Switching from QE to Product Security with Dwayne Thomas

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be speaking with Duane Thomas all about switching from QE to Product security. As I mentioned before, I feel security is a large, hot growing area for people for people to check out if they're looking to change careers, especially if they have a testing background or QA background. The security security testing is a perfect.

Fit for those type of skills.

So Duane actually made this transition from QE to product security recently. And so this is a conversation we had at last year's Secure Guild online conference dedicated 100% to security testing. And this was taken from our live Q and A we have with each speaker where we take questions from the guild and we ask the questions to the different speakers. And this is Dwayne's session. It was so good. I just wanted to give you a quick glimpse of you get when you do join the Secure Guild, which I plan on having once again this year, this time in October. So to check out Secure Guild, all you need to do is head over to GuildConferences.com and click on the Secure Guild 2020 link. So if you're looking to make the switch from one career to another into security testing or security field, or you're just looking for some quick tips on how you can make any sort of transition to learn better a new skill that can help you with your career, you don't want to miss this episode. Check it out.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey Dwayne, welcome to the Guild.

Hi Jeff, thanks for having me.

It's awesome to have you. I think it's a great topic. I was seeing something on labor statistics gives out, you know, areas of jobs with the highest growth and security was one of them. I just curious to know I don't know if you mention it, why, why did you decide to go into security? I know you were in QA for eight years, but why all of a sudden security? Was it money? Was it just a passion of yours?

Oh, for security. I found chasing bugs that were most critical was what I wanted to do. So really it was a matter of going after critical bugs. You know, secondly, there's the opportunity to learn, really. Like I said, CISP was one thing I could do, but there's so much learning to happen. There was a heartbleed bug. Probably everyone has a story of when that happened, when they were working for me, that when that happened in 2014, I was working and there was, you know, discussion about a bug happening and I was like, how can I help? And it, you know, I realized I couldn't, that the ops team was in charge of updating the servers there and, you know, I want to help with the most critical bugs if, you know, if it at all possible. Those two reasons, critical bugs and the chance to learn.

So, Dwayne, since you were new to security, are there any courses or certifications you found really helpful in order to make this transition from a QA over to security?

Really, there are quite a few out there. We can help you do some research. But the best I've heard, I've only gotten this one personally, but the best that I've heard is that do the one that's the cheapest for you right now. That gives you a leg up because there is a cost associated with some of these. And so, you know, you do want to factor that in. You do want the length of time, the financial costs as well. And it all helps depending on where you're starting from and where you're needing to go, you know, so that's really. I considered the OSCP penetration testing certificate heavily as well as something to pursue. And I was pretty geared up to do that. There's a chance to do some training on our own over I think a month timeline. So I think that could be a great one, especially for someone not coming from a QE background or, or even still just to practice.

Penetration testing, bug bounty programs. I do think we should dabble in those even as testers, to understand the industry practice there. I wouldn't focus extensively on that, but those might be quicker to obtain actually coming from a testing background. So yeah, really you'd have to do the, a lot of the analysis and decide what you want to pursue.

Dwayne, the interesting thing about certification is within the tested community, it's still not frowned on. But there's always this debate, ah, it's meaningless, doesn't matter. Do you find that different in security? Like do companies really hold up certification at a high level? It gives you a leg up if you have certifications.

That's a good point, Joe. Certificates do help. It is a filter that a lot of HR folk use when looking for security personnel. I would suggest testers don't list those certificates as in progress. I know that'll get by the feature.

I don't get by the filters as well. But even for myself in qaing I, I started to go after a certificate and I realized I got all the knowledge instead and so I didn't need the certificate. And I totally agree with you Joe. It's. And it's not as welcome in this testing field, in the quality engineering field, but in the security field, when we're dealing with government organizations especially those are mandatory. You need their certificates and they'll spell out which specifically they need. But as you know, they'll slip as well. So they might not be up to date. Even if you've had them, you have them in the past.

Hopefully your company will pay for it eventually. And that'll be the thing. Right, because we don't want everyone to spend so much money just to get into the field.

Absolutely.

So Dwayne, we have another question. I'm really excited about all these questions now. Next one is what was the hardest thing that you had to learn in regards to security?

Okay, hardest thing in the job. Now I'm not a lot more customer facing. I'm looking at contracts but as well looking at vulnerabilities and being able to communicate that quickly to a customer. There's a case with logging, leaking information, disclosure and really being upfront about that right away with the customer and saying that we do have a timeline to remediate those later. So those, it's a combination really of the hard and the soft skills. I think that'll be the true value for our field when we can combine those. Yeah, so that, that's been, you know, because they, they will freak out if you don't right away. You're not saying, you know, and then customer contracts are on the line. If you're not saying that you're fixing it, you're attempting to remediate it, that you understand the issue fully. That's a logging issue, how it was created, you know, that it's not cross site scripting attempt, you know, so doing those things quickly for the customer I think is great. You know, even though we have defense and depth like carbon black, I do want to avoid a long winded answer. Often with customers just get really to the point. So that's really a tricky part, showing the technical understanding and then that you're meeting the customer concern.

