I believe you specialize in app security, but like I said, this for beginners. Are there main areas of security that people usually focus in on?

Yes, yes. I wrote a blog article about this and it sort of caught fire. I didn't realize how many people didn't know. So when I started in security, basically I made friends with an ethical hacker, a pen tester, and he said that I should be a pen tester. The three jobs that I knew about were the people that say no all the time. By that I meant enterprise security. They would just always tell me no for things I wanted. The people that did risk management, which I did not understand at the time, they would just ask me questions about my apps and disappear and then often say, no. I'm not trying to insult them, it's just that's what my limited experience was and I didn't understand. And then my friend that was a pen tester who seemed to make a lot of money, seemed to have a lot of fun and that seems kind of cool. It's in the movies and stuff, hacking, blah, blah, blah. So I joined him and did that. But very quickly I figured out, especially through my involvement with owasp, the Open Web Application Security project, that basically application security is all the things you do to make sure that your software is secure. And that pen testing or security testing is just one of all the many things under the umbrella. And I figured out I really loved doing the umbrella, if that makes sense, like helping them create a program to make sure things are secure. Reviewing code, like helping them put tools into their pipeline to make sure it's more secure, creating standards and guidance, and helping developers just understand what I actually want from them. When the pen tester comes, they don't really find very much stuff like that. And so application security is the idea like that you are working full time, usually towards helping the developers make sure they're creating secure code and formalizing activities as part of the system development life cycle. So sometimes that means going to a design meeting and looking over the design and saying, you know what, this part here I'm concerned about. Could we brainstorm perhaps a way that's less risky to accomplish the same path? And so for me, it's as a person who just like loves helping, I really liked that better than pen testing, where you go and you do security testing really in depth and you try to figure out vulnerabilities and then you often are expected to exploit them and either get trophies or other proof that not only did you find a vulnerability, but that it was exploitable so that a malicious actor could do something bad with it. I personally would rather spend the extra time when you're supposed to be writing the exploit with sitting with the developer and explaining the difference between a waitlist and a blacklist and how they add a blacklist, like a list of things that aren't allowed, which I got around, versus a wait list, which is just tell me what is allowed and block every other thing and therefore I won't be able to get in and then helping them program that in if they need the help. Do you know what I mean? And then, okay, so we learned this lesson, so can you teach it to the rest of your team or can I come in and talk to the rest of your team about this? Make sure everyone's doing this now. Other jobs in information security, there are so many. But just just to continue on, there's people that respond to security incidents. So these are people you have a manager of the incident. And I don't mean that you manage people. It's not like a normal management job. It's where you manage the actual event that's happening. And so you're the person that gives updates to upper management. You're the person that makes sure everyone has the access and the things they need. You're the person that needs to act really cool while the entire world feels like it's burning around you so that you can keep calm and make sure you take the best decisions as opposed to things that might seem to make sense in an emergency. Then there's the people that actually investigate the incident. So some of them do forensics, where they dig through memory and other things to see what's happening. Sometimes they have to search through the dark web to figure out where your data's for sale and how it got there. Things like that. Pretty cool, right?

