Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Tanya Janca on cyber mentorship, “shifting left” and punk rock
Guest:
Tanya Janca
Published:
Updated:
Duration:
38 min
Episode summary
Application security maven Tanya Janca – AKA SheHacksPurple – is an accomplished author, pentester and onetime music festival organizer. But she’s perhaps best known as the founder of We Hack Purple, a community of security professionals dedicated to sharing useful cyber information including coding trainings and coursework. (Dynamic application security testing Bright Security acquired We Hack Purple earlier this year, bringing its own approach to the “shift left” dilemma of moving cybersecurity earlier in the software development cycle.)
Tanya has spent much of her career in cybersecurity and IT empowering others to strengthen their own skills. With We Hack Purple, she built a community from the ground up, and she’s organized plenty of security talks and capture-the-flag tournaments along the way. Computer science can be a nebulous, wide-ranging field – Tanya has further helped people zero in on what they should focus on learning in the wide world of cybersecurity.
Tune into the episode to hear more on:
The story behind Tanya’s bestselling book, “Alice and Bob Learn Application Security”
The qualities that make a good pentester: “You have to be very determined and detail oriented,” as Tanya put it
#cybermentoringmonday and the value of professional mentorship
Make effort the barrier, not money We Hack Purple dropped its $7 monthly fee and instead asks new members to answer a few short questions, keeping the community open to people for whom small fees are a real cost.
Job requirements often exclude real experts Tanya notes that she did not qualify on paper for an AppSec lead role despite writing a best-selling AppSec book, and Bella advises reading what the role does rather than the requirements list.
Mentors open doors you cannot see Professional mentors helped Tanya launch her security career and later flagged acquisition interest in her company. Her weekly Cyber Mentoring Monday hashtag connects people looking for mentors with people willing to help.
Application security is broader than pentesting Pentesting is a deep manual analysis of one application, while AppSec covers everything done to make software safe across the development life cycle.
Shift left with small, early steps Threat model only the new feature, scan only the new code, and set security requirements at the start so the final pentest finds little.
Notable quotes
…why don't we just tell them at the beginning what we want instead of telling them how wrong they are at the end?
If all the jobs say you must have ten years and our industry has only really developed over the past five or six years for AppSec, like it's only gotten big, then who are you looking for?
…application security is all the things that you do to make sure that people are safe using your stuff and that information that they put into it and whatever they're using it for is safe.
I want to put myself out of the job.
Questions this episode answers
What is We Hack Purple?
Tanya describes it as a community where every type of person feels welcome to learn application security at their own level, from developers to career changers. Members can follow weekly drip lessons or jump straight into courses. Read this section
How do you join the We Hack Purple community?
The community started at $7 a month but was made free once enterprise training paid the bills. New members answer a few questions, such as their name and why they want to join, and agree to a detailed code of conduct. Read this section
What is Cyber Mentoring Monday?
Every Monday, Tanya posts with the Cyber Mentoring Monday hashtag on Twitter to help people find professional mentors and to invite experienced people to offer mentorship. Hundreds of people responded the first week and it continued weekly. Read this section
What is the difference between application security and penetration testing?
Tanya defines application security as all the work that keeps software and its users safe. Penetration testing is a person doing intense manual analysis of one application to find and exploit as many vulnerabilities as possible, then reporting them. Read this section
What does shifting left mean in application security?
It means adding security to every step of the SDLC, from requirements and design onward, in small pieces such as threat modeling a single new feature or scanning only newly checked-in code. Tanya prefers telling developers what is needed at the start over telling them what went wrong at the end. Read this section
About the guest
Tanya Janca, also known as SheHacksPurple, is a former software developer and pentester who, at the time of recording, was co-founder and CEO of We Hack Purple Academy, a community and training platform that Bright Security had acquired earlier that year. She is the author of Alice and Bob Learn Application Security and has organized OWASP chapter talks and capture-the-flag contests. Before working in security she was a professional musician in punk rock bands and helped start the Ladyfest music festival.
Attackers scan your systems daily. You just don't get the report. Synack's security testing platform stands out by drawing on a trusted network of global security researchers. From web apps to headless APIs, our platform helps you find and fix gaps in your security posture. Learn more at synack.com. That's synack.com.
