Threat Hunter Girl

by: Nicole Hoffman

I enjoy attending conferences as much as I can because they provide opportunities to expand my knowledge base and create long lasting friendships. Sure, there are also networking connections, but I live in a small town and there are not a lot of techies. It is really nice to expand my network of peers I am able to nerd out with on topics such as threat hunting and malware with.

Speaking at a conference, however, was not something I ever thought of pursuing. I know its cheesy, but it was not until I saw a woman speaking at a conference that I was truly inspired to go down that path. She spoke with such confidence and grace. She made it look easy. After her presentation I felt an overwhelming amount of gratitude that she took the time out of her schedule to share her knowledge and give back to the community. It was at that moment I knew I wanted to follow in her footprints.

One year later, I decided to submit a talk idea for my first Call for Papers (CFP) for a virtual conference-GRIMMcon. Honestly, I think I was less afraid to submit due to the fact that it was a virtual conference. I am sure I would have gathered the courage to submit to an in-person conference eventually, but I am grateful for the number of virtual conferences being organized by the community during the current pandemic.

I went to the CFP submission page and realized I had no idea what I was doing. After reading blogs and watching several videos providing tips on how to nail a conference talk, I was still left with so many questions. With the help of some peers, I was able to get through the submission process. One of the tips I had read was to submit early and often to better your chances of being able to give your presentation. So, feeling motivated, I submitted my CFP to three virtual conventions all at once. Low and behold, all three were accepted! I was now going to be giving not one, but three talks! What better way to learn than to just dive in head-first, am I right? 

After my first three talks went really well, I had a flood of people contacting me thanking sharing my story. I remembered that gratitude because I had felt it at that conference talk that had inspired me one year before. Needless to say, I was hooked. When I heard there was going to be a GRIMMcon 0x2, I knew I had to submit a new talk idea. I went through the submission process and was once again blessed with the honor of speaking at my fourth conference.

I learned a lot along this journey these past few months. While I had a lot of help from mentors and peers, there were a lot of things I had to learn on my own. I would like to make this process easier for others who are interested in speaking at a conference. So, without further ado here are twenty things I learned after my first four conference talks.

1. Write your bio in the third person

I had never written a bio, so I found it particularly difficult to talk about myself. I looked at some of the bios of other conference speakers at previous conventions to see how they fashioned theirs. It seems there is an unwritten rule that you refer to yourself in the third person within your bio. So instead of saying “I am a Threat Research Analyst” you would say “Nicole Hoffman is a Threat Research Analyst”. 

Another thing I noticed looking at other people’s bios was that they seemed really impressive. People had 10-20+ years of experience with multiple degrees and certifications. The impostor syndrome was taking over, and it was taking over fast. I remembered a TED talk I had watched by Brene Brown titled, “The Power of Vulnerability”. I realized I cannot control my age or the fact I only have a few years of experience in the field. So instead of being ashamed of it, why not own it?! No matter if you have been in the field for ten days, weeks, or year, own it and wear it with pride! 

“Being vulnerable is our most accurate measurement of courage.” –Brene Brown

2. Abstracts are for audience members, Summaries are for Organizers

With any form of dissemination, it is important to keep your audience in mind. The CFP abstracts should be written to attract and inform audience members. It should be short, sweet, and to the point. Now is the time to add suspense and curiosity because that is what is going to attract audience members to attend your talk. Although I did not do this in my first abstract, I personally like to mention who the intended audience is in my abstracts. For example, if you are currently a threat hunter, interested in getting into threat hunting, or if you just enjoy a good story then this presentation is for you. 

The summary is for the conference organizers to better understand your talk in depth. This can be a few paragraphs or an outline as long as it discusses a brief overview of the points you would like to make during your presentation. Organizers want speakers that have well-thought-out ideas. I am fairly sure during my first few submissions I wrote out a few paragraphs of what I wanted to cover. When I submitted my second talk idea, I decided to create an outline. I forced myself to map out the entire talk which I liked a lot better. Once my talk was approved, I knew exactly how to proceed, and it seemed as though a lot of follow up processes were streamlined. 

Find out what works for you and before you know it you will be cruising through CFP submissions. As an example, I have provided the abstract of my C-Suite Talk.