There's also risk management, which honestly I'm definitely not an expert in, but the idea of identifying all the different risks to the business and then creating plans to mitigate them, creating plans to manage them, which would mean, you know, keeping an eye on it, or adding some things to make sure there's less of a risk, but the risk is still there, but you've reduced the risk greatly. Or if the risk is still there, you've done things so that if it happens, there would be a lot less harm. So as an example, I recently was on this panel to talk with small businesses and nonprofits about what they can do to protect themselves. And I told them the number one most important thing, like the thing that they're getting hit with the absolute most right now is something called ransomware. And then I explained, you know, ransomware is them either removing your data from site or more likely them encrypting it, and then either way demanding money that they don't have. And I'm like, you can patch and do all these other things, which are actually quite a lot of work, right? And getting all these security tools, or what you could do is reduce the harm if you get it. What you could do is ensure that you have excellent backups and that you can roll back and restore very quickly. So if you are hit with ransomware, you can say, haha, screw you, we're not paying you confidently know you can put all your data back where it was and you can try to figure out, you know, where they got in and try to solve that problem. But if you only have a bud for all of your security at $5,000, you can't go and buy an amazing firewall, right? So a risk analyst would come up with a solution like that. So you have this very small budget, like, what can we do to make sure that you're protected? Or even like really, really big risks, or when risks chain together to become something much larger. And so then they advise the business. There are so many. So there's enterprise security. Those are the people that do things like make sure things are patched. Usually they're what keep your, your desktop or your laptop computer safe. So they are the ones that are taking away your administrator rights. They're the ones that are making sure that you get updated to the latest software. They're the ones that might have a list of white lists of software like allowed software. They would definitely be in charge of things like email filtering to make sure malicious looking emails don't get in, or web filtering to make sure you don't go to sites that are disconcerting. And then there's, you know, the team that does your firewalls and network security. So they might be doing zero trust or they might be doing different zones where you partition different areas off, but they make sure your network is secure. There are some like more rare jobs like social engineering, which usually involves training employees about how not to click on phishing emails and how to ensure you always, always essentially obey your policies. Because when we break security policy, that is when malicious actors get in. So when you let someone follow you in after you know, you've used your badge to get in somewhere and then someone follows behind you, that's you breaking a security policy and maybe that person is malicious. You don't know a lot of people, they don't think very much of those things. However, I worked somewhere once and we had let an employee go and people kept letting her in and she assaulted someone, it turned out. Actually what had happened, we found out later she had a brain tumor. Yeah. So she'd actually been like this wonderful, warm, amazing human being and then got very like erratic and violent and really scary very quickly. And we let her go, having no idea that she and her husband ended up calling us a few weeks later explaining like she just died and they did an autopsy and, and that's, that's what it was like, you know, so you can remember her the way that you had for the years it you worked with. That's the real her. But the point is people just kept letting her in because they knew her face and when they break policies. So then that's the next person, people that write policies. And it might seem like a not sexy job, however, I've written a bunch of policies around software security and it might sound silly, but it was so satisfying to create something that I knew would make sure we made secure software. And although all the other policies seem boring to me because those aren't areas that really interest me as much. The idea that, so we created this policy and then I created this beautiful guideline and a wiki with code samples and all the things. It's like this is the policy, but if you follow the stuff in this wiki, it'll explain. So. Oh you're doing a file upload, that's risky. Like, please do this, right? And by having the policy, that meant that from then on, if a developer disobeyed the policy. So the first thing obviously is you just go talk with them and you're like, hey, oh, did you know this? And quite often it's just a mistake, but sometimes people break policy because they don't think it's important or they don't understand, or they're telling me they did encrypt it. But really what they did is they base 64 encoded something two times in a row and they think that that's encryption because they don't understand the difference. And then we have a good talk, right? And then I make them change it because no, but policy is like a tool that I did not understand when I was younger that you can use to help steer people in the way that you need them to go.

Nice. So I believe your area is app security, and you said you like doing more umbrella type stuff for some reason. I think I come from a testing background. Performance and functional. So I used to think of security as just pen testing. So I don't know if that's a common perception. So when you go to a company and they're looking for help in their app security type efforts, do you find that they're strong on penetration testing but lack some of the other areas within App Sec that they need to focus in on?