Welcome to the show, Tanya. It is... It's really awesome to have you here. Jeremiah and I are both very excited to get to chat with you today. I've actually seen you speak twice, both virtually, at the last two Diana initiatives. And both of your talks were phenomenal, of course. But additionally, like, one thing that I very much remember, in addition to the purple hair that I saw the first time, I very much remember you as, like, probably one of the most enthusiastic and, like, genuinely passionate people that I've ever heard talk about security. So I'm especially excited to talk with you today. I think, obviously, that makes for a great a great podcast conversation. But I wanted to to start by talking about We Hack Purple and just kind of get, can you tell us a little bit about what that is and why you started it?
Basically what I was trying to do with We Hack Purple was make a place where every single type of person felt welcomed. So whether they were someone who'd been a dev for twenty years and they're just curious about making a better app or if someone used to be a nurse and now they are changing careers and they want to become a security professional and they're like, I'm not sure exactly where I fit into this whole cyber thing yet. I wanted to make a place where basically everyone felt comfortable and welcome and that they could just... They could learn at whatever level they're at. So we even have introductory stuff for if you don't know any information security at all. And so when you join the community, everyone like is like, hello, hi. And then there's a bunch of articles kind of to start off and then you can say, oh, well, I know nothing. And you can sign up for like a, we call it drip, like a drip content.
So once a week you get a little lesson to your inbox or you could just jump right in and take a course and just be like, teach me everything now, JEDI's.
Yeah. And we just want, we wanted to make a place where people felt comfortable because when I switched from software development into security, I found sometimes people call it gatekeeping, but it felt like no one wanted to teach me and no one wanted to show me how. And it was like, there are these great amazing secrets, but they're keeping them from me. And I was like, I wanna know everything. I wanna be really good at this. Like Yeah. I I don't know. In software development, it's like, hey. See this cool function I wrote? But in security, it's like, you will never know.
Yeah. That... That's... I think, like, I have, like, a very similar experience when I first... I remember, like, when I first started getting into the security industry, I had so many questions, of course, and, like, this was I was fresh out of college, I was so excited, I had so much energy, I wanted the same kind of experience. I just wanted to know everything. And I like distinctly remember so many people telling me like, oh, there's resources online. You can just find information. And I like distinctly remember thinking like, well, that's great, but like where and how do I pay for them? And like, I think it's really I've been really passionate about finding new or like not even necessarily new, but like finding all of the ways that we can like teach new folks about cybersecurity without asking them to like fork over $5,000 for a certification?
Yeah. When I started... So I'm Canadian, and the Canadian dollar is worth a lot less than the American dollar. And so when I would look at training courses, and we also pay a lot more tax. And so, I pay around half of each paycheck to tax. And so I remember looking at one of the courses, and I was like, this is literally 20 of my my take home for the entire year. Got it. For one class. Yeah.
way I could possibly ever afford this. And I talk... I remember telling my boss and my boss laughing so hard, and he's like holding his belly laughing and laughing and laughing. And he's like, you want $10,000 Canadian dollars so that I could afford, like, a $6,500 course. So you can take one week course. He's like, are you gonna come back and be a ninja? You gonna be able to, like, secure apps with your mind? And I'm like, well, it's actually, like, the first level. And then... And he's just like, oh, he's like, yeah. And our budget was $2,500 a year. And I was like, what if I saved that for four year? And he's just like, you're not allowed doing that. So I would be taking the entire team's budget for you to take one course. He's like, I... Tanya, it's selfish. I can't do that. I'm sorry. And I was like, okay. So then I found a workaround. And I just... I figured out if I give a talk at a conference
Like, I'll be at a conference in person and they'll be like, hey, let's chat. I'm like, come with me. There's a super cool presentation happening. I really, really wanna see it. And like the joke's on all of you. I'm here to learn.
I felt really similarly like I have always loved the idea of conferences. I love the idea of getting to like network with people in industry and learn from like the people that I look up to just like have them in front of me talking to me. That's amazing.
