Full transcript
0:00Hey everyone, thank you so much for tuning in. Look, I'm super excited to get together with a new good friend of mine, Eva. Eva Ben, uh, principal security program manager over at Microsoft. But look, honestly, I'm a little more excited to have kind of just a really genuine conversation that's a bit more human because Eva, hey, this is
0:18the first time we got a chance to chat and catch up with each other, but I'm super curious. Who are you? What have you been up to? Where'd you come from? What's your origin story to kind of get things going here? >> Wow. Well, first off, I'm super excited to be here. We are totally freestyling this and I think that's the way it
0:35should be. We're bringing the most human side of us possible. So, I am obviously I've accomplished a few things in my cyber security career. I've won a few awards. I'm a speaker. I'm an educator. You know, I I've done a few things that I guess sound impressive on the paper. But what I want to talk to you about is
0:53not what I have today, but where I started because I think that that's what matters to anybody who's listening right now. You might be feeling lost and overwhelmed. And you might feel like, oh my gosh, like this cyber security career thing is just there's so much and I didn't grow up with computers or maybe I don't have money or maybe I don't have
1:12resources. I was there. I grew up in Bulgaria, poor in the middle of nowhere in a small town. I had no access to computers. My school had one computer that we had to share. So I probably got like I don't even know one hour a month. So the reason why I'm telling you this is that I came to the United States with
1:31a school program. I had $50 in my pocket. My mom's last money she gave me. And look at where I am today. So I'm not smarter or more capable than you. Whoever is watching right now, listen very carefully. What determines a successful attack? when we put our hackers hat on is not your initial
1:54attack position. It is the attack path you take. It's how resourceful you are along the way. Not thinking about what you don't have, but thinking about what you have, what you can use. And every single step and every single um thing you learn along the way in your attack path helps you in the next phase, right? If you find credentials, you store them
2:14like for later. Maybe you can use them later for privilege escalation. um if you find like a specific vulnerability somewhere you can just go back and you know maybe you can't exploit it now but you can exploit it later right you have to think about your career as an attack I have learned through my career most of
2:31which I've spent in ethical hacking I've been in cyber security for 12 years but I've learned to attack everything in life through a hacker's lens and it served me well so anyways my this is my origin story I just basically built myself up by using a hacker framework just being resourceful. And one last thing I'm going to say, you
2:51know what? If you start with some resources, if your initial attack position does give you some leverage, use it. There is nothing wrong with that. We don't always have to start with nothing. If you have parents who are in tech or if you know somebody who you know can help you out with cyber security, I'm here to be your resource.
3:09If you need a cheerleader, if you need a friend, hit me up. >> I love that approach because it is funny. I think a lot of stuff really parallels like even in the early beginning initial phases you are basically doing recon you're basically enumerating you're trying to see oh what information is out there what can I absorb like as a sponge to just get
3:29visibility just know what we're up against and then you kind of start to get smart and tactical like oh can I network with people can I make these connections can I talk and be present and be part of the activity that's already happening and are those the things that you could like latch on to. Is that the best way to really approach
3:48it? >> Yeah. >> I mean, honestly, I actually just created and I don't want to like promote any of my content, but I literally just created a zero to hired video >> where I broke down the cyber kill chain. If you haven't heard of the cyber kill chain, is essentially a framework that models how an attack progresses from one
4:08phase to another. And so I flipped that into how you can use that exact same framework on approaching your cyber security career. As you said, John, the first step is recon. You have to know your target, right? Hackers don't just go be like, "Oh, well, most of them, right? The ones that are serious. They
4:29have a target. They have objective. They're not going to try to hack everything. They're going to go after where, you know, their objective is, whatever that is. So these can be many different objectives, but that's how we approach our cyber security career. We're not trying to learn everything. We're not trying to be friends with everyone. We want to be strategic and
4:46that starts with reconnaissance, understanding the field, understanding the different domains, the different areas where you can get involved. Most people that I talk to, because I've mentored so many people through my career and I continue to do so, everybody wants to be a hacker because that's what they see in the movies because that's very flashy. But guess