So quite often when I was a pen tester, I would come in and they would have zero app security and they would want me to do a pen test. I want to do the best thing for the client. And the issue is that everyone's heard of penetration testing and so they think that's the thing they need. And that's the famous thing. And that's the thing you see in movies. And they're like, yeah, hack our stuff. And I'm like, cool. And then I would describe a security vulnerability assessment where I don't exploit anything. And instead I spend that extra time writing up, you know, a report that explains how to make sure that these vulnerabilities never happen again. Or I spend the time with the developers showing them how to use a tool where they could find these things, or I threat model, etc. And I explain all of the things that I want to do that I think will give them better value that I can accomplish in the amount of time they've given me. And then I'm like, does that sound like an okay plan for this pen test? And Then they would say yes, and then I would just do that. And that might sound manipulative, but I felt that I was giving them better value. And if I just come in at the last minute, because I've done that too, where I come in, because that is the orders, right? So once I was an independent pen tester, I could do whatever I wanted. But when I worked for, you know, a place that I won't name because it's inappropriate to name your employers, but the way that they had their system set up is Tanya goes in a week before they go live, smashes stuff and then leaves. Right. And I, I would issue a report, but I'd have no time to write it. Like, you're delegated four hours to write this report. How am I going to write an effective report? To help them figure out things in four hours, they would copy and paste the results from the scanner into this, you know, Word document. And then they can figure it out. That's their problem. But then I'm going to come back in a year and all that stuff's still going to be wrong because they won't know how to fix it. Because when I was a developer, I didn't know how to fix the stuff that I got in my reports. And I'd sit there using my favorite search engine feeling like, how do I not know this? So the documentation is a lot better on the Internet now, especially because of the OAuth project called the Cheat Sheets. I'm a huge fan of the Cheat Sheets. I have my own OWASP project, but it's my second favorite project because the Cheat Sheets is my first favorite project. That's how strongly I feel about them. So whenever, you know, if you are a pen tester, you can just link to the Cheat sheets and it's very, very thorough explanation. So that's an awesome improvement in our industry since I was a pen tester. But, yeah, I just feel like not every place is able to have an entire AppSec program and that's okay. But a good place to start is creating a policy and having a secure coding guideline and just giving the developers a scanning tool and a brief lesson on how to use it and a safe place to do it and telling them to just scan their stuff before it gets to the security team. That was my first AppSec program that I developed because we had literally less than $0 to run it and I had four months to develop it. So I just taught all the developers how to use Zap, because Zap is free, and gave them a safe environment to do it in and said, I made a matrix. If you find these things, if your app is public, you must fix all of them. If you find those things and the app is internal, you only have to fix this part, et cetera. And then I just went around and helped them be able to do those things. And it brought all of our legacy, our older applications up to brand new security posture that they previously had not had. And we could have hired a pen tester and potentially tested two of our apps for that amount of money, but we had like 50, right. And so rather than, you know, really, really concentrating on just two, we brought all of them up to a certain just like not awful level because it was not good because no one had ever looked at that before.

So you did mention you were very satisfied in creating documents and policies that make software more secure. I get a sense for that when I go to your website shehackspurple. You actually have some free resources there. One of them is tips for getting into infosec. We don't have time to go over it, so I highly recommend people check it out. Shehack maxpurple.dev But I guess what I was struck by and for some reason when I talk security with people, they think it's niche. But one of the first things you mentioned was there's like millions of jobs openings, but they don't have qualified people enough to fulfill these positions. What do you have thoughts on that, why that is or is this a good field to be in? Stuff like that?

Absolutely, absolutely. You basically touched my favorite topic. So when I wanted to join security, I had literally the opposite of experience as every other person I've spoken to. So I already had 17 years as dev, right. And I'd actually briefly run a top secret environment for a year of the 17 years. So I had a lot of security knowledge that the average developer wouldn't have, which I can't talk about Anyway. So then I met this hacker and we were friends and he spent a year and a half convincing me to join information Security. So most people don't have like their own essential guide and chaperone and my dev team, I had been running this lunch and learn program and just because I'm really, really extrovert and social, I just happened to know experts all over the city that would come in and teach us about everything from you know, like SharePoint or how to do like superintest unit testing to if you're going to go on a run at lunch, here's how to get the most value from your run and make sure you don't smell in the rest of your meetings. Or like we had a nutritionist come in. Like we just did all the things, things. Because that amuses me. And so doing that, I had invited hacker after hacker after hacker until I met at least half of them in Ottawa and just become their friend because I, I want to be everyone's friend. This is a thing with me. Anyway, so when I joined I already knew half the people, half of like the well known experts in my field, and they were ridiculously supportive. I joined the OAS chapter and Sharif Kusa, the leader, he's still one of the leaders, but he was the only leader at the time. Almost immediately he let me plan my own meetups, plan my own speakers. He's like the most chill dude ever. He's like, if you want it, if you'll do the work, I'm in, let's do it. You want topics on this? If you can find a speaker.

Yeah.