I'm actually kinda curious on... I'd like to go back to the We Hack Purple again, actually, because it's such a cool initiative. I'm looking at the website as we speak, and I see that you can sort of request to join. Who is that for and and who all can participate?
So we used to... When we first started, we charged $7 a month or $70 a year to join, and that created a barrier to entry. But it also helped fund my startup. Because from the first month, basically, I was able to pay all my bills. So then suddenly I had a runway in order to do... Because, like, when you're starting a startup, you don't immediately have income. Right? And so I was really lucky that basically a lot of people that support that really support what I
you $7. No problem. And so before I know it, I could pay my bills. And I was like, okay. This is... I... Like, I don't live an extravagant lifestyle, so it's not that hard. But so I'm like, okay. So now I sort of have this endless runway. But then I started creating courses and I started doing enterprise training. Enterprise training pays really well. And so then I reached out to everyone in the community and I said, okay. So I kind of wanna make the community free because I don't want people for whom... Cause for some people, $7 is a lot. Like in Canada, $7 isn't very much, but in India, it really is. And so I was like, I wanna find a way where the barrier to entry is not financial, but I still wanna have some sort of barrier to entry because I don't want it to be a place where... I want, like, the barrier to entry to be effort. And so the platform that we're on is called Mighty Networks. And so then I reached out within their community and people said the best one is make them answer a few questions and they just have to type.
So basically, you're just like, what is your name and why do you wanna join? And as long as their answer isn't so I can harass others or so I can sell all my products to everyone because advertising is not allowed in the community. And then we have a big long code of conduct about... And it's, like, really, really specific. So it's like, racism... Racism's not allowed and sexism's not allowed. And but we also get a bit more specific like if we have an event, you're still following the code of conduct at the event even if you're not inside the community and if we have an event and then you all go off and do something after, we can't enforce the code of conduct But if we hear about a bunch of you going to a bar after and making a scene and having a bar fight, we're gonna talk with you and the thing isn't to throw people out. The thing is to try to figure out where there's miscommunications and talk about it. And so then we formed this basically big organization of volunteers that helped me moderate everything and everything's going so far really well.
We've twice asked people to take down posts and one of them were like, could you just reword it? Because the way you worded it was a bit making some people uncomfortable. But the other one was like, it's an advertisement for a product. I'm like, we're not allowed to do that here. Like, like, you work somewhere, you're allowed saying like, I work here, we're hiring. That's cool. But you're not allowed being like, our product is the absolute best product, and let's buy this product now. I'm like, okay. So sorry. You can't do that. But if you wanted to give a demo of your product, like, and we could plan an event and then people know it's an event, they decide yes or no. They wanna show up. And so we've had several products demoed. Like, sounds weird, but when you're an AppSec professional, you're expected to advise on buying these products that sometimes cost hundreds of thousands of dollars. And if you've never seen them before, it's really intimidating. And then as soon as you want a copy of it to make your proof of concept, the sales team descends.
Yeah. So we started just inviting people to just give a demo. And I'm like, it's not sales pitch about why your product's the best. It's like, here's the problem, and here's how we have chosen to solve it. This is how it works. And a lot of people have been attending them. And Wow. People told me, like, no one's gonna like that. But we asked the community, do you want this? Do... So basically, like, hold votes a lot and let the community decide, which might sound weird, but I find that that's better.
Like, I think particularly, like, as a, like, woman in cybersecurity, I'm constantly seeing, like, communities geared towards, like, either women or people new to the field or things like that. Like, I feel like in cybersecurity, but also just in tech in general, I feel like there actually is kind of a large push to finding your community. And I guess I'm wondering, why do you think that is?
