UNSECURITY Episode 130: John Strand, Black Hills Information Security, Working Together, Community

### Overview In Episode 130 of the UNSECURITY podcast, hosts Evan Francen and Brad Nigh are joined by John Strand of Black Hills Information Security (BHIS). The discussion focuses on building an open, supportive cybersecurity community, demystifying consulting competition, managing business growth during COVID-19, and breaking down entry barriers into the industry. The conversation also delves into core security realities, including vendor hype around AI/machine learning, asset management, data science detection algorithms, and architectural challenges like egress filtering and emerging cloud complexity.

### Key Topics - **Community and Collaboration over Cutthroat Competition:** Strand and the hosts discuss the fragmentation of infosec into distinct "spheres" (e.g., SANS, DEF CON, ShmooCon, BSides, DerbyCon) and how offensive and defensive communities have increasingly blended. They emphasize that boutique firms must collaborate rather than compete, as the cybersecurity market is vast and mutual support elevates consulting quality across the board. - **Democratizing Cybersecurity Education:** High training costs (such as eight-thousand-dollar certification courses) act as gatekeeping mechanisms for newcomers. Strand details his "pay-what-you-can" training model (hosted via Wild West Hackin' Fest), highlighting how removing financial hurdles and eliminating conventional gatekeeping broadens entry into the field far more effectively than traditional scholarships. - **Vendor Hype vs. Practical Realities:** The speakers critique marketing around artificial intelligence, machine learning, and "zero false-positive" endpoint security tools. They point out that automated tools consistently miss threats (as highlighted during MITRE ATT&CK evaluations) and often fall back on traditional signature-based detection or data feeds like VirusTotal. - **Data Science in Defense:** Machine learning algorithms such as k-means clustering can detect rigid beacon intervals (e.g., in C2 channels), but fail when jitter or system downtime is introduced. Methods like median absolute deviation (referenced in relation to RITA / Real Intelligence Threat Analytics) provide better statistical modeling for jittered beacons. - **Firewalls, Egress Filtering, and the SolarWinds Debate:** Discussing Senate hearings on the SolarWinds Orion supply chain attack, the hosts and Strand evaluate the debate over whether egress firewalls could stop C2 communications. While theoretically effective, practical enforcement is complicated by shared CDNs (like Akamai), domain fronting, internal DNS forwarding, and automated patching needs. - **Rising Complexity and Fundamentals:** Modern environments—including Active Directory, cloud providers (AWS, Azure), containers (Docker, Kubernetes), and public APIs—are exponentially increasing complexity. Both Strand and the hosts argue that security practitioners must master basic fundamentals (TCP/IP, operating systems, asset inventory) instead of chasing advanced concepts before understanding foundational networking.

### Technical Details - **Detection Analytics & Tooling:** Strand mentions developing the open-source tool RITA to analyze Zeek logs for command-and-control (C2) beaconing and DNS tunneling. Statistical dispersion analysis (MAD/median absolute deviation) is highlighted over standard k-means clustering due to adversary jitter. - **Lateral Movement:** The discussion underscores that detecting lateral movement is often far more effective when analyzing Active Directory logs (such as Kerberos authentication and stacked logon analysis) rather than purely inspecting network traffic. - **Basic Controls:** Critical security hygiene—specifically hardware and software asset inventory (referencing the CIS Critical Security Controls and tools like Rumble by HD Moore) alongside directory-based application allowlisting—blocks the vast majority of commodity attacks at low cost.

### Takeaways Security cannot be achieved through the illusion of risk elimination or high-priced commercial silver bullets; it requires rigorous risk management, disciplined asset inventories, and an understanding of core protocols. Moreover, strengthening the industry requires lowering financial barriers to education, rejecting toxic arrogance in hiring and peer interactions, and focusing on foundational skills over buzzwords.