Andrew (@Andrew___Morris) is a security researcher at Endgame. Before he got that role he was a penetration tester. I had an opportunity to get to know Andrew at some events in the Columbia, SC. He's very knowledgeable and excited about what he does in the information security space. In this two-part series we discuss some of the nuances of being a pen tester and how to find yourself in that particular role.

Frank (@TheDevilsVoice) is the lead organizer of BSides Indy (@indybsides). I am excited to be traveling to the conference this year. I will be taking pictures and speaking at the event. I decided to have Frank on to talk about BSides Indy to gauge what type of BSides event I can expect. The theme I got from my chat with Frank is that it's a very laid back type of BSides with a lot of the usual events. They have some wonderful speakers. A lock pick village and a place for hacking Internet of Things (IoT) devices. Hack4Kidz for the little ones and a devious capture the flag (CTF) event. I am excited to go. Tickets are still available. General Admission is $15 for Saturday. Hack Harder (Friday workshops) and the Saturday talks are $30. If you're a student or broke tickets are free. See you there!

Greg (@_GRRegg) is one of three project leads for the OWASP project DefectDojo. The project is an appsec automation and vulnerability management tool. This is something I wish was around when I first started managing vulnerabilities for the development team. It has got a lot of great features including metrics, integration with JIRA, automatic ticket creation, vulnerability de-duping, and of course it allows appsec teams to manage vulnerabilities in development. A demo site is available. It's open-source (as all OWASP projects are). I would recommend anyone having to manage vulnerabilities check this project out.

I continue my discussion with Michael Santarcangelo on decentralized IT. We talk about: Roles and responsiblities; Having leadership buy in; being adaptable; building better relationships; and doing better with less.

Michael (@Catalyst) has talked about decentralized IT before on a couple other podcasts. It's a concept that I am currently experiencing in my day-to-day role. I work with the development team to improve security in the software development life cycle. I sit with the dev team. I attend meetings. I am a resource for them to approach about security concerns and questions. I am having quite a bit of success. Which is why I wanted to have Santarcangelo on to have a discussion around this concept. It's something that I think more teams should be looking into as an approach for working with other departments and teams.

Paul (@PaulCoggin) is the founder and organizer of BSides Hunstville (@BSidesHSV). I will be attending the conference for the first time this year. The conference is in it's fifth year of existence. In our discussion I found something unique about the conference. Paul doesn't deal with sponsors like some other BSides conferences. Which isn't a bad thing and I'm interested to see how that plays out in talks and networking opportunities. The lineup of speakers looks fantastic.

After recording the How to find a mentor episode, Wolf (@jwgoerlich) suggested that I do a podcast on how to be a good mentee and to invite Amanda (@infoSystir) on to discuss. I thought this was a great idea. I've heard Amanda rant before about people who ask for advice but don't do anything with it. And that's the sad truth. She's given out advice and taken the time to write up a how to on networking and networking forensics (try it out and let her know), but has yet had a mentee follow through. This episode is meant to guide those looking for their start infosec, asking for advice, how to interact with a mentor.

Samy (@samykamkar) shouldn't need too much of an introduction to most people. He's been in the news for hacking garage doors, credit cards, cars, and much much more. Samy likes to hack things and has a knack for finding vulnerabilities in everything from locked machines to wireless doorbells. His site has the full list of vulnerabilities as well as videos and press appearances. Which made him the perfect guess for talking about how to find vulnerabilities. In this episode we discuss: how Samy got started; what is a vulnerability; what skills are needed; how he decides his next project; steps to finding vulnerabilities; what he does when he discovers a vulnerability; how long the process takes.

Samy (@samykamkar) shouldn't need too much of an introduction to most people. He's been in the news for hacking garage doors, credit cards, cars, and much much more. Samy likes to hack things and has a knack for finding vulnerabilities in everything from locked machines to wireless doorbells. His site has the full list of vulnerabilities as well as videos and press appearances. Which made him the perfect guess for talking about how to find vulnerabilities. In this episode we discuss: how Samy got started; what is a vulnerability; what skills are needed; how he decides his next project; steps to finding vulnerabilities; what he does when he discovers a vulnerability; how long the process takes.

Around this time each year the SANS Holiday Hack Challenge releases under the direction of Ed (@edskoudis) and instructor with the SANS institute. This year Santa has been kidnapped and it’s up to use to figure out who did it and save Christmas. The challenge is for new people in infosec, and for those who have been in the industry for many years. As Ed notes in the episode it is even for children. The challenge itself has been around for years and several past years are still available for people to go through.