When I was a software developer, I never joined any software development communities. And I would talk to a lot of devs, but I I I would network, I would say, rather than... Like, I wouldn't go to dev meetups. I wouldn't do any of that because I was like, I'm building code. I keep getting promoted. I assume everything's fine. And and I was also a professional musician for a really long time. And so I would spend lots of time
Drums, guitar, and I sang. That's so cool. So I had five solo albums out, and I was in a bunch of punk rock bands. And I, like, yeah, like, I played the same music festivals of... It's, like, rancid and followed Casual. Stuff like that. And... Yeah. What? Yeah. Yeah. So, like, if you look on Spotify, those are my albums under
and so I would do that, and I'd spend lots of time in those communities. And I, like, help start a music festival for women called Lady Fest. And and I would kind of go in a lot of those circles per community. And then when I was trying to switch to cybersecurity, I was like, well, you can just buy a book on how to learn Python. But there was no book on how to learn AppSec. And there were two or three books on pentesting at the time, and they're all network pentesting and not web app pentesting. And I was like, well, I wanna be really good at this. And I don't know. So I stumbled upon OWASP, the open web application security project. And basically, there are these two local guys, Nadeem and Shrief, running it. And I was like, this is so cool. And so then I asked Shrief, like, can we have a capture the flag contest? He's like, yes. If you take the lead in running it because I organize all the other stuff.
Yeah. So then it will go. I eventually organized four or five of them. Like, every year we had one that got bigger and bigger. And then after a few months, he's like, do you wanna start organizing talks too? Like, are there specific comfort... Like, topics you wanna see or speakers you wanna see? And so I was like, oh my gosh. This is amazing. I can choose what it's gonna be about. And so then he made me one of the leaders. And then I went and I went to the international OWASP event. I got to meet all these other amazing leaders. And I was like, what do you do at your chapter? And like, how's that going? And then I met this woman named Nicole Becher. And it was like friendship at first sight, like at the moment we met. And so she had made this intentionally vulnerable app and I was giving a demo of it at a conference. And, unbeknownst to me, someone had hacked that app... Her website so badly the night before they'd taken it down.
And I'm like, there, and it's not working. Oh. And so I put this email out to all the leaders of OWASP around the planet, like 1,400 people. And I was like, this website's there. Can anyone help me? And then the most famous software developer response of all time an hour later, try now. Yep. And, like, deleted the the date and we've deployed the whole thing and she updated the web server and she's like, try it now. I'm like, yeah, it works. I'm like, gosh, thank you. And then like two months later, I'm in Ireland speaking at my first international conference and I'm tall. I'm like five nine And Nicole's very tiny, woman. And so my friend Tiffany is like, she taps this tiny woman ahead of me on the shoulder, and she's like, hey, Nikki. Remember that that lady that was trying to use your site? This is Tanya.
And we spent the rest of the trip together. Were, like, inseparable. And then she's like, do wanna start an open source project with me? I'm like, you haven't yet? Hello?
you think it like... Think like... I feel like I hear not not exactly the same story. I feel like that's a very unique, very unique path to finding community. But I feel like I hear a lot of like... A lot of my peers have like elements of similar stories of like, you know, wanting to find, like, I guess, like, do you think it comes, a lot of our, like, as an industry, our community seeking, do you think it comes from just like, there isn't another great way to learn from one another? Because I also struggle with finding the right resources. Like I think I have the one comprehensive web pentesting book that exists.
I do feel like it's really hard to figure out what to learn. Like when... So when I made my AppSec Foundations program, it was all the stuff that I had spent five years or six years learning. And I was like, this is my my personal approach to per... Like creating an application security program and then making sure it succeeds. And I had people who are like, I've been doing this fifteen years and I took your course. And I... And like, I don't mean to sound rude, but I was expecting to learn nothing. And then I was like, oh, crap. I never thought of it that way. Or like, oh, that's an excellent idea for this. Or, oh, we could do that if we tried. And and so I feel like it's really hard to figure out where to learn these things. I feel like it's really hard to form a network and find your first job. So when I graduated computer science, I had already had several jobs in computer science.
It's extraordinarily rare that cybersecurity hires interns because of security clearance levels and because they're not sure if they can trust someone to keep their trust shut.
