Aelonius.net

Cyber Security - My origin story

2021-10-05T16:42:30+02:00

For the last 13 years I’ve been actively trying to get started in Cyber Security and Information Security as a whole. Over the years I’ve conquered many obstacles, both personal and professional, and as a result I landed a great job at one of the world’s leading Cyber Security firms, Fox-IT. We are hiring awesome people for really cool jobs by the way; check it out!

My journey to become a cyber security analyst started many moons ago. My dad got a computer early on and I ended up actively learning how to use it from the tender age of 2 years old. Back then, we had no Windows yet so everything we did was on an 286 with DOS and Norton Commander. But these computers were cool and I was into it a lot!

I remember being the envy of the class in 6th grade because I had a hard drive that could save a whopping 1GB of games! ONE whole freaking gigabyte! Surely this was the peak of what I could have! Oh boy… I was so wrong.

A few years later at the end of my high-school, I decided to follow classes at the ROC Mondriaan in Delft, for the course of IT Administrator. During this course, which was filled with silly pranks, I eventually found my passion for Security and my resolve to pursue it.

Aspiring IT Administrator

From 2005 to 2009, I’ve taken part in a course for IT Administrator at the ROC Mondriaan. For those unfamiliar with the Dutch system, the course was at an MBO level which translates roughly to the equivalent a trade school in other countries.

Originally I started in Delft; riding my bicycle through sunshine and thunderous rain to attend classes such as networking, hardware classes and things such as ITIL and Prince2 project methods. I am not sure how much I retained; our class was rather a rowdy bunch and pulled many pranks. A fan favourite in the classroom was for a handful of students to come in a little early and flip the power supplies from 220v to 110v before their “owners” would arrive.

If you didn’t check the power supply before booting, you’d hear a sudden and loud BOOM and you ended up blowing your power supply towards the scrapyard. That was the level of … education that I experienced in the first two years. Though; this was not the fault of the teachers. After two years (?) we left the Delft location for the new one in Den Haag where many shenanigans were had; alongside the one defining moment that I consider the start of my interest in security.

The Accountant's Hard Drive

One of the hardest things I found back then was to determine where I wanted my future to head. Sure, I was about to finish my trade school degree in IT Administration, but I wasn’t convinced this was the end of the road for me. I am rather ambitious and I wanted to follow up with an university degree.

But after 3.5 years of studying, I had no freaking idea what I wanted and it made me feel lost. Interestingly; this time also spawned the one story that I believe started my passion for my field. It’s also a funny anecdote about the neccessity of information security beyond “catching hackers”.

As some of you may know; I have a diagnosed form of ADHD that isn’t severe enough that it cripples me; but it can mess with my ability to focus if I am not paying attention to it. This “skill” is something I learned later in life, but during my studies at the ROC Mondriaan there was one teacher who was very much able to tap into my interests. Aside that, he was just genuinely a cool dude who loved what he did and could express that in a very captivating way.

One of the stories that the teacher, Martijn Rotteveel, told us was when he supported an accountant in need. I may not remember all the details correct, but the story I remember goes as following:

A long while back when the euro wasn’t a thing yet, my teacher was available for computer emergencies and support for others. One day, he got a call from a frantic accountant with a desperate plea for help. The harddrive of the accountant was completely broken; no back-ups were available and the customer had to send in their administration very soon.

“Sure, I would be happy to help but it’s night-time AND it’s the weekend so you’re going to be charged accordingly. Is that okay with you as it’s not going to be cheap?” - Martijn

It’s not very common people are willing to shell out that much money on a whim; especially back in the day.

“Absolutely; by all means I NEED this data!” - The Accountant

After confirming the details; the first triage was performed and the result was quite dreadful. The harddisk was so damaged that it could not be recovered with regular means, which would mean the customer lost all the data.

However; back in the day one of the new techniques that was being tested in Germany where the company would place the disk in a vacuum; replace the physical drives from the broken drive, put them in a new body and then make a copy of the data. Total estimated costs? 40.000 guilders; which would be about 31.000 euro today. That price did not buy you a guarantee however; there was a significant chance that it would fail.

As my teacher explained; the accountant had no break in saying “Go for it” when hearing the cost and luckily the procedure went along swimmingly. Total cost of an entire weekend in Germany, troubleshooting AND having the service performed by this company? Around 55.000 guilders ( 42.000 euro ). The accountant signed the document with a giant smile as he would’ve lost over 4.5 million guilders ( 3.45 million euro ) if that data was lost.