Like, it's like his favorite word is yes. So I had all of this support and then I got a new professional mentor and he ran BSides and he just announced on the Internet I was going to speak at B sides. I was like, what? And then all these awesome people in the community came together and let me practice my talk on them and helped make sure I was factually correct. Like I had like the dream experience of joining our field. So most people, they do not have that kind of support. Most people don't have. Like, I feel super lucky to have been in Ottawa where it turns out it's such a wonderful community there. And where I live now, it's also a wonderful community, just to be clear. But not every community, it turns out, is like this. And not every person actually has people like drag them into the field. And so what usually happens, from what I'm told, is someone's interested and they want to join and they don't know where to start. So they try taking a bunch of free courses, many of which are not very good. They don't understand what they need to learn. They end up learning and memorizing these very weird, obscure hacks that don't actually help you necessarily be a good pen tester. They don't understand exactly what makes a good pen tester or how you know when you're complete. No one appears to teach how to validate the results in your scanner, which is a thing that none of my mentors were very good at helping me with and is a thing that I I think that we really need to cover, which I'm going to cover because I think it's important. But like, you know, I've run the scan. How do I make sure these results are actually real before I give them to someone? Right? So people, they're trying to join our field, they have no idea what to do. It's not like if you want to become an orthodontist, you go to orthodontist school and then you are an orthodontist, right? And it's like a very clear career path. And an infosec is just like this, this like dumpster fire of way too much information. No one knows what they're supposed to do. And then you are like, I think I'm ready. Okay. And I want to get job experience. And then you have no idea where to get job experience. So I was lucky. I was working for the Canadian government and I was leading the dev team for Elections Canada because I was in charge of the big ass dev team. I could be in charge of the pen tests, who to hire, and I could be in charge of fixing and mitigating all the things, and I could be in charge of all the security things. And then eventually the security team let me move over to their team once I'd completed the really big thing that I had to do that they hired me for. And then I ended up running all the security for the election in 2015, which was really cool. It was amazing that they believed in me and gave me that amazing opportunity. I mean, like, they tested me out first, don't get me wrong. But the point is I had so many amazing people that took chances on me. And then when I left that job because they can't hire permanent staff there. So when we had a majority government, so in Canada, we have minority or majority. And majority means, means the people that are prime minister have more than 50% of all the seats, which means an election for sure will not be called for four years. So they let us all go, which is what they do every time. And so my next job, my mentor actually, he was interviewing for a job and he told them they had to hire me or he wasn't coming, which is like really amazing. Right? So most people don't have essentially the absolute best experience ever, which is what I had. And so they don't have this person advocating for them. So that's why I started Cyber Mentoring Monday. So we were called Mentoring Monday. But around three months ago, some sort of social media company realized how, our marketing company realized how popular it was and stole our hashtag and flooded us out with an automated tool, which is really sad. Yeah. But that's okay because now we're Cyber Mentoring Monday and we are as strong as ever. And now you don't have to wade through other people using the hashtag because no one's actually interested in using Cyber Mentoring Monday, which is great. Except us. Awesome. So then I've been pairing people with professional mentors for over a year now, which has been going really well. All these amazing humans from the information security industry have been, like, essentially reaching a hand down and lifting people up. I've heard wonderful, wonderful stories. This man came up to me at a conference and he said, I need to thank you. I participated in Mentoring Monday and I started mentoring this woman that was just graduating computer science, and now it has been eight months, and we just hired her full time. And I don't know how to explain to you how hard it is to hire an AppSec engineer, but, like, it is. It's impossible. And it's amazing because I got to hire essentially a person who I already sort of trained. And she's so happy, and I'm so happy. And, like, she's such a positive. Like, he just went on and on about how amazing she was, and he's like, and we wouldn't have met if it wasn't for Cyber Mentoring Monday. And I was just like, this is so magical. I have all the butterflies. Like, that's awesome.

You know?

Yeah. And then now him and I are buds because I can't help but make friends.