ATT&CK on C-Suite: Cheat Codes

“The topic of cyber security can be difficult to discuss with the executive branch of an organization. Thus, the thought of presenting the MITRE ATT&CK ®  framework to an executive let alone an entire C-Suite can be a daunting task. Fear not, for I have the cheat codes to make even a novice become triumphant in this endeavor! 

If you are contemplating the idea of implementing ATT@CK, preparing a pitch to management, or are a cyber security consensus executive yourself, then grab your laptop and open that digital notepad because this talk is for you. Get ready and leave the technical jargon and confusing acronyms at the door. The key to successful dissemination is knowing your audience.

Executives care about are the 3 R’s: Risk, Revenue, and Regulation. In this presentation, I will be giving (you) the audience members the necessary tips and insight needed when creating an ATT&CK implementation plan that targets executive management. These tips will cover all aspects that appeal to executive management such as: risk, revenue, impact, compliance, and regulation.”

3. It is ok to give the same talk more than once

This is more of a question I had when I started out. I wasn’t sure if there were any rules against giving the same talk at multiple conferences. The good news is that there are not any rules. Ok, I am not an expert, there might be some conferences with those types of rules, but I have yet to see them. I actually like it when others give the same presentation more than once because if provides more opportunities for people to get the chance to see it.

So ,don’t be afraid to start your public speaking career with a single talk that you can get comfortable with. It provides you with an opportunity to get more comfortable with the process without the added stress of creating multiple topics. 

4. Make sure you are aware of your time limit

Typically, you will know what the time limit is when you submit your talk. Depending on the conference, there are usually 30- and 60-minute talks, but some conferences will have lightening talks that are 15 minutes.

The talks I submitted were both for 30-minute time slots. However, not all conferences are the same. One of the conferences only provided 25 minutes for the talk with a 5-minute time period reserved for Q&A whereas the others provided the full 30 minutes for the presentation.

If you are chosen to speak at a conference, be aware of the specific time slot you allotted so you can time yourself when you practice. ALWAYS ALWAYS time yourself when you practice ensuring you are prepared on the day. There is nothing worse than running out of time.

When I practiced my C-Suite talk I kept going 5-10 minutes over. When I gave my presentation, I found myself speeding through the content. I ended up losing my place for a moment before slowing down.

Looking back, I wish I had practiced more so I wouldn’t be as concerned about running out of time. Time yourself, but don’t let the timer stress you out to the point you rush through. Stay calm and take your time. 

5. Avoid time zone confusion

If you are speaking at a virtual conference, make sure you pay attention to the time zone. If your talk is scheduled for 10 AM EST and you are in California, then your talk will be at 7 AM PST. You do not want to miss your own talk.

Most organizers are forgiving and understanding, but you don’t want all the work you did to go to waste. The organizers saw value in your presentation so ensure you get the chance to give the presentation. 

6. Story telling is useful

Story telling is useful in conference talks because you aren’t trying to explain something new that you are unfamiliar with. You are telling the audience about a personal experience that you went through and things you learned.

Some of my favorite conference talks of all time included some form of story-telling such as ‘How I Hacked XYZ’ or ‘Lessons Learned from XYZ’. A story is not needed, but it can be really useful especially when you are starting out. 

7. Start with an outline or an essay or both

When I was preparing for my first conference talk, I wasn’t sure if I should just add bullet points to my slides and just wing what I am going to say or if I should write an outline and expand upon that. In order to get all of my ideas out I decided to free write which is a method I use in writing to get past any form of writer’s block.

So, I wrote out my talk in an essay format that included my intro and conclusion. For example, ‘Thank you all for coming to my presentation. My name is Nicole Hoffman, and I am going to be giving a presentation on XYZ’. Once I had the talk written out, my slide deck was really easy to create. I already had ideas about things visualizations and animations. 

When I wrote my C-Suite talk, I started with an outline that I submitted as my summary. From that outline I expanded and made it a full essay. It actually ended up being about 10 pages. I knew I would have to cut some things out, but I did not want my hard work on the 10-page paper to go to waste. I thought why not make it into a white paper. 

Find out what works for you. Try different things or a combination to find out what helps you streamline the process and get comfortable with your content. If writing out a full essay seems like a daunting task, try starting with an outline and just expanding upon it. 