You can imagine that the accountant would always help Martijn with financial matters in the years afterwards with a giant smile; even if he would call them at 04:00 AM!

A story matters.

While fighting hackers is something that many people associate with security; I was initially driven by this story because it highlights the need for good data security procedures, including how to make sure that an incident does not get rid of important data!

Directly related to this, I found a course on Information Security Management at the Hague University of Applied Sciences that I enrolled for in Zoetermeer. In the next few years I’ve studied under the patient guidance of my professor Leo van Koppen; a man who has had more patience with me than I probably deserved at the time. I will probably write more on that time in the future and leave you, the reader, with this comment:

Your words and your actions influence people in ways that you could never imagine. Had I not met Martijn Rotteveel as my teacher and mentor, I would never have reached the dream job I have today.

For that, I say thank you.

Useful Tools for Cyber Security

2020-08-11T16:42:30+02:00

One of the most important things I found when I started my cybersecurity career is that having a good source of information is crucial. We live in a time where so much different pieces of information are available, that it is easy to lose track of the big picture.

This is why I’ve started to compile a list of useful links that I have/will use during my career in Cyber Security. Of course; only public tools will be listed in here. If you have a suggestion, please do reach out to me by tweeting at me.

Blue Team Labs Online (BTLO) is a gamified platform for defenders to practice their skills in security investigations and challenges covering; Incident Response, Digital Forensics, Security Operations, Reverse Engineering, and Threat Hunting.

Security Blue is a parent website to BlueTeam Labs and offers certification opportunities against payment.

CyberDefenders provides users with interesting, in-depth CTF-challenges to get new and existing professionals into understanding the mechanisms behind Blue Teaming.

Brim Security is an open-source search and analytics tool for network visibility, troubleshooting and security. It is similar to Wireshark in many respects, but unique in its approach on PCAP data.

Rangeforce Community is a training platform where users can prove their skills and take part in periodic CTF-challenges where they compete against other experts. This service is invitation-based; manual review of applications can take 2-3 days.

SoloLearn is a learning website where you can learn coding languages in short lessons. Offers a (temporary) free option.

Snaplabs.IO makes it easy to build, launch, and share cyber labs for cybersecurity training, research, and demos.

Penetration Testing Labs Collection is a collection of amazing self-learn tools by Aman Hardikar worth exploring!

A grand adventure in China

2020-08-10T16:42:30+02:00

Anticipation. One of the more scary emotions that yet is extremely pleasant. That fear of the unknown, the uncertainty of change and the desire to explore that new world or that one new thing.

Some people thrive on such anticipation, others turn into nervous wrecks. I find that feeling, the queasy hollowness in your stomach, absolutely fantastic. A feeling similar to that large drop in a rollercoaster, but then everlasting and continuous.

It is the 27th of August 2011, and I am standing at the precipice of a grand adventure, wondering what I will experience and how it will change me. I board a plane and for the next fourteen hours, I am stuck in a flying metal box towards a far away country and stay there for a total of 6 months.

My final destination is China. A country that has deeply intrigued me ever since I was young. A mysterious far-away nation that is so very rich in history that many things from China directly affected European life. A cultural powerhouse that had an unimaginable depth of rituals, beliefs, norms and values.

But because it is such a far away place in the mind of a child, I had never conceived the idea of heading there, until I had the opportunity through my studies. Early 2011, I asked my professor if it was permitted to do my mandatory internship within the United Kingdom. At the time, it seemed to be the place to be for my major in Information Security Management. But instead, my professor mentioned that there was a great opportunity in China. An opportunity where I would work alongside Chinese students in projects that required international cooperation.

I… was… hooked!

Some people might find it extremely hard to understand the perspective that I had. Here I was, looking at an opportunity in a country where the overwhelming majority of the people didn’t speak English, and where I had zero capability on speaking Chinese myself. But the way I saw the trip was that it was a once in a life time opportunity. An opportunity to learn about myself, about a different culture and the opportunity to have something wonderful for my future.

While I write this, even though nearly eight years have passed, I still feel emotional when I dig up those memories. I strongly experience a remnant of that wonder, combined with a pounding yearning to head back for a long time. From time to time, a single smell can give me a long flashback of the days I had there. A single taste or sound can trigger me to dive into that mental library. A time of pure happiness and wonder.