Like like, I've done anti terrorism work. You think we're gonna hire an intern? No. We are not. Yeah. And so there's less opportunities for junior people. And and it's also because for some reason... Or in... Because... So when you study to become an accountant, you graduate, you take the exam, and you're an accountant and know how to do accounting. But if you take a course at this place, that place, and the other place, that doesn't mean you're a good test or doesn't mean you know how to do AppSec. So we don't have a really good way to measure
And a lot of the people who are doing the hiring don't know how to qualify the person that they're hiring. And so they're like, well, you have to have this certification or you have to have ten years experience. And I only... I'm working on my ninth year of security. And so Yeah. I was telling someone today, yeah, when I was in Ottawa, all these guys. So all all the main consultant pentesters were guys. They would all get the contracts, and then they'd subcontract them to me to do because I am a little app sec nerd. And... But they had ten years experience, and I didn't. So I didn't qualify. And so I had someone ask me a few weeks ago and they sent me this job description for their app sec lead. And I'm like, so I wrote the best selling book on app sec for English. It's the only one. And I don't qualify for your job. So who does qualify for the job you posted? If I'm not good enough for that job, I'm like, well, of course, we'd hire you, Tanya.
And I don't know how to say this, but I don't know if I would have the guts to apply for a job that says you absolutely must have ten years. I have... I'm... Like, I'm almost at nine.
Probably still apply, but when... Yeah. But but think about it, though. If all the jobs say you must have ten years and our industry has only really developed over the past five or six years for AppSec, like it's only gotten big, then who are you looking for?
Yeah. One of the, like, big They've got one of the big, like, piece of advice that someone gave to me when I was first getting into this industry that I constantly pass along to other people, which is silly when I say it out loud, bear with me, is when when I read job descriptions, I ignore the requirements. I read everything else, and I focus particularly on the, like, what will you do in this role? Because that's, like, if I if I think I can do that, then great. But I skip over the requirements. I never read them, because either I, like, I've never read a set of requirements that I felt like I met. Ever. And like, I have gotten jobs in this industry. I'm currently working in this industry. I don't think that I met the job requirements, like, on paper of the job that I'm even in now, because they're so frequently written in a way that's, like, not attainable.
Yeah. No. I I actually do the exact same thing. Think, like, there... In this industry, there are whole memes that are created just because of how ridiculous some of the job advertisements are for this career field or field as a whole. You know, twenty plus years of cybersecurity pentesting experience coupled with fifteen years of developer experience. And, oh, by the way, you've gotta be a pilot, and you also have to have done some whaling in the past. And on top of that, if you could also make a pizza from scratch, then that's the bonus. I don't like like the requirements for trying
Yeah. There was a few things that you mentioned that kind of tie into this thing that I saw that you do, which is Cyber Mentoring Monday. I was wondering if you could speak more about that.
Awesome. I'd love to. So every Monday on Twitter, I use this hashtag called Cyber Mentoring Monday to try to help people find professional mentors. And it started because professional mentors are what helped me launch my security career and then helped me launch my company and then helped me get my company acquired. And so I've gotten new professional mentors as I have done new things in my career. And people started writing me and saying, well, will you be my professional mentor? And at first I said, yes. And then I had four people I was mentoring. And I... And that's awesome. But someone else asked and I said, oh, well, then I won't have time for my mentees that I currently have, and then I'll be a crappy mentor. And so then someone else asked and someone else asked. So then I did this post on LinkedIn and I said, listen, this person I know is looking for a professional mentor in this and I want to help, but I don't have time to be their mentor.
Would anyone respond? And all these people started responding. And then a bunch of other people started saying, oh, well, I actually need a mentor too. And it ended up having a thousand comments. I'm surprised we didn't break LinkedIn because their notification system really stinks compared to, like Sounds overwhelming. It's really bad. Yeah. And so then I wanted to figure out a way that I could help people find professional mentors. So with my OWASP chapter, we started a mentoring program and we had like 10 mentors get up and offer to mentor people and then people lined up and we did sort of like speed dating mentoring. So like they had like five or ten minutes with each person and then they decided who they thought would be good And it didn't work very well. Like, would love to tell you how it worked perfectly and everything was great and it was a happy ending, but it was more like some of them connected and some of them just didn't. And that's life. Like one of my mentees fired me.