We have a few more questions from Andrew.

Thank you, Andrew.

Let's get to them. First one is, have you ever learned or used the social engineering toolkit? Anything around social engineering, you dabble in.

The toolkit. Now I want to hear from Andrew what that is. I'll have to do it offline. But you know, I consider for advancing in this position that there was social engineering as much as I had to have conversations with people that knew the right information, with managers that maybe had previous experience as security architects themselves. So that, that's the social engineering that I applied on my job, you know, and so that's a loose response. And he wasn't doing security testing against humans. I would need waivers for some of that. Yeah, I'm sure that, yeah, that'll be useful. I haven't found the right case for it as far as practical hands on for security servers and whatnot. But definitely in my own approach to career development, talking to the right people about the right things, that's a super useful trait.

So this is what I love about the guild. I get to learn as well. So I never heard of the social engineering toolkit either. When I go to GitHub, it says the social engineering toolkit repository from Trust Set.

Pretty cool.

This is a great question. Do you have any big wins, early wins during your transition that reinforce the decision to focus in on security rather than going, oh my gosh, what have I done?

Well, that's a big one. There's, yeah, that definitely. Small wins early, where you can get them are terrific. One of the things that started for us in the conference software space was that we started encrypting databases for customers. Now that actually previously led to a vulnerability for one of our competitors and the chance to do that with our development team for them to really, you know, hand off what they were working on and the reasons why this would be beneficial to our customers. And that went through the process pretty quickly. They considered it technical debt. So if you can get anything accomplished by existing mechanisms, then absolutely, I think that's a good way to do it. And you get buy in from other folks that know that you can do these wins. That's really going to create momentum instead of a giant project. You know, there was a thought of doing a bug, an internal bounty for Our team on APIs and that was such a heavy lift and I knew that I didn't want to rush into that too quickly and I was getting advised on that from engineering leaders actually to do that and to meet that need, but just taking one swing like a home run swing. I don't advise that that's what the API bug bounty, internal bug bounty program would have possibly done for us. But as well the chance to share about cross site scripting and seeing developers do that in their documentation. Say I avoided these, you know, these risks right away upfront or even mitigated them. So those were early wins with developers. So really starting with the core people that you're working on, getting their trust early and then having that mushroom, I think that was some of the content for the presentation before Adiron. So I do appreciate that question and I'm glad you get the chance to tie that in how to work with developers and the teams you're closest to.

Dwayne, another thing you mentioned was people were telling you you had to become a pen tester and you said there you want to focus on things that had a higher impacts, highest impacts or bigger impacts and pen testing. But I don't necessarily know that you've. You said what that was like. What areas do you think have bigger impact than pen testing?

Right. Yeah. So when I say strategy, you know, one of the things could be training, developer training. Right. You know, I want to get courses in front of developers and for SQL injection that that could be. Now these are just best practices if we're not doing best practices in the first place. And penetration testing are telling us that we should parameterize inputs. You know, if they're pointing that out, then, you know, I think we're spending more than we need to to reach a better place. Right. So as far as getting trainings before developers, application security training, that's one thing that I started on and we'll be launching soon and my at Carbon Black otherwise threat modeling, we had a chance to start on that and engineers at Carbon Black or Gung Ho for that as well. We're not a big team for security for supporting that, but I just consult here and there with threat models really we want to earlier in the software development life cycle is the idea. Any changes we can make sooner, I think pay a lot of dividends later.

Dwayne, we have another question from Pradhu. They want to know what are the challenges you face while transitioning from QA to security and how did you overcome those challenges? Any examples from your Experience.

Yeah, I'll be honest, I allude to it in a presentation a little bit with the stubborn slide, the meal really for us, my previous company, you know, we were starting to be focused on security a little bit more in the, in the proactive aspect of it. And then the market really demanded that we change our app and where our app was stored. And so we almost pretty typical for software, I had to pivot priorities. And then we were focused then more on UI accommodations for customers. So in doing that and trying to do both, focus on the both two top things, right, you know, every project management experience, you know that that comes to mind. So just being enough focused on both and then there could be people within your organization who could see the security as a distraction and it's, you know, if something falls through the crack somewhere they could say, oh, but what about the testing that, you know, the main thing that we, they hired you for really. And so always having advocates and you know, being clear, transparent with your managers, your team about why you're doing when you're doing it, how much you're doing it right, that you're limiting it, you know, time boxing to maybe 2 points of 0. Work on your Sprint, if that's how you count effort. You know, being super transparent about those things and getting those within timelines that are all reasonable, getting developers to approach you more than going out to see them, I find that it's pretty effective. For example, on the threat modeling, I'm not, I don't have a lot of cycles to go out to every team and make myself a resource. So having developers come to you, having done some of that analysis themselves really pays off a lot. And then you just say, okay, maybe let's invite a couple other people to your threat modeling session. Let's have it a little bit lighter weight so that we're not taking the full scope of the product. So those are the kinds of guidances that I want to give our developers. Always not, you know, not needing to do it all myself because if we go down that path, really we're not going to be able to do everything. That's the biggest challenge really. A lot of it's project management, I want to say a lot of it's project management and sharing out those responsibilities where you can and making it transparent.