So that was, like, kind of one of my first attempts at trying to get more people into our field. So I've published a bunch of stuff for free. So I published this 21 long post, different series, and it's for free of how to do AppSec. It's got a secure coding guideline which is quite basic. The idea is that you take that and you could apply it at any workplace, and then you add on top of it the specifics for your business, security requirements for any web app app, and secure design concepts that you must apply to any piece of software. And then more like how to threat model and all of these things. And so then I started writing a book which is like all of my AppSec knowledge into a book. And it's like a textbook, but with cute stories, because that's how I teach and that's how I understand. And so it's called Alice and Bob Learn Application Security. And so there's all these stories of the two characters and how Security policies affect their real lives and how they get their jobs done and how they manage their health. And so when my previous startup company failed, so I had tweeted out like, I don't know what to do next. Like, I really want to scale my efforts in a way where I can help as many people as possible. And just person after person after person said, I don't know how to get into this field. I want you to teach me everything in your brain. How can you do that? And so I was going to give training in person at various companies, but I realized that doesn't scale very well. And so I'm making all of these things into courses on exactly how to do the job job, that is application security and exactly how to be a DevSecOps engineer. Like what I would do at work, what my friends do at work. And then I'm hoping if I can make enough money. My plan is to like, once I have a complete program, if you finish the program, to try to get people job placements. Because the two biggest things are one, people don't know what to learn and how to become competent. And then the second biggest problem is they can't get that first, first spot. Honestly, this wasn't my idea. I was at a job fair in Victoria, where I live, and this guy was saying, you know, that my new company was really, really cool. And he's like, can you take my number? And your first graduate, I want to hire them. And I'm not kidding, don't forget me because the very first person you graduate, I want to hire them because I need someone made in your image. Which is very flattering and good for my ego. But he's like, I need someone who, who knows what they're doing. And it's so hard for me to be able to tell them. They have these silly certificates like, oh, I did my oscp. And it's like, I don't want you doing anything that you learned as part of your OSCP to my network because it's like so destructive. And I get that it's like super cool to smash all the things and learn about really hardcore in depth hacking. That's super cool. But that is not what you generally do as a pen tester. You don't generally get to do half of that. And companies, most of them don't even really want a network penetration test. What they actually want is a security assessment of their network and guidance on how to harden their entire network as a whole as opposed to, you know, just how do I harden my sharepoint server or how do I harden my, I don't know, my Juniper servers. Right. What they really want to know is like, okay, so what level are we at and how can we up that level? And like, are there any serious holes and how do we fix those holes as soon as possible? That's what people really want to know. And so he's just like, yeah, the moment you have someone, you're first graduating class, like, I want to meet all of them and hire as many of them as I can afford to hire. And I was just like, oh, wow, that's so cool. All these people are telling me like, I'm signing up for your thing because I want a job. Or even a few of them actually told me, I just got put on the I am the AppSec team. I just got assigned this. I'm a network engineer or I'm a software developer. I have no idea where to start. So I am signing up for your content now. Please help. Right. So I want to make it so people know exactly what to do. And so all the stuff that I teach with my coaching, all of that is helping me cement exactly what needs to be in the courses, if that makes sense.

Yep.

Yeah. So basically I am going to try as hard as I can to help solve this problem and bridge in a bunch of junior starter level AppSec and DevSecOps engineers and hopefully cloud security engineers too, if I can figure out how to afford to make Azure training. Because it's like, I love Azure but they don't have like a really simple lab environment that I can use to teach. And so then I have people making free trials, but then the free trial runs out and I don't want it to be. My thing with Shax purple.dev is I'm trying really, really hard to make it so a person can afford it.

Nice. Right?

Like, I've never been able to afford to go to Sans. Even when I worked at Microsoft, my boss like, laughed at me and he's like, yeah, I'm not, not sending you to Sans, so when you're done dreaming, please give me a plan.

And so like, do I want to go? Yes. If it was free, would I be there every day of the week? Yes. But I mean, with so like the American dollar versus the Canadian dollar, when I was in the government, I'm like, this would be 15% of my entire income for the year. Like, are you kidding? Right? Like, and we pay, you know, like 40 to 53% tax. Right. And then the amount that we have left, I'm like, I'm going to give you that percentage. Are you kidding? Like, I, I need groceries. And so I want to make something that people can like actually do and then actually go off and do this job because I'm doing it online. Then I'm hoping that it will scale because I can't go and train every single company, like 10 people or 20 people at a time. At Microsoft, they taught me so much, but the main thing that they kept just drilling into me is how can we scale? How can we scale, Tanya? How can we scale you? So that's why I wanted to write the book. And they, they just kept going on about like, Tanya, you can't have a one on one email with every person that emails you and asks you how to get into information security. Write a blog post about it, right? And they just went on and on and like gave me all these awesome strategies for scaling. And then when I quit, they're like, why are you quitting? I'm like, because I'm gonna scale.

