Look at What I Learnt in Class

The below is my first contribution to The Analogies Project started by Bruce Hallas. When he asked to me contribute I couldn't say no. You can also find it here on the analogies page

One of the best pieces of work experience I've ever had wasn't in IT or information security, in fact, it was Teaching English as a Foreign Language (TEFL) in Spain.

Let me tell you a little story…

Once-upon-a-time I was looking for a bit of a challenge, something different, and something not in the IT field. So I applied for a course that prepared you for becoming a TEFL teacher based in Spain. I passed and was subsequently offered a job with the college based in a small city called Zamora in the North West of Spain.

My job was to create and teach lessons using the course text for juniors, seniors and adults. At first I was a little apprehensive but then I thought to myself this will be easy, I have the text book and I’ll create lessons using the guidance provided on the TEFL course.

What could go wrong?

My first few classes were with the juniors and…well…erm…let’s just say they were no fun!

No one listened, no one paid attention and most importantly no one actually learnt anything.

Why?

I played it wrong. I went in with the attitude that I was the teacher and that I was right. That my lessons were engaging and that they should listen to me.

After a couple of classes and a lot of mockery from the students (I am now well versed in Spanish profanity) I realised that something needed to change. It was me, I needed to change. I had to change the way I was doing things in order for me to get any results. So what did I do? Well…

• I took salient points from the text book and then I ditched it.

• I began to chat with the students during the breaks asking them about

• their likes/dislikes, hobbies, favourite sports etc.

• I played football with the guys and talked about fashion with the girls

• I moved the class room desks around so that the atmosphere was less formal

• I had competitions e.g. guy vs girls

All of the above changed the dynamics of the class and after a few lessons they warmed to me. They listened to what I had to say, began to interact in class, made suggestions on future lessons and even began to ask if we could go over certain topics again. From then on I taught in the same manner and style across all the age ranges with the same results – I managed to get them engaged!

Comments like “your lessons are fun”, “you’re the best teacher” and “please don’t leave” were very flattering but all I had done was to take a different perspective and see things from their point-of-view. My job was then to look at the best way to get them on board.

Essentially, I changed my behaviour to change theirs.

The skills and experience I picked up during my time in Spain I now use in information security. As professionals in this field we need to take the time to understand people, notice the different personalities and the overall picture of the environment, in essence – the organisational culture.

I have an air conditioned room with leather seats...

Who was I kidding the Tube strike wasn't going to be cancelled! I woke up grumbling like Muttley and made my way across London town.

Once I'd picked up my pass I headed upstairs and although I'd seen the Council Chamber the day before (aka swag bag pack day) when I walked in on Tuesday I was a bit worried. Such a cool room shouldn't really be bereft of people. With the Lightning Track being an on-the-day event it could have ended badly.

However, the four of us; Anne Wood (@fairycakepixie), Glyn Wintle (@glynwintle) and Diarmaid McManus (@hacors) with lots of wrangling and using the line:

..."you see I have an air conditioned room with leather seats" ...managed to keep the room respectably full. Thanks to Glyn for suggesting that line :)

We had talks from Arron Finnon (@f1nux), Matt Summers (@dive_monkey) and at 2pm we had the Women in Security (@womeninsecurity) panel at which @treyford was kind enough to get involved.

We even had an underground talk, a talk about locking picking and one from Kevin Breen (@kevthehermit) on extracting IOC's from RAT's.

The final talk was given by Paul Batson (@lazysecurity) who still had the energy to get up and deliver a talk, kudos!

At the end of the day (when I actually remembered) the lightning shortbread biccies flew out of my hands! After the clean up we all headed to the MWR after party, where a much needed drink was had by all. Thank you MWR.

Being part of the crew you don't really get to see any of the talks but what you do get is a sense of achievement. That you participated. That you helped to make it happen.

The other part of the event is catching up with people you've met before and actually meeting those you've been conversing with virtually - To those I met for the first time, it was a pleasure :)

Massive thanks to Paul (@lazysecurity) and Thomas (@fvt) for being tireless in making the event a success and to all my fellow crew members.

I'm already looking forward to BSides London 2015!

Bring The Lightning!

Logo by Kev McGuinness (socks84)

It's back!

BSides London is back and this year along with a couple of ex-rookie speakers from 2013 - Anne Wood (@fairycakepixie) and Diarmaid McManus (@hacors) as well as Glyn Wintle (@glynwintle) I'm running the Lightning Track.

What's the Lightning Track you ask? Well it's the unscheduled track - No CfP and no pre-registration. So if you didn't make it through the CfP process, didn't register for the Rookie Track or were just too damn lazy ;) You still have a chance to talk.

Talks can be up to a maximum of 20 minutes and can be about any security or industry relevant topic. This could be projects, personal interests, hacks, ideas or opinion pieces. There are no limitations on the subject matter or content of these talks.

