Looking Back

What an interesting year it has been. I wanted to make a post looking back on the wild ride that we called 2022 and look a bit into the future to see where I was heading from a career perspective. For context, here is a tweet from 2021 that contained my goals for 2022. Lets talk about them.

1. PNPT: Did not get this unfortunately. Partly due to bad planning on my part and partly due to starting the exam before going through all the material. I still have a retake but have not had time to invest into it.
2. First two blocks of SANS masters: This got a little weird this year because I ended up having to take some classes out of order. In total though I got 7 SANS certifications (with the 8th coming soon!) so I would say I completed this goal.
3. 12 meaningful blogs: I did not post 12 blogs, however, I did post 7 blogs and 25 roundups which is a LOT of info to post. While I didn’t get 12 blogs out, I still consider this a massive win.
4. OSCP: I have the voucher. I’ve been through the training. I will touch on this more a bit further down, but my year was jam packed with interesting (and time consuming) events. I did not want to force myself to take the OSCP just to add a few letters to my resume.

2022 Accomplishments

2022 was the most busy year of my life by far. It was full of certifications, conferences, education, and even some mistakes here and there.

Masters Degree

This year I started my masters degree and spent a lot of time going through GIAC certifications.

• Certifications/Masters
  • GSEC Certification
  • GCIH Certification
  • GSTRT Certification
  • GCIA Certification
  • GPYC Certification
  • GDSA Certification
  • GCED Certification

Conferences

One of the biggest things I wanted to do this year was attend some security conferences. I attended (In order of most to least favorite):

1. Wild West Hacking Fest Deadwood: This was not only the coolest security conference I have been to, this is one of the coolest trips I have been on. Deadwood was such a unique experience. While there I volunteered to assist in BB King’s Modern Web App Pentesting Class during the first two days, and helped around the actual conference the following two days. Over the course of the week I met some fantastic people. If you get the opportunity to attend Deadwood, I would highly recommend it!
2. Wild West Hacking Fest Way West: Way west was my first “real” security conferences. I was lucky enough to be able to present My Tale Of Two Strands. Way west was also a great conference with lots of great people and talks. It was in San Diego which was a sweet setting but nothing will top Deadwood.
3. Blackhat: My company let me go to blackhat this year. It was… an interesting experience. I am glad that I got to go but I would not go again. Vegas is is gross and it seemed very much like a trade show. I wasn’t in the market to buy anything so it wasn’t super appealing to me.

Technology

I spent a lot of time towards the latter half of 2022 learning about technology. I’ve always been pretty good about staying up to date with the latest technology, but I am especially proud of my latest efforts of spending more time learning about technology rather than certifications. Don’t get me wrong, I still love pursuing a certification but there comes a time where the return on investment of getting another 4 letters on your resume is not nearly as beneficial as understanding a new technology. At the time of writing, the latest technology for me has been Vagrant.

Another highlight of this year was finally finding a way of capturing a list of all the tools/technology/concepts I want to learn. I settled on using notion to build my Learning List that helps me keep track of technology I wish to learn, the depth in which I want to learn it, how long it might take, and how difficult it is. I have only started doing this in the last couple months but it has already been immensely helpful in visualizing and organizing my every-growing list of technology to learn. As of writing, here is my current list.

Homelab

One of my goals for 2022 was to build out my homelab network. I’ve been slowly adding on to this as the year progressed and have the following services up and running.

• Gitea: My version control server. All my code goes here before pushing to github. I now only use github for mostly finished projects. Quick scripts I don’t ever plan on releasing, archived git repos, and other things I don’t want public live in my gitea instance.
• Filebrowser: This is currently part of my backup solution. I had a few requirements for a backup server.
  1. I needed to be able to SSH into it like a normal Linux box and the directory structure needed to be somewhat normal.
  2. I wanted a web GUI front end that allowed me to browse my files with picture previews.
  3. It needed to be simple. I tried a few solutions that were powerful but so unnecessarily complicated.
• Linkding: Linkding is my bookmark manager. I use it for saving all sorts of links. I will admit that I spend much more time adding links to it than reading my saved links…
• Pihole I’ve been using Pihole as my DNS server. Honestly I might move away from this soon. It seems a little complex for my use case but it works well.
• Flame: I’ve been using flame as a dashboard software. I really enjoy the simplicity of it.

In 2023 I want to spend more time working on my homelab. Currently I use it mostly for “core services”, but I want to build out a fancy detection lab.

Tooling

One of my goals for 2022 was to create more tools using python and bash. I had a good understanding of each language, but I realized that I was at the point where I wouldn’t become better at these languages unless I took the time to develop tools. I developed many tools for work but more importantly, I released a bunch of my personal ones on github:

• Smore: This is the theme I made for hugo that I use on this site. I decided to release it on github for others to use. Not really a tool, but I’ll count it.
• SansTerminalIndexer: Probably the most practical piece of software I’ve written. I have used this tool for every SANS certification I have taken. It has been instrumental in allowing me to quickly create indexes for SANS books.
• Autodeploy: I am always setting up new Linux machines. This is a pure bash tool that allows you to keep your configuration files the same across all machines. Very handy!
• GTFOcheck: This is fork of t0thkr1s’s gtfo. My addition allows you to define a list of binaries to check against GTFObins.
• Loveboxer: This is a tool that can be used to grab the WiFi password from an the network if there is a lovebox IOT device attached.
• Ear2Ground: Is a program I made to help keep tabs on job postings from companies you like.

