Security Confidential S10 E6 Josh Mason

Manoj Tandon: Hello everyone. This is Manoj Tandon and welcome to another episode of Dark Rhiino Security, Security Confidential. Today we are honored to have Josh Mason join us. Josh has a great history. He has over 10 years of military experience. He was an Air Force pilot, went to the U.S. Air Force Academy, and became a cyber warfare officer. Currently, he’s a senior technical trainer at NuVik Solutions, providing training, engagement management, penetration testing, risk assessments, and business consulting. In his free time, he provides guidance to a host of people on how to develop their cybersecurity careers. We’re honored to have him. Welcome to the show, Josh. Thank you so much for being here today.

Josh Mason: Thanks for having me. Glad to be here.

Manoj Tandon: Josh, you’ve got a heck of a background. Of the hundreds of guests we’ve had, I can count on one hand the number of people who actually got a degree in cybersecurity in college. By and large, everybody else has come here from somewhere else. So you’ve got to share your story. How did this happen?

Josh Mason: The first time I thought about getting a job was maybe freshman year of high school. At that point, I was big into band and I wanted to become a band director. Then I got tired of band and realized, “Oh, maybe I don’t want to do this.”

Someone mentioned, “You know what? You’ve got good eyesight. You can go fly planes.”

I was like, “Wait, how do I do that?”

They said, “Well, if you get into the Air Force Academy, it’s free. It’s hard to get into, but you can do it. Then if you don’t stink there, you can get a pilot training spot. Then if you don’t stink there, you can get in a cockpit.”

I was like, “You know what? I’m not the best at things, but I can get away with don’t stink. I can do that.”

Manoj Tandon: That’s awesome. That’s an awesome self-assessment. That’s a strength.

Josh Mason: I rode that all the way to a cockpit. It worked. I did not get into the academy the first time. I had a decent enough SAT score that I could get into a few schools in California. My GPA was all right, but I wasn’t going to get scholarships or anything huge. So I actually went to a prep school. I was close enough that the Air Force Academy said, “Hey, here’s a scholarship. Go to prep school, don’t stink, and we’ll see you next year.”

Manoj Tandon: That is very cool. So the Air Force paid for prep school?

Josh Mason: A little bit. I also worked that first summer pulling wires through rich people’s houses in Southern California, setting up home automation. The irony now is that you could put Ring doorbells and speakers in every room and you don’t need to pull any wires.

Manoj Tandon: Those are some seriously unsecure systems.

Josh Mason: Yeah. I totally messed up someone’s Venetian plaster walls, and they had to spend an extra two grand to send the painters back just so I could cut out a little hole to put a touchscreen outside of a bedroom door. That was a fun summer.

Manoj Tandon: I was going to say, that gig had to have some stories. But that was actually IT work. People still pull cables through walls. It’s not glamorous work, but without it, it’s hard to have a wired network.

Josh Mason: Yeah. I terminated RJ45s and Cat5e back when that was the thing. I haven’t done it since, ironically.

Manoj Tandon: Well, I’m sure you’ve helped secure some networks, though, but it didn’t involve pulling the cables through.

Josh Mason: Yeah. By the time I made it to cyber, they were like, “You’re a captain. We have people for that.”

Manoj Tandon: So then in the Air Force, you transitioned to cyber warfare officer?

Josh Mason: Yeah. My wife and I were both C-130 pilots. Some family stuff happened, some complicated stuff happened. She ended up getting medically retired. I went through some stuff and ended up ending my flying career and getting reclassified into cyber because I still owed time back from pilot training.

Manoj Tandon: Got it. Can you talk about what a cyber warfare officer in the Air Force does?

Josh Mason: Classically, up until I found out myself, I had known it as a communications officer. Truth be told, it was the last thing almost any of us wanted to do at the academy. My wife followed around a communications officer when she was visiting a base in Japan, and she was like, “This guy’s job is so sad. It’s answering emails and going to staff meetings.”

It wasn’t wrong. I got to the First Special Operations Communications Squadron at Hurlburt Field, Florida, where we had AC-130 gunships, U-28 spy planes, CV-22s, and a command base.