5:08what? There are so many cool jobs out there that you might already have transferable skills to. So in that zero to hire framework, I'm not just, you know, kind of talking about it. I've broken down free tools. I've broken down just kind of like I'm giving you also the how, not just the what. Anyways, uh
5:28very passionate about this topic. So, you're striking a chord here. No, I mean that's excellent. I think it's just because it is so relatable. I know there are so many people that are so interested and fascinated and want to get into cyber security, but it is overwhelming and it is hard. It's tough. It's difficult because there is so much
5:48out there. But you find your path, you find your attack path. I love that. And then, hey, you just kind of keep cruising along, taking the opportunities that come at you, but making these opportunities available to you by leveraging what you can. Oh, taking those those exploit opportunities. Not to say, not to put that in a bad light
6:07or oh, abusing vulnerabilities. That's totally just the synonym and allegory we're using here, but I it's true. It's right. It's just finding when luck is at your door, when something is on the horizon, you chase it. I do have to open a parenthesis here. >> Yeah. >> I don't believe in luck. >> I believe in being prepared when an
6:28opportunity arises because guess what? If an opportunity drops and you're not prepared to take it or if you don't know, if you don't know where you're going, you're probably going to miss it. That's why it's so important and not to put pressure on you. I'm actually trying to simplify it, right? if you have to have some sort of a baseline of goal
6:46where you're going because that's going to enable you to kind of like detect the the opportunities um and also to be prepared when they come your way. >> Heck yeah. What do you think? Could I and I don't I don't want to steer us in a in a in a new direction unless you're ready, but >> why not? Let's go.
7:07>> I mean, I know it sometimes it can feel like, oh, you've got all the odds against you. you you've got hey all these different challenges and potential setbacks and for some it's not a secret and I hate to I don't know not to to bring or open up a can of worms right but you have been crushing it you
7:24personally individually and what a lot of people will just start kind of saying and maybe they they they lean back on the fact that uhoh this is a a male-dominated field uh and you have been doing incredible things despite that when you're feeling like okay am I not to say I I don't want to say a minority. I don't want to say oh some
7:43just smaller fraction here but I I want to get your perspective and your take. How do we arm and keep adding the best support we can for that diverse representation in cyber security in creative work to encourage more cyber security? Can we fall down that road? But again I want to take it with grace and really get your thoughts. AB
8:03>> absolutely and first of all thanks for opening and being open about this conversation. Right. I think there is especially I think cyber security as we mentioned has a lot of different domains. It's a broad field I would say especially in some of these more technical and operational roles such as red teaming and penet penetration testing. Uh we have very few um I'd say
8:25I'd say we still can work on diversifying. Let me just put it in a very productive way. And I think one of the ways that we can do better and what I'm doing practically I am practicing what I preach. I show up because I feel a sense of accountability to show those getting in the field that cyber
8:44security, pentesting, you know, security operations, they can look in many different ways. And that is one of the reasons I also actively support and empower more, not just, you know, women voices, but any voices from all over the world to contribute. Guess what? Even if you're a beginner, you probably have
9:06something value valuable that you've learned and you can probably help. There's probably somebody out there in the world that needs exactly your voice. So, I'm very passionate about encouraging more people to show up because that helps us. Like growing up, I didn't have any examples to emulate and I briefly mentioned about my story, but the only thing that I was
9:28envisioning for myself was basically growing up marrying a guy and working at the grocery store because that's all of the examples that I had. I mean, I literally didn't have any other examples. So, I think that while examples are not the only way, they are a really good way for us to empower others. When somebody sees themselves in
9:47you and in your story, guess what? that gives them fuel to keep going. And I truly hope that my story inspires you today that no matter where you are today, you can be way further along than you can probably imagine. >> And I think the coolest thing is that it absolutely is, hey, everyone that's got
10:09to be in on the fight in security and the work that we do, it there's no there's no one missing out. We are open arms and welcoming. Hey, no matter where you come from, no matter what you look like, no matter what all those silly stupid things that I think we tend to quibble about, some parts and pieces of
10:24the internet do. Look, the internet's open. Uh that's where we can get this information. That's where we can learn and improve and then be part of it. >> Yeah. And you know, one thing I have to say to be careful. We are currently not lacking information. We have a different problem. We have an overload of information. So one of the reasons why I