I really love creating tools. I hope to make a lot more in the coming year.

Community

This year was an amazing year for me getting to interact with the security community. I got to meet some amazing people both online and at conferences. Some highlights and notes of interest:

• Got to interact with so many amazing people on Twitter,Mastodon, and even Linkedin.
• As mentioned previously, seeing a ton of people at security conferences was certainly a highlight.
• I posted 7 Blogs
• I posted 25 Roundups
• I posted 10 Videos
• I had countless awesome conversations.

Career

This year was a very interesting year. I got a promotion, and then another promotion that came with the title of Technical Lead which is really awesome and gave me a lot more responsibility. I also learned a ton about way too many things to list here.

Additionally, I started doing 1099 contract work this year. One venture I need to embark on in 2023 is figuring out how to sustainably work what is essentially multiple jobs. Additionally, I will need to figure out how to establish an LLC and streamline some business processes (contracts, NDAs, etc).

I have more interesting news in this realm but I will hold my tongue until the ink dries :).

Looking Forward To 2023

Looking forward into 2023, I already have a long list of things I want to delve into. Some of those things are concrete, such as “obtain X certification”, some are less so, such as “understand X technology better”. Currently these are my goals. I am sure they will change as the year goes on:

Concrete Goals

• I am almost finished with the GXPN certification, but I did not want to take the exam just to get the certification. I should be ready to take it January 2023
• I have an OSCP exam voucher I need to use. I’m holding off on taking the exam for two reasons. The first is I don’t have want to sit for a 24 hour exam, right now it is not worth messing up an entire weekend and throwing me out of my routine to get a certification. I will eventually take it but I am not looking forward to it. The second is I am confident in my ability to pass it, I just want to dedicate some time going through some more boxes. Similar to GXPN, I don’t just want to pass it, I want to come out with knowledge, a toolkit, and a copious amount of notes.
• I also have a CISSP voucher I need to use by February. I am not looking forward to this and I have a lot of concerns with ISC^2 but I should take this just to get it over with.
• I am about to start on the GCPM certification/class for my masters program.
• Finally, I hope to finish by the end of 2023 but we will see what happens once my schedule fills up.

Fluid Goals

• I would really like to get better at tool development. Right now I’ve made probably 10 or so automation tools, I would ideally like to increase that and work on some more complex projects. I have a plan for this but I will hold off on speaking about it until the ink dries :)
• Learning a compiled language has always been on my todo list. I started looking into rust this year but after talking to a lot of people about it, I might go back to learning C.
• Read more. Both professionally an personally, reading has helped me grow in a lot of ways. I’ve found recently that going through a technical textbook can be difficult but you can absorb so much information because it is so deeply concentrated.
• Publish more content. One area in which I would like to do more in is giving back to the community. Not only do I find it incredibly helpful when I am able to find someone’s blog/video/book on a very niche topic I’m looking for, but I also find it personally rewarding as well. This year I hope to publish 8 blogs either exploring new ideas (IE: Research), or crash courses that detail everything I know about X topic (Similar to how I did with vagrant). Additionally, I would really love to create more videos explaining both more advanced topics, as as well as offer some more generic guidance that I wish I had.
• Be more regimented. I’ve noticed I very much ride the wave of excitement. When I get into things I get really into them which is a great recipe for burnout. I hope to be better about not spending 12 hours straight on labs, taking breaks from difficult work, and going on more walks.
• I really want to learn reversing! I know the VERY basics but I want to be able to reverse engineer malware with confidence.
• I want to set up a small fuzzing farm at home. Doesn’t need to be anything fancy, but it would be cool to find some bugs :)

2023 Goals TLDR

• Relentlessly chase cool opportunities
• GXPN
• CISSP
• OSCP
• Finish masters program (!!!)
• Publish 8 Blog posts
• Do more advanced research
• Learn a compiled language (C or rust)
• Do more 1099 contracts
• Take a long vacation

Lessons Learned In 2023

• Advocate for yourself first. Take PTO. Take sick days. Don’t overwork yourself. Defend your calendar at all costs.
• Everyone does their best work on the stuff deemed to be fun or important. You can set yourself apart by also doing your best work on the stuff that is not fun and seems unimportant.
• Learning from certifications is a great path for learning, but they give you the same knowledge as everyone else. Set yourself apart by combining learning from certifications and doing your own learning.
• Going through a technical textbook can be difficult but you can absorb so much information because it is so deeply concentrated.
• Keeping an organized list of technology you want to learn is vital.
• Follower count != wisdom

Have any questions?

Do you have any questions or comments? Feel free to reach out to me on twitter, Mastodon, or Linkedin or email me at: blog(at)grahamhelton.com