She was super ticked and she's just like, you don't give me lessons and you don't... She wanted like this formal structure university style. And I was like, I can't provide that for you. And and then eventually she readjusted her things. And then it's funny because now we're good friends, But she was, like, very frustrated because I guess she'd had another professional mentor who had been a professional professor and, like, would create weekly lessons and spend many, many hours per week. And I was like, I can't offer that. And so Wow. Then I I put this post, it and was just mentoring Monday. And I was like, are you looking for a professional mentor? Are you looking for a way to give back to the community? Are you willing to take someone under your wing? And just hundreds and hundreds of people answered the first week. And so I was like, I'm just gonna do this every Monday for... I'm I'm sure after a few months, like, we'll run out of people, but no. Every Monday. So many, many people, if you follow that hashtag, are gonna post every single Monday and just try to help people connect.
me more. I have had a few mentors at like really critical points in my like, education and career, shifting into into this space. And, like, for me, having mentors that helped me get to where I am, I mean, like, just essential for for everything that I've done so far. But, like, I think, like, one of the one of the marks of like a really great mentor is being able to see exactly what you need, right? Like having a professional who knows what they're talking about say to you like, Okay, it's time like you can do this, do it. Like that makes such a huge difference. And I think, like, I I don't know. I I know for me, I won't speak for anyone else, but for me, that has, like, absolutely helped me progress in my career.
Absolutely. And I feel too, like, professional mentors because they have experience in the area you're trying to learn. They'll be able to say things like, this is the book that changed my career, or you need to meet this person, or even just like, a recommendation for something that you might not have thought of. But I've had so many key introductions made. Like, it was one of my professional mentors idea. She's like, someone wants to buy your company. And I had started We Hack Purple, like, maybe two months earlier. And I... She's like, it's just an acquihire. They're just they're just trying to hire you, basically. I'm like, yeah. I haven't built anything yet. Like, I have one course and it... And I filmed it in a weekend. Like, it's not good. I mean, like, the con... The topics were good, but it wasn't it wasn't, like, professional. Right? And she's like, yeah. It's an acquihire. I guess, like, do you want a job with a big pay bonus?
Yeah. And then and then two years later, check-in with me and say, like, you know, someone, someone has a more serious interest than they actually mean at this time. Do you want to meet them? And I was like, woah. And I didn't end up selling my company to them. It ended up being like many companies down the line that we decided where it was like a really good click. Cause you, you're gonna work with these people for several years after and you wanna make what they're doing a success and you have to like make sure you're actually on board and you agree. And like for me, especially, it's like this product bar would be really awesome or I'm not coming. Right? And so like all these things like... And having and having the guts to say no to someone offering you a big hunk of money and stability when you're like, I am in charge of the livelihood for all the people that work at this company and that's pressure. Right? And if someone's like, we'll just like throw a whole bunch of money at you and it's like, well, that is exciting, but that's not what actually is right for me, and that's not what is right for my team.
Our listeners can't see this, but in the background behind you, there is a couple of books that I've been eyeing. And I believe that is the Alice and Bob Learn Application Security. Right? Yes. Absolutely. I was kind of curious about it because we're hearing things like application security all the time. And and is there a big difference between application security and penetration testing together? I'm... I know application security personally is kind of a big deal. And I was just wondering if you could speak more about that and some additional insights that you had in creating that.
Okay. So when I wanted to learn security, I was like, great. I'm just gonna read a book. My library had Kevin Mitnick books. And although it was an interesting and exciting tale that he told, it didn't teach me any security, like the book that they had. And then I read gray hat hacking. I read the Shellcoder's Handbook, etcetera. But there was no book about how to do the job of application security. And so I wanted to create the book that I wished I could have had, if that makes sense. And so application security is the security of software. It's the part of computer science. So computer science is a big nebulous. And then below that a subsection of our industry is cybersecurity and information security. And then a subsection below that is the security of software and how do we ensure that every time we create software and every time we're releasing it, that it's safe for our customers or our citizens or our employees to use.
