Continuous learning

Working in the information technology (IT) field means you need to be comfortable with things at work constantly changing and the need to continue to learn as your career grows. Working in information security (InfoSec) means you not only need to keep up with all sorts of IT trends, but also the attacks, defenses, and mitigations for each. When I started learning about DevOps, and how they value continuous learning and ‘taking time to improve your daily work’, I was sold. But I wasn’t quite sure how to go about putting it into practice.

When I switched from being a software developer to a penetration tester, and then onto application security, I had a lot to learn. On top of that, I am dyslexic, so the more common ways that people learn don’t always work well for me. Even worse, my training budget for my job in the Canadian Public Service was $2,500 CAD a year (approximately $1900 USD) and I wasn’t allowed to travel for courses. Living in Ottawa, Canada at the time, there weren’t very many options that were within my reach.

I started out my security career switch with a professional mentor, but the first one didn’t work out very well. He got frustrated with me quickly, no matter how hard I tried. Although I found out later that his expectations were near-impossible to meet, and what was asked of me was not very reasonable (nor ethical at a times). Example: He asked me on a Friday to learn pentesting over the weekend, with no help or advice, and then told me to do my first pentest the following Monday, setting me loose on a client’s live production system, with zero previous experience. It did not end well. For me and the client. The mentor and I went our separate ways.

By this point I had started joining security communities. And I LOVED it. My favourite community of all the local ones I could find was OWASP, the Open Web Application Security Project. The Ottawa chapter was led by someone named Sherif Koussa, who I am proud to still call my friend and mentor today. I made friends quickly, found more than one new mentor, and even became a chapter leader. I learned a lot by inviting speakers, talking to others in the community, and volunteering for projects.

Eventually, I started doing public speaking, which provided me with free tickets to conferences, and sometimes even free training! I also started my own OWASP project (OWASP DevSlop) so that I could learn how to secure software in a DevOps environment.

It became clear to me, very quickly, that I learn best by reading/listening/watching something, then trying it for myself, then teaching it to someone else. I also enjoy learning more when I follow this process, rather than only reading or watching videos. I realize this is way more work than just reading a book, but everyone is different. And I’m lucky because other people seem to like my style of teaching and writing, which motivates me in a way I had never previously known.

Eventually, I wrote my own book (Alice and Bob Learn Application Security), started my own tiny Canadian startup (We Hack Purple), and opened my own online academy and community.

Below is a long list of ways that you can use continue your learning. If you have more ideas, please send them to me and I will add them!

General Advice:

• Find what you are interested in. Join communities (online and local, if possible) that focus on those topics. Make friends if you can!

• Finding out what you are interested in might take a lot of time, but that’s okay! It took me two years to figure out I wanted to do AppSec, not PenTesting. You need to find the right place for you.

• If you fear that you are too old to learn, please put that notion aside. You CAN learn. If this belief is holding you back, talk to someone who cares about you and let them talk you out of it. Everyone has doubts sometimes; people who love you can help you look past them.

• Find out if there are learning opportunities at work. Sometimes, you can job shadow someone or help on certain projects. I kept volunteering to help the security team at my office and eventually, they let me join the team!

• Some organizations offer coaching services to employees. Usually, it’s for leadership, but I used to work somewhere as an AppSec coach. I trained up the junior people into AppSec pros; it was great!

• If your office pays to bring in a trainer, it’s often significantly less costly than sending them all individually to courses. See if you can join forces with other teams, departments, or even other organizations to create a larger budget.

• Ideally, you will aim to learn about best practices that are agnostic in nature, and then also learn about your specific tech stack that you use at work. This could mean a general secure coding course, with a break-out session on your specific programming language, framework, cloud provider, etc.

• If you are reading this and you are on the security team, and you are planning to train your developers on security for the first time, if anyone seems nervous, you might want to assure them all that no one is losing their job. It might sound strange, but sometimes when there’s change, people worry. If you can remove their worries, they will learn more, and hopefully maybe even enjoy it. Pay attention for this and reassure people if the need arises.

• If you are planning learning for others, communicate your plan, in advance. Let them know what’s coming. It helps people prepare themselves, and you are likely to get better results.

• If possible, provide training in multiple formats (audio, visual/diagrams/images, hands on, written, etc.) so that every person’s learning style is accommodated. If you’re not sure how you learn, try a few different ways and see which one “feels right”. That’s likely the best one for you!

• Give yourself short breaks. A microbreak (5-15 seconds to laugh at a meme or read a few short posts on mastadon) can help you move the information from your short memory into long-term memory, meaning you are more likely to be able to apply what you learned and remember it for significantly longer.

• Take tests or give yourself tests. Not so that you can see how you measure up against others, but to make yourself remember the things you’ve learned. Practicing ‘recall’ will help ensure you’ve learned (not memorized) the new information.

• Set time aside for yourself each day and slowly watch recorded conference talks and other content that are of interest to you. Consuming information in smaller chunks can make it easier to absorb. If you aren’t sure which videos, books, or articles that you want to start with, ask for suggestions from people in your community.

Tanya Janca, Presenting at B-Sides Ottawa, November 2022. Ottawa, Canada

Application Security Learning Opportunities:

• Please start with the free training inside We Hack Purple Community. There are courses, articles, events, and formal courses you can follow, and all of it is free! Start with the class ‘Application Security Foundations Level 1’ if you are new to this topic.

• Most AppSec vendors will give you a workshop for free if their product is expensive/enterprise. ASK for a workshop for your team, for free. They might say no. If they do, tell them their competitor offers it (because this is true in most cases). Sometimes this works! If it doesn’t work, find out if you can add the cost of training onto the licensing agreement.

• The OWASP DevSlop Project, was started by myself and my friend Nicole Becher, and is now lead by my other friend, Nancy Gariché. DevSlop is a great place for free, high-quality content that focuses on DevOps, DevSecOps, and IT modernization.  https://www.youtube.com/channel/UCSmjcWvgVBqF3x_7e5rfe3A

• Join your local OWASP Chapter, and if you can, attend their amazing in-person conferences and training. Attend their online events too!

• Read Alice and Bob Learn Application Security. Available in e-book, paperback, and audiobook formats. There are also free, online lessons available for each chapter, here. (Shameless self-promotion!)

I hope this helps you on your continuous learning journey!