While my mission ended up being in charge of QA and training and helping people get out the door so that they could go and be the IT or cybersecurity person on a small special operations base, the majority of my time was in staff meetings or replying to emails for the commander or command staff.

After six months of it, I was asking my boss, “Hey, could I go teach back at the academy? Could I go get this teaching job at AFIT? I heard about this opportunity.”

He was like, “Look, Josh, if you want to go teach, there’s a special operations school literally across the parking lot. They have a cyber warfare officer billet. That guy needs to move. So you could go over there if you really want to.”

I was like, “Yeah, I’ll go teach. I would love to teach.” I’ve been an instructor ever since. So that was 2018.

Manoj Tandon: Wow. That’s pretty cool. The Air Force did a study, and I don’t know if it ever landed across your desk, but they coined the term “the prevention paradox.” It was a pretty decent piece of work. I don’t know that a lot of people even know about it, but the paradox was that the more you focus on prevention, the less secure you actually become.

Their basis for saying that was if you exclusively focus on prevention, or you go to a singular platform for prevention, detection, and response, then you will lose sight of the movement of the adversary to anything that is not visible in your prevention window.

Josh Mason: Yeah, you get too stuck, too focused, and you miss greater movements.

Manoj Tandon: Well, you just won’t even detect them because you’re relying on detecting and responding to signals you’re going to pick up. But if all the signals you pick up are what you can prevent, then you’re missing probably 10% of the signal base out there. It was a very interesting study. If you still have friends out there, pull the document and take a look at it.

Josh Mason: Oh yeah.

Manoj Tandon: I don’t know if it was out of their cyber warfare unit, but it was out of their cyber prevention group, whoever was doing that work.

Josh Mason: I’ve been connecting with Frank, the leader of the cyber warfare officer weapons school at Nellis recently. He’s been helping me with putting together a paper and a talk that I’m giving next month.

Manoj Tandon: They’ve upgraded that. They’re out at Nellis now. That’s interesting. Were you guys ever tied up with the NSA or U.S. Cyber Command?

Josh Mason: I wasn’t. I have friends who were. I went to Hurlburt. They came up here to Fort Meade and some others are now up here as well. They went to small little areas on Fort Bragg and did some really neat stuff. I’ll just put it that way.

Manoj Tandon: I’ve got to believe in today’s global environment, there’s probably work going on there I would love to know about. More importantly, what’s going on with the offensive folks. I’d love to see what’s in their handbag. There are probably some interesting things there.

Josh Mason: I have a high schooler I’ve been mentoring since the pandemic started. I was teaching at SANS, we got sent home, and they didn’t have a solution for teaching remotely because the military hadn’t agreed to anything. I was bored and I got on Facebook and said, “Hey, anyone want to learn cybersecurity?”

Someone said, “Hey, my friend’s daughter is interested.”

I was like, “Sure, why not?”

I had my wife’s uncle, my mother-in-law, and a couple of high schoolers jump into a Zoom call, and I was teaching the CIA triad. Fast forward to that next school year, I got introduced to those high schoolers’ teacher, who ran a cybersecurity club. I’ve been working with them for the past three years now. That high schooler has an internship at the Fort and is doing some really cool stuff for a 17-year-old. It’s pretty wild.

Manoj Tandon: That’s great, actually, that you’re helping young minds and getting them off to an early start. We had a couple engineers join our company out of high school. They’ve moved on to other opportunities, but they turned out to be some of the finest engineers we’ve had in the field. Very dedicated people. They did excellent work.

Josh Mason: I always feel like, on that, I look at Marcus Hutchins’ story or so many of the criminals they find nowadays. They’re in their teens or early 20s. If we could have turned them early, imagine how powerful that would be.

Manoj Tandon: Yes, it would be very powerful. One of the big areas that’s missing in our profession is understanding the psychology of the adversary. Just like what you’re talking about, if we could have talked to that person earlier, there was a motivation driving them.