8. Do not read your slides

Never read your slides. The audience does not want this. You do not want this. If you are able to use a slide deck, remember the purpose of the deck is to give the audience something to look at while you are speaking. At times, it can also be used to show visualizations or animations to emphasize or compliment your talk. The key is to figure out what information is absolutely necessary for the audience to know on each slide. Some people like to use the notes section in PowerPoint, but I have ADHD so that does not work for me. 

Instead, I like to write out the key points on each slide. Instead of just reading the key points, I expand on the topics as I am talking and try to give examples as well. Remember, less is more. In my Fraud talk I have a few slides with a single word on it like ‘The Hunt’ and ‘Results’. This allows the audience members to know where I am in my presentation as well. 

Just remember, if you do end up reading a slide from time to time the audience will forgive you. The audience is way more forgiving than you would think. If you ever panic, lose your place, or end up reading just know that all speakers have gone through this. Take a deep breath, slow down and continue. 

9. Write a talk you want to hear

If you want to speak at a conference but are not sure what topic to choose think about what type of talk you would want to attend and then write it! I always love talks about threat hunting, so I wrote one. 

10. Practice Makes Perfect 

If possible, try to practice in front of someone or a group of people either virtually or in person. Encourage your practice audience to ask questions and make suggestions. If you are unsure who to ask, there is a large community of amazing individuals on Twitter that would be happy to take time out of their day to help you, including me.

At first, it might be awkward if you are not used to public speaking. This is normal. Everyone goes through this. I am here to tell you that you will make it through. It is better to be awkward in front of a practice audience than a real audience. Each time I have a practice run in front an audience I always get suggestions that I end up incorporating into my presentation. 

11. Don’t overdo it on the slides

My rough draft of my fraud talk was full of fancy animations and transitions that I was giddy about. However, when I would do a practice run, I found the animations and transitions distracted me or I would be talking and forget to click for an animation. Before I knew it, I was clicking through several animations to catch up to where I was. The only time I add animations now is if I am explaining a process. The other thing I noticed with animations as well as 3D objects is that it slows down PowerPoint a good amount. 

I spent more time on my slide deck than my C-Suite talk, and I felt like it showed. I spent so much time creating the graphics and backgrounds. If I had spent less time on fancy graphics and made my slide deck simple like my Fraud talk, I think my C-Suite talk would have been a bit smoother. So be careful spending too much time on your deck. Less is more and a well-thought-out presentation can be more valuable than a fancy deck. 

12. Get a good night’s rest the night before

You want to have a fresh face on the day of your presentation. I don’t know about you, but I tend to get cranky and absent minded when I am sleep deprived. It is also important to remember that giving a talk should be a fun experience and not something you stress over. I try going to bed early the day before a presentation. 

13. Do something relaxing during the day to calm your nerves

I was a nervous wreck the morning of my first conference talk. I tried watching the talks leading up to mine but it was just making things worse because I was comparing my presentation to theirs which you should never do. Instead, I had an impromptu dance party with my kids to loosen the nerves and take my mind off things. Find something that works for you. What calms your nerves? Yoga, Running, Dancing, Video Games? There are no wrong answers, just take some of your time because you have earned it. 

“My philosophy is that worrying means you suffer twice.” -Newt Scamander, Fantastic Beasts

14. Get a mentor or a friend to help you along the way

I was lucky enough to find an organizer as amazing as Grimm. Both GRIMMcon events had a new speaker track and an expert track. All of the new speakers were assigned a volunteer mentor to help them along their way. I was blessed to have one of the best mentors anyone could ever ask for Matt Carpenter (@Ma77Carpenter). He was so welcoming and helped me combat my impostor syndrome. I don’t think I could have done as well as I did without his encouragement. I am fairly new to the hacking world and was expecting to have to prove myself in a way. This was absolutely not the case with Matt. He ensured I absolutely do belong, and he took the time to read the hacker manifesto to me which is something I will always remember. 

I highly recommend participating in conferences that are designed for new speakers that provide mentors such as GRIMMcon. If you are speaking at a conference that does not advertise mentors, feel free to ask. Most organizers want you to succeed because they want their event to succeed which means they are probably more than happy to provide some assistance. If this is not an option, InfoSec Twitter is full of amazing individuals that are more times than not willing to help out a fellow peer. 