Oh my gosh. They were so understanding and really, really supportive.

Awesome. So you talked about cyber mentoring Monday that helps diversity and get people into security. But also I believe you have wosec. What's that all about?

WOSEC stands for Women of Security. And we chose that acronym because our previous acronym was too much like another woman's group. And then everyone was confused and we wanted to make sure no one confused us. Slash, we don't annoy other organizations, but basically WOSEC is the space between all the other women's orgs. I've been to a lot of other women's organizations events and they're very formal and they're very professional and quite often there's a steep membership fee. So WO sec, basically, my friend Donna and I started having a brunch once a month and we just invited all of the women we knew to come and we made a meetup and said, if you want to meet other women that work in security and make friends, I just knew Donna, Nancy and kids Katie, and I am the world's biggest extrovert. So if I only knew three and I grew up there, that's not very many. And I said, you know, I'd really like to know more. And 22 women showed up for the first lunch. We were so loud, giggling and laughing and having so much fun the next month. And from then on they gave us a private room. And it just grew and grew. And then we started doing women only learning circles. And a lot of men have asked me like, why can't they just all come to the men's CTF or the men's this or the men's that? And I'm like, because when a man enters the room, a lot of them just get really quiet or they just don't show up. So then we started crashing what we would call like we crashed events essentially. So crashing means we still buy a ticket, we still obey the code of conduct, we still rsvp and we actually also have our own code that is even more strict that we enforce when we crash events so that we're always a pleasure for whoever is hosting the event. And the idea is, is that we grow as a, a group so that no one's alone, no one is the only woman there. You have this group of buddies and there's usually a WOSEC leader there. So if something happens and you don't feel comfortable going to the host, you can come to us and we'll go to the host with you. And the idea is we want to make women feel safe. And so we've crashed RSA DEFCON, like 10 different B sides. We crashed AppSec Day in Australia. We just had a coffee like an hour before, you know, like 15 women show up. It doesn't sound like that many, but then all those women knew each other for the rest of the event and then they all reported who did the survey, that they enjoyed it a lot more because they had, you know, like a new friend to go to, all the things with. And a lot of men don't understand because they're the majority. Just like I'm a white person and when I go into a place and it's like all white people, I don't understand what it's like to not be a white person and have other people just notice you way too much. So like I went to a Python meetup years ago and unban unknowns to me as the only woman who had ever attended and there were 80 men and they're drinking and I remember thinking, was this a really bad plan? Like, am I unsafe? And I am a very confident person and I am a big person. I don't mean that like in a self insulting way. I mean I'm 5 foot 9, I'm 170 pounds, I lift weights, I am much bigger than the average woman. And so if I felt intimidated, how do my friends that are 5 foot 1 that weigh 98 pounds feel right? Like the ones that I could pick up with one of my arms if I wanted to, how intimidated is she? And so, but When I go, like I went. So the first crash that I did was a capture the flag contest. And a bunch of us wore cute party dresses and we made our own team and we did little happy dances when we got flags and ran around and gave each other hugs and just like had this great super fun, essentially like girl party. And I remember other people being like, I wish I was at that table and. But none of us felt weird at all. Like the way that I did feel weird when I would go to things by myself. And all these women told me I wouldn't have had the guts to go if you hadn't invited. And so by inviting more and more women to participate in more and more things, then essentially like, first of all, I've made hundreds of cool, kick ass friends. If I had known Joe so long ago, I could just start a meetup like this and then make hundreds of cool friends, I would have done that this way sooner.

How does someone get involved though? Is it a website or.

Yeah, so we, because we're new, we're only a year and a half old, but we have 31 chapters around the world.

Wow.