What’s interesting is that it’s not always greed. If you talk to any real-world hackers out there, it’s not always greed. The money is kind of like the sugar on top. It’s more the challenge. It’s a lot of the chutzpah of saying, “You’ve built this great thing. Well, I’m going to show you how wrong you actually are.”

Josh Mason: Oh yeah. I remember Jason Haddix recently got on Darknet Diaries and told his story. He was making fake IDs because he could and thought it was cool and people were interested. Then all of a sudden everything’s going down. He’s driving around with all these fake IDs. He gets pulled over by the cops. They don’t say anything, so he goes and he passes them. He’s like, “I’m done.”

I’m really excited. I get to meet him next month, and then I’ll go up and try not to be too fanboy.

Manoj Tandon: Did you have a hard time transitioning to the civilian cybersecurity workforce, or was that pretty natural?

Josh Mason: It was complicated in that I didn’t feel like a cybersecurity practitioner. Even if I had stayed inside the communication squadron for three years, with my experience there, I still wouldn’t have felt like I wanted to come into cybersecurity.

My dad was a network engineer, and I saw what that looked like third person. He did consulting. He worked for government contractors—not on government contracts, but big firms. I was not that interested in that.

I grabbed an MBA in aviation along the way while I was in the Air Force, and I wanted to work at a Northrop Grumman or an L3 and help them come up with something really cool. I thought I was going to be a program manager. Everyone in the Air Force who is an officer, if you’re not going to be an airline pilot, you think you’re going to be a program manager.

Then I realized I didn’t really want to do that, and I wasn’t getting any traction. People would be like, “So how many programs have you run?”

I was like, “Well, I’ve done all this stuff for years, managing programs in the Air Force, but it wasn’t the same as a project manager, a PMP, lifecycle management, all of that yourself and keeping a team running.”

At least not to people on the outside, because they’re like, “Well, you were a pilot.”

I was like, “Yeah, for like 10 hours a week. The other 50, I was doing project management.”

One of my friends, Stefan, I found him on a Slack channel for veterans for coding. He was like, “I’m recruiting. If anyone’s got any questions…” Now it’s wild. I had a phone call with him yesterday morning. We’ve known each other for three and a half years. We haven’t actually met in person. He was like, “Look, you know enough. You could do this.”

Ironically, now we’re both in consulting, basically.

Manoj Tandon: That’s so cool. Do you think there’s any kind of bias against veterans who are trying to enter the civilian space in cybersecurity?

Josh Mason: I don’t think so. I haven’t seen it.

Manoj Tandon: Glad to hear. I know we’ve had some veterans on that sometimes think people look at them a little differently. We hire a lot of veterans and we think they’re some of the best folks out there.

Josh Mason: Yeah, especially in this industry. There are so many people who are like-minded to the military mindset. We’re out here to help protect and help people. When I hear of veterans who come in, people are like, “Yeah, I want to help them out.”

I haven’t heard negative biases. Maybe people haven’t said them to me, or I’ve been in the right crowds. I’m glad to be in the right crowds. Sorry for those who have had negative experiences. That’s a bummer.

Manoj Tandon: I’m glad yours has been very positive, and I hope people listening can take that message away.

What are you doing now at NuVik Solutions? Did I say that name right, by the way?

Josh Mason: Yes, NuVik Solutions. Ryan Leirvik started the company, built out GRIMM, and then moved on to start his own thing separate from what GRIMM was doing. Some of the folks from GRIMM said, “Hey, we want to come with you.” So they started NuVik Solutions.

We’ve been doing risk management, penetration testing, red teaming, and some purple teaming. I put on my Black Hills purple team shirt today because I’m going from this to checking in for a pen test. I do some engagement management. After that meeting, there’s a call with a client to talk about some slides that we’ve been building out for a course we’re going to deliver for them in about a month. So I’m doing a lot of stuff.

Manoj Tandon: You’ve had your hand in a little bit of everything in cyber, so I have to ask: in your immense experience, if you were to generalize, what are some things that you see clients get wrong with InfoSec programs? Where do you see a lot of gaps?