It actually sounds like a lot of communication. And communication, it sounds like you got substrating from Toastmasters. So Andrew has a question and then I want to dive into it a little bit more, wants to know what levels have you completed with Toastmasters oh, okay.

They. Toastmasters just switched the. Right now they're, they're doing a road map path and you know, I suggest starting on that. It's actually not very clear which path that they want you to end up with. But yeah, so time I actually went. Our Toastmasters met weekly and I think consistency about our practices pay off a lot. You know, I, Yeah, I don't have a. To be frank, I don't have a specific path. They just changed their paths recently, but I, I think just showing up weekly. Portland actually has dozens of Toastmasters. For a small city, I'm sure we have a lot more almost compared to the amount of breweries that we have here.

Wow.

Being regular about your practice is going to pay off tremendously.

From Toastmasters, what have you learned the most about that to actually help you with customer interactions and developer interaction. Any techniques like get in their heads that they don't even know about?

Yeah, a lot of my interactions with customers are digital. Right. And so when I'm talking about customers, external customers that I'm interacting with, you know, those. Yeah, Toastmasters isn't super relevant that way because it's meant to be presentation guidance and, you know, public speaking. However, internally, when I'm dealing with internal customers, you know, the legal teams, for example, or else developer managers and SecOps managers. A lot of managers, we really want to be clear about how we come across. I notice when my peers use connecting words a lot, they take away from the weight of the presentation, breathing in between words. We don't do that enough as engineers. We make our content really dry and information packed and a lot of that gets missed. So I'm, I'm often trying to do that and we're all, you know, some of being human and using those connecting words is perfectly normal. So just, you know, cutting myself some slack too in some of those calls and some of those presentations. Yeah, that's really what's paid off for me with internal customers, mainly just being clear what I get across, getting the point out early, summarizing where I can. Because as technical people, it's really easy for us to have a call, a presentation and have that not be clear what the result was and what the action items are for later.

It sounds like you're someone that's always learning. Is there anything new in security that you're excited about that you think people should jump on now that you're learning or trying to get more involved with?

Thanks for that one. We're doing a meetup here on Cryptocurrency and the blockchain. So I, I really want to have us be more analytical about the benefits of that. You know, there people seem to be making a lot of money in it. There are also a lot of security questions and so I'm looking a little bit more closely at that. I do have startup friends asking questions about cryptocurrency and I just asked them, why don't you use other pay mechanisms? So yeah, that's, that's really something that I want to have a good handle on. You know, as someone in the security field, I think it takes some work. I'll let you know. Maybe I'll post. I'll definitely post the blog. My company will have a blog about that, so you could definitely follow up there. Covering black.com, the blog.

Awesome.

Yeah, I know a lot of people are talking about AI machine learning within testing and someone brought it up within the security space. Is that an area you see as maybe helping developers with the more low level things that they may get stuck in the weeds with that can maybe help bubble up things easier and quicker?

Absolutely. For logging, AI would be one way to really kick us on the chair and let us know when we need to act. I'm sure we all get flooded with logs. I'm looking at our AWS logs and I counted hundreds of them for containers. We need logging for containers as well in individual components. So if we can, yeah, we can develop smarter logs. And yeah, I totally see those as wins and not immediate for me that I'll be pursuing, but I'm curious if we have other folks presenting on that as well.

So when are there common security issues you see over and over again that.

You think people should be more aware of? Like someone brought up the point about clear text passwords with their customers and third party systems. Do you see any of that and.

How do you handle it for cleartext? We've probably been in that place before as a company or as an industry.

That'S on the OWASP list. I'm sure I am not seeing those personally as a security company. That's one that. I think we're beyond that one. Further though, for us, logging, just doing the right logging. I'll come back to that one. We have a web part of our console. So even though we're not a traditional web application developer, we do have a web aspect and so OWASP is always really relevant. I do recommend folks read the OWASP top 10 guidance. Those will always come up, always be relevant. You're dealing with servers you want to be Secure on the back end and also on the front end and with the UI. Yeah. So SQL injection, the OS top 10, they're really. Yeah, that's really the source of truth and the gospel really, that we're all, you know, I think the more that we can get this in contracts, even so that we're all accepting these and getting beyond these, I think that'll be tremendous because yeah, they're still out there.

Awesome.

Okay, Dwayne, those are all the questions we have before we leave though. Are there any last words of wisdom that you want to leave the guild?

I really before the common theme that I've noticed with Adirondack's presentation before and this one, you know, collaboration goes a pretty far way in security and you know, just getting a little bit of buy in will get you to work on that server, that application that you want. And also you'll get an advocate at the same time, you know, so if you can do that, I think your career will go pretty far a lot quicker. Just a little bit of collaboration at the front end will take you a lot of different places.

Thank you Duane for your security testing awesomeness. The links to everything of value we covered in this episode. Head on over to testguild.coms22. And while you're there, make sure to click on the Try Today link under the exclusive sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in and application security. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.