15. Share your slides after your presentation

Plan to make your slides available for your audience members to download after your talk. The best way to do this is to save your presentation as a PDF and share the PDF either through Dropbox, a blog, etc. You figure out what works best for you but let the audience know at the beginning and/or end of your presentation where and when your slides will be available.

16. Record your presentation if it is not already

Find out if the conference is going to be recorded and publicly available for public consumption at a later time. If this is not the case, I recommend taking some time before or after the conference to record your talk so that you can have it and share it at a later time with peers.

If someone was unable to watch the presentation live, it is always great to be able to access it later on YouTube or another streaming platform. I know there are some talks that I have gone back to and watched multiple times because they were either technical or just really enjoyable to watch. You will also want to remember this amazing accomplishment that you worked so hard to achieve. 

17. Have a backup plan or a plan a, b, and c

Plan for the worst. What happens if your computer crashes on the morning of the presentation? What happens if your ISP decides to go down 10 minutes before you go live? These, of course, are based on experiences with virtual conferences. However, although I have never given a presentation in person, I am sure there are many things that could go wrong.

I would like to save my presentation to a flash drive in PDF and PowerPoint formats a few days before the conference in case I need to change devices. I have heard that some people will record their talk and send it to the organizers as a back-up if something goes array. As an example, like an idiot the night before one of my talks I ran a bunch of Windows updates. The next morning something was not working correctly on my computer, and I couldn’t access the Internet.

I had to roll back or remove the updates I did the night prior. Then ten minutes before my presentation, my DNS decided to stop working. I had no plan B. It was almost a disaster, but thankfully my husband was able to save the day with two minutes to spare. Hope for the best, but plan for the worst. 

18. Ask questions during the dry run and/or mic check

A few days before the conference talk (if it is virtual) the organizers will reach out and do a mic check to ensure each speaker has a working camera and mic. This is also an opportunity for the organizers to make recommendations about what is seen in your background on camera. Don’t take offense at the recommendations, they are just trying to help make the background less distracting. It is not a personal attack on you. 

This is also a great opportunity to ask questions. Make sure you know what is happening on the day of. Do you have access to the green room? Does the green room lead to the conference webinar, or do you have to switch platforms? A lot of times I notice they will have a separate platform for the green room to do last minute mic & camera checks. I missed my first conference talk and was afraid to ask too many questions because I didn’t want to seem dumb. I am telling you from experience you will not seem dumb. Ask questions so you are confident on the day of the conference as to what is occurring and where you need to go. 

Note: The Mic checks are sometimes referred to as a dry run. This means they want to see you can click through your slide deck functionally without lag and what not. You do not have to give them your whole presentation. So, if you are running behind and don’t finish your deck by the time the mic check rolls around, do not worry. You have more time.

19. Provide a way to make the things you discussed actionable for the audience 

If you are presenting a solution, tips, or a how to talk try to figure out how to make the information actionable to the audience. You can provide links to GitHub with downloadable content or provide a separate list of step-by-step instructions for how to recreate what you did. This is not a requirement, by any means, but something audience members will really appreciate.

This might even be a summary page towards the end of your deck that puts everything together in a single location. You don’t necessarily have to go through it, but you can let audience members know its purpose and that it will be available on your deck. 

In my Fraud talk, I speak about some of the similarities between hunting criminals and whether they are committing financial or cybercrimes. I did not, however, have a lot of time to go into explicit detail how. Instead, I have a slide towards the end of my deck with a table that has the techniques I talked about with some open-source software they can use to perform each associated technique in. 

20. Kick impostor syndrome out of the room

Regardless of your experience, age, gender, or race you have something of value to offer the community. If your talk is accepted that means someone else already saw the value. People are planning to come and see you or virtually tune in. This means you already made it, and the stage is yours. It seems cheesy, but Matt (my mentor from my first talk) told me this and it really helped combat the impostor syndrome so I hope it will help you with yours.

Some of my favorite talks were people giving their first conference talks. You may hate it, you may love it, but you have a right to be there. So, leave the impostor syndrome at the door the day of your presentation and don’t forget to have fun.