Josh Mason: Three weeks in a row, we’ve been doing an external pen test or web pen test, and it’s always the same: patching, certificates, security headers. There’s so much low-hanging fruit. Then you get into externally facing databases or admin portals, password reuse. It’s wild. It’s the same stuff.

Manoj Tandon: Those are all the basics. That’s like the CIS top five.

Josh Mason: It is. And these aren’t small companies, and these aren’t the first pen tests we’ve done on them.

Manoj Tandon: I can believe it, but why do you think that is? Why are we still not getting the basics right? Where’s the gap?

Josh Mason: That is the golden question. That’s part of my plan for my talk. I feel like we’re not getting the feedback to the people who need it. The communication isn’t occurring in a way that makes sense.

There needs to be more internal consulting in a lot of security teams, getting the message to decision makers, the C-suite, department heads, and VPs about what the important factors are. Then it becomes a negotiation of risk management and where resources should go in the organization.

Sales, marketing, and product are all going to talk about, “Hey, we do this. We spend this, and it has led to X revenue.” Security goes, “Well, we do X and it has led to… we haven’t gotten breached.”

It’s hard to make that case, but a lot of that is changing. There are now models like the Cyber Matrix where you can point to, “Hey, if we change these things, we can actually increase efficiencies and reduce costs.”

If we were to get a SOC 2, if we were to get a CMMC, ISO 27001, we could have more opportunities in these markets. That’s a case that needs to be made, not from a “we should do this so we check a box” perspective, but a case for the business. We should do this so we have more opportunities, so clients trust us, so customers trust us, because we’ve shown these things.

Manoj Tandon: That’s right. There’s a lot when you look at the loss of reputation to the brand, the legal fees that can go with it, the fines that can come along with that, and the losses in sales. Target cited way back when in an annual report that they had lost $300 million because of the breach. That’s real money.

Companies need to think of cybersecurity in real financial terms. It’s not an IT problem. It is very much a business problem, and it needs to be looked at in that way.

One thing that we’ve brought up many times on this program is that a lot of our colleagues on the cybersecurity side may not know how to make that case exactly the right way.

Josh Mason: I’m a big fan of Alyssa Miller. She talks about The 10-Day MBA. It’s a book. Alyssa’s been a BISO, a business information security officer, and now a CISO.

Reading through a book on business like The 10-Day MBA can give a security person the understanding of, “What does the CEO think? What does the CFO think?”

Those of us who have gone through MBA courses think about Porter’s Five Forces and SWOT analysis and what our ARR is going to be. I didn’t realize I’d become indoctrinated to that until I got into sales.

I was like, “Okay, you guys need to read this book. I can’t put you through a whole MBA course, but I do need you to think about the value to the organization, the mission of the organization, and how cyber fits into that.”

In the same way that when marketing comes and says, “We want to do a social media campaign,” it’s not, “We want to do a social media campaign because that’s the thing to do.” It’s, “We want to do the social media campaign because we’re seeing our competitors do social media campaigns and see growth in these ways, and we need to react in similar fashion if we want to stay relevant and competitive.”

Cyber needs to think in that mindset: how do we stay relevant and competitive?

Manoj Tandon: Absolutely. One thing that is going to drive the conversation in that direction is the rapidly changing cyber insurance market. In the past, people said, “If we take a hit, we’re covered. We’re insured for it.”

Well, that’s not exactly the case anymore. Cyber insurance premiums have been on the rise tremendously. A lot of sectors are getting less coverage at more cost or are being dropped from coverage altogether. Typically, what we’ve seen is that most companies are getting 30 cents on the dollar of what they thought their contracted value was. That is one item that’s going to hit the CFO’s desk square and center.

Josh Mason: I look at it as an opportunity because now they might be looking at, “Okay, where do we want to put our insurance dollars?”

“You want to be insured by us? Awesome. We need you to do a pen test. We need to see your SOC 2. We need to see your Nessus scans from last month. We need to know what your E5 health from O365 says. Where are your policies? What does your ISO 27001 look like? If you have that, then sweet, we will insure you.”