10:44started creating content which started as a joke without my name this is a different story but because I created one of my friends who is a creator got me to create a Tik Tok account >> and I and I was like what is happening here? >> What is happening here? Uh I saw so much misinformation. And I saw a video that
11:05absolutely enraged me that was saying that cyber security plus is the only certification you need to get hired in cyber security. And I was like okay somebody needs to get the record straight. Also a lot of people were selling and trying to get people to sign up for expensive courses where I knowing me I didn't have anything when I was
11:24trying to build my cyber security career and I know how hard it is to have to you know separate from your already scarce living expenses to invest in your learning. So my goal and my mission was you know what I'm just going to crank out all of the practical free resources that I can get out there. I actually
11:42created a video about you too. Oh, thank you. >> At the time, at the time it was there, these videos are really bad. They're still like floating around on TikTok. But I think that this is the crux, like being able to filter good information from bad information. And that's why I think having creators and people who are in the field, who
12:01have proven track of record of, you know, succeeding in the fields are the ones that can help guide you. I think it's awesome because I know there is so many different resources available, especially ones that you, I'm sure, mentioned in free resources, but they also still kind of add up and stockpile to like, hey, these are the incredible
12:21spots and people and teams and organizations that we could partner with or work together with. Hey, a hack the box. Hey, a try hackme. Hey, a just hacking training. Hey, a defense lab security online range, whatever the case may be that we're using to learn from and learn with. And then look, that helps create
12:43more creators and to get more education, awareness out there. So that's awesome. >> Yes, I think information is cheap. AI made it a lot cheaper. What we need more of is authentic voices that have lived experiences that you are about to go to. I have a belief that every challenge
13:04that we go through in life is literally because it's preparing us to help others through it. When we embrace that mindset of giving back, of life of service, you look through every challenge and you wonder, you know what? one day I will be the resilient version of me that can help other people overcome it.
13:26>> So, yay you. >> I think it's good to have that voice. I think it's so good to look keep things again you got to and it's not a matter of like selft talk. I don't know. It's a matter of just like you knowing with your direction, your compass, your ambition that you're going to keep things going and not losing or faltering
13:44any of that motivation. >> Yeah. Yeah. It's very demotivating when you try to learn it all. And by the way, I'm not here preaching. I went through this, okay? Early in my career, I was that person who was relentless. Not to mention that I had a major imposttor syndrome. And I need to make sure I
14:04think most of us in cyber security at one point of our career >> have had. Yeah. No, I mean, it's it's a field with a lot of smart people. It's inevitable that you're going to look around and you're not always going to be the smartest person in the world. Actually, most of the time you're not going to be the smartest person in the
14:21room, but you have something to bring to the table and you need to acknowledge and find what that is that is different. One mistakes that I made early on is I was constantly surrounded by, you know, people who grew grew up hacking, right? And I mean, I was always trying to my baseline was like right here, but I was
14:40always like trying to be right here and just compare and like push myself and just didn't have weekends, nights. All I was doing is trying to get every possible lab and certification and whatever. And guess what? Like I was burning myself out. Nothing really came out of this. Yes, I learned a few things along the way, but I think that trying
14:59to learn it all without clear direction is a recipe for burnout. It's not a recipe for success. Do you feel like some of the burnout and some of the imposttor syndrome maybe as tough as it is to say and maybe as much as a hard as it is a hard pill to swallow, right? But it almost feels
15:20like that's part of the process. It it almost feels like look that monoomania obsession to keep cruising, to keep charging onwards, >> it feels like you you almost to a certain extent have to go through that. But I mean, you got to be able to recognize it. You got to be able to acknowledge, okay, look, I am burning
15:39the candle at both ends and working so hard so that you can set yourself up for the future and so that at some point you can >> pump the brakes. Let life get in the way because it needs to. It has to. That's what life, you know, happens. But >> you work so hard when you can, uh,
15:58smartly, responsibly, so that, hey, you'll have easier times ahead. Is that right? I agree. And you know what? This made me think I really love the way you're framing it almost like as a healthy momentum to ride on >> as like it's like a as a force propelling you forward.