In addition to the lightning talks there will also be Underground Talks. These are intimate lightning talks where people can discuss investigations, findings or things that they may not wish to disclose in a public forum. They will be run in the Lightning Track room. However, access will be controlled and they will follow the Chatham House Rule.

At 14:00 we have a Women in Security (@womeninsecurity) discussion panel. Berta Papp (@bertapapp) will be moderating on individual approaches to professional development for (not just) Women in IT Security. 

The panel line up is:

Raj Patel, UK Operations Security Manager, SocGen

Ioana Tugui, Security Consultant at BAE Systems Applied Intelligence
Ahmed Bengrina, IT Operational Risk & Security Coordinator at SocGen

The Lightning Track is situated in the rather grand Council Chamber and we are lucky to be in there, check out the pics!

So now you know what's happening, where it's happening. How do you get to present? Well when you pick up a swag bag in the morning you'll notice our flyer in there. Fill in the details, tear of the strip and bring it along to the Council Chamber and you'll be added to the list. Simples.

A few of you have said you might be interested. If I don't see your name down to do a talk. I will look for you, I WILL find you and...I..hmm...damn I forgot.

P.S - There will be lightning shaped shortbread biscuits. Made by my own fair hands, they won't be laced with anything. Honest.

Seriously though, as we are an unscheduled track, do come along and take part or else we'll be twiddling our thumbs in a lovely room all on our own.

There's just one more thing....

Bring the lightning!

Information Security Buzz Article

My first article for InformationSecurityBuzz was published in February. I'm planning my next one and will try and get one out every month, hopefully, maybe ;)

Entitled - From Rookie Speaker To Mentor To Track Organiser – My BSides Journey. Check it out here

Goodbye 2013 hello 2014

At the beginning of a New Year I usually set myself some goals, If I reach these goals then I reward myself. If I don't reach them well then no goodies for me. This harks back to when I was a child...discipline ruled. Naturally, I didn't like it at the time but in most things there's always some good that one can extract.

The main goal I had for 2013 was to speak at BSides London on the Rookie Track, achievement unlocked! This led on to me being invited out to Oslo by Kai Roer (@kairoer) to speak at the CSA Annual chapter meeting. More info on these below.

Somewhere along the line I noticed I had been included on Tripwire's Infosec's Rising Stars and Hidden Gems series. God only knows how I ended up on there but flattering nonetheless. Cheers to Anthony Freed (@anthonymfreed) at Tripwire.

To my surprise in December Information Security Buzz contacted me via Twitter and asked if I'd like to write for them, so as of January 2014 I shall be a contributing blogger.

If anyone is actually reading this ramble you're probably thinking "so what's the goal for 2014 Mo"...to that I say ask me ;)


All in all 2013 hasn't been too bad a year, I'm looking forward to 2014!

Thank you to all who gave feedback, mentored and inspired.

Mo.

Good times in Oslo

So most of last week I was in Olso, Norway and without my mittens. Ok I really need to let go of this mitten thing. I don't even own any. I just like the sound of the word...mmmiiittens, hmmm anyway I digress.

I finally met Kai and his business partner Lars who is also a thoroughly nice chap. The evening I landed we all went out for a meal. We talked about security culture and the work The Roer Group is doing around this, specifically the Security Culture Framework.

On the day of my presentation I was speaking after Martin Mckeay who works for Akamai as a Security Evangelist. I've been following his blog and pod casts for a number of years now so I was a little nervous. However, when my time came I felt at ease and I was good to go.

After my BSides talk I knew I could flesh that presentation out for another audience and still make it something that people would be able to relate to and hopefully take something away from. I managed to get through the thirty minutes fairly well and drew a few laughs which is always good as well as answer a couple of questions. Me being me as soon as I sat down I began to think about my delivery, the content and how I could have been better. Kai and Martin gave me some good feedback which I'm very appreciative of.

The evening concluded with a nice meal and awesome company thank you to Akamai for picking up the bill for my meal :)

I saw a little bit of Oslo, made some new friends and managed to survive a thirty minute presentation, I think there's more to come...actually I'm speaking at the OWASP Birmingham Chapter meeting in December...time to practice the brummy accent ;)

Thank you to Kai and Lars for being lovely hosts and to the rest of the people I met over the three days.

I'll be back!

Link to the video here Courtesy of Kai Productions

Off to Oslo!

Although I had planned to submit to a CFP somewhere (namely, to the full track at BSides London for 2014) after my BSides London Rookie Track talk, I hadn't anticipated on getting invited to speak at an event. So I was quite flattered when Kai Roer (@kairoer / roer.com) asked me if I'd like to speak at the Cloud Security Alliance annual chapter meeting in Oslo.

I shall be donning my mittens and flying out in a couple of weeks to do an extended and revised version of my BSides talk.

I'll be talking about my Teaching English as a Foreign Language (TEFL) experience and how I brought this in to InfoSec.

Once I've thawed out I shall post an update here.