It’s like the good driver discount. You haven’t crashed? We plug in this thing to your car and see that you don’t speed? Awesome. We’ll give you a discount.

Manoj Tandon: You’re absolutely right. Insurance companies are enforcing that depending on the size of the organization. What people may not know is they’ve lost their shirt on cyber. It used to be that 60 cents of every dollar in premium was profit. Around 2020, all that flipped where they actually had to dip into their property and casualty pools to pay their cyber policies. That is like the sacred cow of the insurance sector.

So they’re like, “We’re done with this. People can’t get their act together.”

If nothing else forces them, money will. That’s kind of what’s happened.

You brought up penetration testing. How should penetration testing be used in a program, and what is the right way to go about doing it?

Josh Mason: We just did a whole series at NuVik of blogs this month. I think the last one is going to drop today or tomorrow. We’re looking at a vulnerability from the traditional method. It was a zero-day. It was found in the wild. It wasn’t found by a pen tester.

The common way we find bugs is through penetration testing. Someone comes in, uses adversarial tools, and sees where the weaknesses are, where the loose bricks are, where the barbed-wire fencing is peeled back or falling apart—except in your infrastructure, network, or website.

That works. You find things. But it’s messy and expensive to fix because you’ve already got something in production. Instead, there’s the shift left, bringing security into part of the development cycle. DevSecOps is one of the terms that gets thrown around a lot.

A development team is going to come up with a plan: “Hey, we want this product to come out. Awesome. Let’s build it. Let’s make sure it does what it says it does. Let’s get it out to customers and QA test it to make sure it doesn’t break if you throw stuff at it.”

That’s a functionality test. It’s, “Are the wheels going to come off?” It’s not ramming it into a wall and saying how badly the passengers are going to get hurt.

We didn’t use to do crash tests on cars until recently. It was analysis after the fact, and that’s what pen testing is. It’s analysis after the fact. It’s up there with incident response feedback of, “You guys would have had this incident if…”

If we can move it into part of the development cycle, before it even pushes, let’s run some automated scans. Let’s get a pen tester who can be on our team. Let’s put it in a test environment and pen test before we’ve pushed it out.

Or move it even further. Let’s get the pen tester, or just a security person, talking to the developers. They say, “Oh yeah, so you’re going to put an input here. It’s going to go to this database, pull this information, and bring it back.”

The pen tester goes, “How are you going to transfer that? Am I going to be able to see it? Could I replace it? Could I spoof it? Could I get back more information than you intended?”

They go, “Wait, what? That’s not what QA does.”

And they go, “No, but you need to be thinking about these things and put some things in place to avoid that.”

That’s threat modeling.

Manoj Tandon: SQL injection queries come to mind. They still work, and they work pretty darn well.

Josh Mason: They do. It’s wild. While some people are getting trained in security, everyone in development and computer science still gets the same training: make something that works, work out the bugs so that it’s functional, but not so that it’s secure.

Until we get it into all the schools and all the computer science classes that it needs to be more than functional, it needs to be secure, I don’t think we’re going to see massive change.

Manoj Tandon: Bringing security up front has real value. If I play devil’s advocate, there’s going to be someone on the other side who says, “We need to get to a minimum viable product, the MVP, to go to market. If we bring DevSecOps up front, it’s going to delay our whole timeline.”

Josh Mason: It’s technical debt and risk management.

I was literally making these slides at two this morning to finish something for our presentation in a couple hours. In a rush to get an MVP or something out to market, often there are choices that developers make. It might be, “We’re going to go with this code. We’re not going to include these features. We’re going to use this language and these libraries because that’s what we know. We don’t have the time to develop more. Let’s get it out. Let’s get it functional. QA says it doesn’t fall apart. Awesome. Push to production.”

Then you get feedback from early adopters, and they go, “This is a really cool idea, and we hate using it. We need it to do this, that, and the other.”

Okay, that’s cool. Now you can’t move from what you built to what they’re asking for because the language doesn’t do that. The architecture you built doesn’t do that. You’re going to have to go back and rewrite the code. You’re going to have to refactor.