And so application security is all the things that you do to make sure that people are safe using your stuff and that information that they put into it and whatever they're using it for is safe. And so I wrote that book because that book didn't exist and I really wanted it. And I also wrote it partially because, so I'm dyslexic, I'm learning disabled, that's what it's called. But basically I learn in a different way. I still learn lots of stuff all the time. And so I wanted to create a textbook that wasn't so hard to read. Like when I read textbooks Yes. It's like, oh, I'm gonna fall asleep. This is like so long. And so I wanted to have a book that was full of stories of like my stories, stories of Alice and Bob, things that happened to them. I wanted to have, like, diagrams and pictures, and I wanted to be able to explain things in multiple different ways. Like, one of my technical editors was saying to me, this is the third time that you're explaining what DevOps is, and you're just saying it in a different way.
I don't know why you need to say it three ways. Like you drew a picture, Tanya. Do we really need a picture? I'm like, I'm doing it so that every single different type of learner understands. That's why I'm doing it three different ways because apparently you need to hear a very abstract concept in three different ways in order to completely understand it. And I want people to know that by the end. And I want people to really know, you know, the difference between dynamic or static analysis for instance. And I'm like, and so I'm explaining on different ways and using pictures and all these other things to make sure by the end of the book, people like it. And I've had people tell me, like, I picked it up Friday and I finished reading it Sunday afternoon and it was like a pleasure. And that was, like, a huge goal in writing a book that you could learn the stuff, but it didn't hurt. And I I don't mean that as an insult to other people that write textbooks because they're teaching and that is important.
But I wanted to write a book that would be easier for someone like me to consume. And, like, I struggled with the Shellcoder's Handbook. I struggled with the Web Application Hacker's Handbook. I, like, just struggled through these things where it's It's big. Like, the person that wrote it, brilliant. Oh my gosh. It's like bigger than the Bible. Yeah. It's like three Just
like size alone, even if you can comprehend all of the information like first pass through, it's it's a lot to digest. And that's what like... I I feel like that's what every other resource is. Like, I think, like, when I first learned the phrase application security, it was explained to me as, oh, that's web penetration testing. Like, here's the book on it.
Oh, okay. Let me explain the difference. I forgot Jeremiah, the second half of your question. So penetration testing is a person doing manual intense analysis of one application to try to find every single vulnerability that they possibly can. And then they try to exploit the vulnerabilities to make sure they're real. And then they write a report telling you all about them and like, why you should be afraid, why you should fix them. And then hopefully advice about how to fix them. And so a person that does that job. So I did that job for maybe a year and a half. You have to be very patient. You have to be very determined. You have to be very thorough and detail oriented. And in my case, because I had to do a lot of these tests inside of a data center, you have to be a person that has a toque and mittens and a hat. It got really cold. And as a person as a social butterfly and very extroverted, I started to feel quite lonely doing that job as weird as that might sound.
Because I would code all day, but I'd always be chatting with other devs and and I never ever felt like lonely at work doing development work. But for some reason, like being a pentester, I'm like, I'm literally in this giant data center all by myself the whole weekend.
This is Yeah, and I'm sure none of the devs or folks on the other side want to talk to you because you're the person who's there trying to break everything. Know, I haven't been in security industry for like a terribly long time. But even in my my several years, like I feel like I've seen either not necessarily a shift in the entire industry, but like evidence of a shift because companies that I've worked with that have been around for a long time operate very differently than new companies. And I think a major way that I see that is how they define AppSec, right? And like my first definition of AppSec, which I think is fair to say is wrong, was I learned that because that's what I saw several companies doing as their entire appsec, you know, work is. Here's our thing that we've had live.
Here's our application that's been up on the Internet for ten years. I guess let's check it out like what's going on. Let's do a pentest And it seems like, again, I don't want to say that this is a recent shift, because I think it's a shift that's been happening for a while, but at different companies at different paces. This idea of like, know, the buzzword shift left, moving security further left in the pipeline and like this idea of of DevSecOps, which is another buzzword, but like very real.