16:18>> And I agree with that framing and I'm actually going to use that. I'm probably going to be pondering on this because I love when somebody gives me a different perspective. One thing I will say though is when you put all that force and energy, try to put it towards like that one thing, right? Um don't study like
16:40don't go take a GRC course and then um you know identity engineering and then whatever like just try to like I think if you focus on one thing then guess what all of this energy all of a sudden starts moving faster. If you think of a steam engine, right? If you get the valves like all the way out, like if
16:58you're just putting energy all over, scattered all over the place, you're going to move slower. So, yes, invest that. I mean, I am somebody who is all about putting in your time. You're inevitably going to need to put in the hours. AI is not going to replace that. I'm sorry to disappoint you. Um, but
17:19yeah, I I think this is a really healthy way of framing it actually. Yeah, it's so interesting because it is like a a a tough thing to have to grapple with. Like, look, I know I'm going to have to work hard. Uh >> but that is at least the way you can start the way at least the way you can
17:39dive in and keep things moving. So, >> I mean, you're going to have to you're going to have to put in the work. But guess what? When you are aligned, when you know where you're going, like I was obsessed. I wanted to be in ethical hacking from my very early in my career. and all I invested was in this. So I did
17:55identity engineering, I did um like u other things like along the way but that was my ultimate goal from the very beginning. So I worked towards it like from the very beginning and yes I grinded really hard but even though no matter what kind of jobs I was doing I was working towards that one goal. So
18:16you have to like have some sort of a direction especially early on. you cannot be a generalist like I don't know I feel like it's really hard to start off as a generalist like you become a generalist is later on uh and you have to have a baseline understanding of the whole field but my advice always to people
18:31early on is like to try to pick a path or a domain >> choose what's fun choose what you like and you know you'll keep moving fast on because you love it and then look you you'll be able to pull your head up for and then see everything else that we everything takes in security. So >> you know what's funny? After 12 years in
18:50cyber security, even today like I feel like a beginner. Even today, every single day I wake up and I feel like a beginner and then I look back and I'm like what? What? I've been in security for 12 years. Like I don't know. Kind of like snuck up on you. Embrace that beginner mindset. There's there is never
19:10uh you're never going to wake up and just feel like you know it all. >> Yeah. >> Never. And I'd say honestly that's a good thing because it is the like constant learning. It is the oh being able to adapt to how the industry changes, how everything in our world adapts. Being able to >> I don't know keep up with it, stay on
19:28the pulse, stay on the heartbeat. So if you don't always feel like a beginner, well, you're not going to keep chasing things. Uh and it's good that you do like >> Yeah, >> that's a good thing. >> Can I ask what are you up to these days? What's going on in your world? Uh is it hey a lot more advocacy? Is a lot more
19:45speaking? Is it a lot more again spreading the education and awareness? >> Well, I think I do quite a bit. So, my number one priority is really to make cyber security as accessible as possible for as many people as possible. So, I do a lot of cyber security education. I also contribute to the OASP for Agentic
20:05applications for LLM. This keeps me on the edge of things. I do speaking. Um, to be very frank with you, I love bridging all of my cyber security experience to to kind of bringing people along on the journey and educating has always been a big part of my heart in addition to, you know, my day job. So,
20:28so yeah, I also really really love um again just creating more opportunities for people where I can in practice. And last month I'm going to bring out what you know we try hackme one example for those of you that were around for advent of cyber you probably noticed we
20:49had such a beautiful and diverse lineup of creators from all over the world and I'm very you know grateful that I got the opportunity to work with try hackme on putting this lineup together on creating opportunities for new creators we quite literally created new creators.