In order to develop to scale and develop to what the real end product is supposed to be, it requires a lot of refactoring. That’s expensive, as opposed to if we had planned for the end product at the beginning. We wouldn’t have to go through all that refactoring. We could spend a little more time in development and end up with a better product.

There’s a paper, I think from the ’90s, from Toyota or Nissan, where spending a little more time in the planning and development cycles ends up getting you to your market win faster. It sounds like it’s going to take longer, but by planning early and thinking all the way through the process, now we can plan for an MVP, but we can also plan for the MVP to expand and scale.

While everyone else is refactoring their MVP for a full production run instead of the beta, you’re already there. They got MVP out first, but you’ve got production, you’ve got a 1.1, and they’ve got 1.0.

Manoj Tandon: What you’re saying is very correct. I think some of this has to be taught in management programs. Execs and managers need to understand this problem set as well and not have such a myopic view in a lot of cases in the development cycle.

Everything you state is absolutely correct. You will have to refactor the code, and you don’t know, in your rush to get things done, what kind of third-party risk that’s injecting into your environment. Dealing with that later might be another fun problem to deal with that was completely unanticipated.

I hope the folks who are listening can bring that up if they’re involved with these programs. Incorporate more DevSecOps up front. Do much better planning up front. It may extend the timeline slightly, but the net result is going to be a much shorter market run and a much longer lifecycle in the market.

Josh Mason: And if the SEC rules come through and the president’s cybersecurity strategy comes to fruition with teeth, then software producers might be held accountable for pushing vulnerable code.

Manoj Tandon: That is going to be very interesting. What’s your opinion on that?

Josh Mason: I’m a big fan.

One of my first extra duties after I learned how to fly the C-130—you go through pilot training, and you’re 100% just flying. Then you get to your squadron, and it’s like, “Okay, cool. Now that’s going to become 10% of your job. The other big chunk of your job is going to be working in an office, making everything else work.”

I went off to Aircraft Mishap Investigation School and learned how to run safety investigations for plane crashes. I went through their course, which included looking at lots and lots of remakes of footage, black box audio that’s been put with graphics, and then going out to sites that they have at the school and looking at carcasses of planes where the red on it is someone’s blood.

Realizing that if we don’t take lessons learned and apply them, nothing is going to occur. Thirty or 40 years ago, planes were not as safe as they are now. There were not the regulations that were in place. Even with plane crashes, it wasn’t painful enough for airlines, carriers, and manufacturers to really dive in and make things safe from the start.

With the 737 MAX, we saw that recently. They followed most of the right practices, but the FAA had to step in and say, “Hey, no.”

Every plane over a certain weight has to be airworthy in architecture before it’s even put into design. Then before it’s airworthy, it has to be tested by the government. Then you can sell it to people.

We can make code and sell it now. I can put it on GitHub and anyone can get it and make themselves super vulnerable. Who’s responsible there? Is it them for trusting my bad code? Is it me for putting out bad code?

At some point, someone’s got to be responsible. If we can put teeth on it in the right place so that people care—because they’re not caring about their breaches. Two hundred million to Target is still less than half a percent in ARR. They could have a few of those breaches a year and still not see any big change to their stockholders, other than fewer people showing up to their stores.

I think it’s good if things get some teeth on them.

Manoj Tandon: That would require a massive change. I don’t know, you’re probably way too young to remember, but way back when, there was this idea that we would switch to the metric system in the United States. We know how that ended up. We never really were able to make the switch, although it was a big government-imposed program.

This is almost like that because of the confluence of a couple factors. People are used to free. There’s a lot of free stuff out there. If they’re going to have to pay for all that, and because there would be a much higher cost of development, that would have to get borne by somebody. Who is that somebody? Does that change the free mindset? That’s an uphill road.

Josh Mason: Yes, but also look at this: 25 years ago, I had dial-up. Thirty years ago, I didn’t have an internet connection in my house. A hundred years ago, multiple people could not fly on an airplane because it had a small motor from a tractor.