When I learned about the idea of shifting left, I was still working in the Canadian government. There's this guy named Damian, and he would watch lots of conference talk talk recordings from his desk when no one was looking. Like, he's like, it's lunchtime. And he could go outside at lunch, but instead he's like, I wanna watch this and I wanna learn. And he was very obsessive about learning and was super encouraging of me learning. And he's like, we just gotta ship this left. I'm like, what are you talking about? And he's like, in the SDLC. And I'm like, do you mean earlier?
we keep doing pentests at the end. Why are we doing that? I'm like, no. I agree. It sucks. When I was a pentester, was like, I kept calling companies and saying, could I just show up two or three months earlier? And could we go over your design? And could we do this? And could we do that? And I remember my boss, the pentesting boss was really ticked off at me. He's like, why are you bothering our clients way before your pen test? I'm like, I'm just gonna run some quick scans and like, they can fix those things. And then when I would get my final report, there would never be highs or criticals because I would have already walked them through fixing all of them and retested them at the end. And my boss was like, you can't find any criticals or highs. I'm like, well, I did, but they fixed them. So it doesn't go in the final report. And so the devs were like, we really like her. We look better when she's around. And I had no idea that that's what I had been doing. And so he's like, yeah, there's this thing. It's called like shifting left or like pushing left. And so then I read about it and then I ended up making a presentation about it called pushing left like a boss because I'm silly.
And and people were like, how how do you do that? How do you start earlier? I'm like, you make the whole SDLC secure. So every single step, there's five steps, whether you're doing DevOps or Agile or whatever, but you still have to gather requirements. You still have the design. And basically you just do a baby small version of whatever the thing is. So you just threat model the new feature instead of the whole app, or you just scan that new part of the code that they checked in, not the entire thing. And I'm like, so every time we do requirements, like we still have to figure out what we're building. And so why can't I add security? Like, I know you're doing serverless. Well, these are things that concern me about serverless. So these are the rules or requirements for serverless. And I'm like, why don't we just tell them at the beginning what we want instead of telling them how wrong they are at the end? I don't want to give an adult a lecture. I want to, like, help them be awesome. Like, I want to not find a lot of stuff in my pentest.
So I just have like one, one kind of close out question for you that we that we have like one final question that we ask all of our guests, so would love to ask you. And it is, what is something that we wouldn't know about you just from looking at your, like, online bio, social media, LinkedIn profile, things like that? And you can get as deep as you'd like on Whatever you're comfortable sharing.
So I started growing things. It sounds weird, but I went through burnout when I was a software developer. And I read in books, like, if you wanna get over burnout, you should get lots of sun. You should try doing grounding exercises where you, like, touch earth, which I thought was ridiculous. Honestly, I was like, that's so dumb. But, apparently, it really works. And you should get exercise. So I was like, well, I'm hyper So I'm gonna do all three at the same time. And I landscaped my little itty bitty tiny property that I had. And I was like, all my stress just... It sounds weird, but my stress just melted away. And so then I was like, well, I'm gonna plant like a little vegetable garden. And I like... So just to be clear, I sucked. My thumb was black. It... Like, everything would die. I I... Someone sent me this meme and it's this lady and she's holding these plants and she's like, so happy with them. And it's like, hi, babies. Do you wanna come home... Back home with me so you can die?
But now I'm actually really good at it, and I, like, plant flowers and I gather seeds. And so I ended up growing so much food last year that I actually... My neighbors insisted that I create a little farm stand so that they could buy it because I kept giving stuff for free, and I make $550 for my little hobby.
And so this year, with special thanks to Bright Security acquiring my company, I bought a very small hobby farm. And I'm so ridiculously excited. I'm planting flowers and my significant other is planting things. We're just like, oh my gosh, there's so much fun.
I so love gardening. I had no idea that there was this magic thing where suddenly it's like, I have no stress. I don't know how to explain, but I like go into my greenhouse for a little bit and I plant some seeds or I do weeding, which sounds like really crappy hard work, but I just love it. It makes me so happy. And so, yeah, it turns out. Yeah.
That's awesome. It was really, really, really wonderful, getting to speak with you today. Thank you so much for joining us. This was really, really lovely. We're very appreciative.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, share this episode with your friends. And if you haven't already, make sure to check out all the other really fascinating people that we've already interviewed. We're also open to suggestions. If you know someone we should be talking to, drop us a line at we'[email protected]. That's we're in podcast at s y n a c k dot com.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