We do not have a website yet. We all have meetup accounts. So there's 32 different meetups. You could check in your city or you could use your favorite search engine and just look up wosac. So W O S E C and then the name of your city. And if we have one, like the meetup will be the first thing that pops up. And if not, you can start one. It's usually free. Like usually we figure out a way to pay for it. We're just actually becoming a non profit, I think. And this pandemic could not have come at a worse time because we're about to like file paperwork with the courts to become official nonprofit and all of that. But basically our plan is to make it free for everyone, including leaders. So we can just open the meetup for you. Like basically you just go to a meetup, any one of them you want. There's no membership. Just if you're a woman or you identify at all as being a woman, you just show up and you're welcome and you just make new friends or learn the thing they're learning or go to like, you know, meet up ahead of time of the event that everyone else is crashing so that you know the group that you're with and you feel included and you feel safer. And I know that I, I've had a lot of men object. They're like, it's not unsafe to attend our meetups. And I'm like, you know that, but they don't know that. And it's about feeling safe. It's about feeling included. Right. Like, diversity and inclusion isn't about adding a white woman to a panel. It's about making everyone feel valued and wanted and invited and welcome. Right? And so whatever the thing is that you need to do so that everyone feels good, that's the right thing. And so sometimes I will give up my places on various panels and ask them to have someone else or, you know, if I can't speak somewhere, I'll give them this huge list of other people that are minorities that should speak, speak. And they're like, why are you doing this? Because even if I'm not there, it matters to me.

Oh, let me tell you, you actually, this is true. For my first Secure Guild conference online, you said you couldn't do it, but you gave me a list of awesome speakers, and I got like three or four speakers out of that. Just awesome. And really did help. It wasn't just because they were women. It just helped the diversity of the whole program. It was really a pleasure for you to do that. So thank you for that. So.

Pleasure.

Yeah, that was awesome.

I'm one of those firm believers that. That there's always more, if that makes sense. Some people are like, well, aren't you worried you'll help this woman? Then she'll be more famous than you, or she'll take your spot. There's more spots. There's always more when there's more of us. And so if I grab someone's hand and bring them up, I don't believe I'm going lower. And WO SEC has been an opportunity to scale that at this huge level. So now we have leaders all over the planet, and they're doing that in their cities. And now that this pandemic has had. Has hit. It sounds weird, but we had been considering doing virtual meetups so we could reach all the women in cities and remote places where they can't attend. And so one very small positive from this pandemic is that it has pushed us to start having events online so that everyone can attend. So, for instance, if a woman is on paternity leave and she's like, yo, I have a baby. I feel we're bringing the baby me. It's like, that's cool. Attend from home. Here's how. Right? And, like, she can have her infant with her and it's not interrupting anyone, and it's totally fine. Or for instance, in India, it's not always okay for wives to leave the home at certain hours or they're just not allowed sometimes. And so having events that are remote means that all of them can attend as well. Right. And it's allowing us to be even more inclusive. And it just kind of gave us that push like, well, we still have to have meetups. Like we can't not see all of our friends.

Right, Right. Awesome.

It's turned out to have one small part positive effect.

Absolutely. Okay, Tyna, before we go, is there one piece of actual advice you can give someone to help them with their security testing efforts? And what's the best way to find or contact you?

Okay, so the first thing if you want to create more secure code is to just Every time you don't know how to do something, you search on the Internet for the most secure way to do it. So if you are a pen tester and you are testing something and you don't know how to test something, go to the cheat sheet because it'll tell you how to test and find everything thing. And if you are a developer or if you are an operations or DevOps person, when you pick that thing at the top of stack overflow, that is the least secure way to do anything. It's almost guaranteed, unfortunately. So what you want to do is search for the most secure way to do X. So if you're forgetting how to connect to this database or your company just switched from one type of database to another type of database and you need to connect to it, look up the most secure way to connect to it and your code quality will go way up. And how to reach me, go to shehax purple.dev I am there. There's lots and lots of free content. Or see me on Twitter Shehacks Purple. You can follow me on LinkedIn now. I'll add more connections and I'm Tanya Janka there. But basically if you look up, she hacks Purple on, you know, dev to Medium, YouTube, Twitch mix, all of those things, that's me and content from my site and hopefully eventually there'll be more. She's as she hacks purple.dev so there's a whole bunch of topics. Thank you so much for having me on the show again, Jo, you're so such a pleasure.

Thank you, Tanya, for your security testing awesomeness. For links to everything of value we covered in this episode. Head on over to testguild.com S17 and while you're there, make sure to click on the try today link under the exclusive sponsor section to learn all about Micro Focus, which is the recognized market leader in application security. So that's it for this episode of the Test Guild Security Testing Podcast. I'm Joe and my mission is to help you succeed creating full stack end to end testing awesomeness. As always, test everything and keep to good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to test guild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.