Everything that we know now seems like such a big leap. But 60 or 70 years ago, we didn’t have highways that went from coast to coast. Is it going to be a big change? Yes. Can it be done? Yeah.

We’ve made these big changes before. They’re organic. They happen anyways. But if we want to see real change occur, it has to be pushed. Here’s the sad thing: it either gets pushed, or it’s going to get pushed in a sad way.

I was in high school when September 11 happened, and the world changed massively. The United States changed massively. Look at this pandemic. How much has changed in the last three years? Something so small. If we want to push positive change instead of waiting to see what naturally is going to happen, what fate is going to bring us, I think that’s a good idea.

Eventually, change is going to happen. If we can plan for it, massage it, and manage it, it’s better.

Manoj Tandon: And get people to go along. People are so resistant. You’re right. But you look at 9/11, that was imposed on us. You look at the pandemic, that was imposed. Now the outcomes of those things are here to stay.

I don’t see everybody ever going back to the office. Some people will, but work from home is going to remain a real thing. People not having to fly was one of the best things. I used to travel so much. It’s wonderful not having to get on an airplane. Zoom is great. There are still reasons to do it, but it’s a lot less than what it once was.

That was imposed on us by an external force majeure. Trying to get people to do the right thing—I’ll tell you what, run for office, Josh.

Josh Mason: No, I like to sit in lofty towers and be a teacher and instructor.

Manoj Tandon: It’s a great concept that I agree with, but wow, it’s like getting people to eat right. Good luck with that.

We’re already at the hour. We didn’t even get through everything. We’ll have to have you back. I do want to give you a chance to plug anything you’d like. The floor is yours for this last minute or so. Any appearances, books, blogs, whatever you want to plug, please go ahead.

Josh Mason: Thank you, sir. I’ll do it quick.

I run a couple nonprofits: Cyber Supply Drop and New Village. They’re both .org, and they provide resources. Cyber Supply Drop does giveaways, prizes, free vouchers, and training for individuals who are trying to get in. It’s a way of pushing people to do a little bit of work to help themselves, and then rewarding them for putting in the work.

It can be getting them to start posting and sharing things on LinkedIn that are going to benefit them in their careers, but also now they might get a free voucher for Security+, like we did recently, or Security+ training directly from an instructor.

A couple of my winners just got their books that we sent to them in the UK yesterday.

New Village is around resumes, LinkedIn profiles, branding, and where to find resources. I’m a big fan of free training, and there’s a lot of good free training or cheap training out there. I made some of it myself.

The other thing I wanted to talk about: I’m going to be speaking at Hack SpaceCon at Kennedy Space Center on the 15th. If anyone reaches out to me, I can help them find out if there are discounted tickets or help them connect and find out what free training is happening.

The 14th is a whole day of free training that includes pen testing, threat hunting, and a lot of neat stuff for free.

Manoj Tandon: Is that in person? So they have to be at Kennedy? That’s a cool place.

Josh Mason: It is. Then I’ll be talking about what cybersecurity teams can learn from the aviation and aviation safety community. A lot of what we talked about earlier.

Manoj Tandon: Well, there’s a lot there. Cascading failures is a topic in itself.

I’ll tell you what, Josh, it’s been fantastic having you here, and we’d love to have you back to talk about exactly that. The free resources—I read an article on LinkedIn that you had posted that had some really good insights for people trying to get their Security+ or get other cybersecurity training. I’d love to have you share that with the audience and resources. I think people are hungry for that, and you’re doing great work. Thank you for doing what you do.

Josh Mason: Thanks. Those posts that you just mentioned with resources are featured on my profile on LinkedIn. So if anyone’s listening, they can go to the show notes and jump to my LinkedIn or to New Village. I have links to all those resources there as well. I’m trying to make it as easy for people as I can.

Manoj Tandon: Sounds fantastic, Josh. Thank you so much. It was a pleasure having you here, and I hope to see you again soon. Thank you.

Josh Mason: It was great. Thanks, Manoj.