21:09They created their YouTube account and then started creating. And so this is what gives me energy. I just uh feel like in a world that there are so many creators that started, you know, in the early days, right? There is um not a lot of clarity for people who just want to get started, who may have who may be
21:28earlier on their journey, but they may be more relatable to you know some of the students. Everybody's voice brings different value. There is no one person in the world, maybe except John, maybe except you, that is liked by everyone. >> No, no, not definitely not. >> I love the fact because I think that has like a onetoone mapping in all reality
21:49with the stuff we were talking about from the start is that hey, whether you're getting started in your career, whether you're looking for new, hey, things to learn from, new resources, new things to help you keep cruising, then the creators are helping for one thing. And then when if you want to start to create or share videos, share content,
22:09share lessons, writeups, blogs, articles, like that opens more and more opportunities for you because you're sharing your work. You're showing, hey, look at what I've been doing. Look at what what I can do. And that's going to help you in your career. That's going to open these doors for you. And it's like awesome. Super cool virtuous cycle. I
22:27gotta say >> it is. I do have to add two um very important points to this. One is don't feel like you have to have all the equipment or all the stuff. I've been doing this honestly so scrap. I mean, if you guys look at how I've been filming just with my phone just like propping things with like books, okay, you don't
22:49need to I literally this this conversation that I'm having with John right now, it's my first time having an actual equipment. So, yay. You're witnessing this test run. And the other thing I want to say is visibility alone is not enough. You also have to make sure that you add value. Okay? I see a
23:09lot of people just posting and like getting hung up on the visibility and the likes and they're not really adding value. Recycled content is is quite cheap and it's not helping you build your brand in the way that you want it. So make sure that when you're posting, when you're visible, share your outcomes
23:29of, you know, a CTF challenge that you saw that you solved. Uh maybe start documenting a repo like on GitHub any kind of project that you're working on. Share with the community. Like I always call it embrace the give mindset versus get mindset. You get much more. So that is
23:50just a little tiny tip. >> I love that. I I really appreciate you mixing in that you give and take. The the go- giver mentality is something that we're in love with. Uh you give so much more than you get and then it it is still a great way to be a part of the community and really that's what it
24:09comes out to be is just the community uh everyone learning and getting better and being a part of this thing. >> Exactly. We can't do this alone. We can't we are standing at such a you know at at a time where we quite literally need everyone to embrace a cyber security first mindset even the everyday
24:30people because now with AI the attack surface has transformed it's not just your computer anymore it's also your decision- making and you know your interaction your cognitive biases are directly exposed to um you know to attack surface so they are an attack surface So yeah, I think that we just need to
24:52all embrace that one security first mindset and yeah. >> Well, hey, this has been awesome. Eva, is there more you think we can dive into? Is there anything else that is top of mind for you? Anything else that's oh worth getting the message out? Uh, anything else that we could help shine a spotlight on or should we wind this
25:09thing down? >> Well, I think it's been a great conversation. And if there is one thing to leave you with today is please pick a path, believe in yourself, and if you need somebody to hype you up, again, I'm here. I'm your bestie. Add me on LinkedIn, tag me. I would love to support you and cheer you on along the
25:29way. I'd add one extra tidbit to that because I'm I'm glad that you mentioned look LinkedIn is like the way that we can connect and and not just oh sure if I'm clicking a button and having some silly LinkedIn network but like literally be a part of the heartbeat be a part of the pulse be a part of the
25:47community and that can take shape on LinkedIn that can take place on Discord on YouTube on Twitch on whatever like >> that opportunity that the internet gives us is an awesome thing and that can help really springboard the work that you're doing, the work that anyone is is taking apart to get through their career and really make an impact. So, absolutely.
26:09I'll see you on LinkedIn, Eva, and we'll keep chatting. >> Yes, absolutely. Thanks for having me, John. That was awesome. And thanks for allowing me to test my equipment. >> Well, you always have some incredible stories to tell. And uh again, I think it's just the right mission. We're all in it together. So, thank you. Thank you. Thank you.
26:27>> Thank you.