2025 - Rob Fuller - Lessons Learned from Doing Things the Hard Way

### Overview In this presentation, Rob Fuller shares personal stories, career milestones, and hard-earned leadership lessons gathered across roughly 20 years in cybersecurity and eight years in the U.S. Marine Corps. Rather than focusing on complex technical exploits, Fuller highlights the value of resilience, work ethic, interpersonal communication, and embracing failure. By recounting his own missteps and unconventional decisions, he encourages practitioners and leaders to challenge common industry assumptions and pursue personal growth.

### Key Topics - **Ownership and Determination:** Fuller emphasizes that no one will care about your personal or career goals as much as you do. Drawing on an early memory of his father forcing him to apply repeatedly for a gas station attendant job at Arco, and later applying to 300 jobs in two weeks after being fired from the U.S. Senate, he argues against waiting for ideal titles or relying on others to advance your career. - **Marine Corps Discipline and Humility:** Reflecting on his military service, Fuller discusses repeatedly receiving "page 11" administrative punishments due to difficulty following rules. He notes the importance of the 11 Marine Corps leadership principles and recounts an incident where, as a tier-1 analyst, he overstepped boundaries by improperly sharing and uploading incident details, nearly sabotaging an investigation led by Christopher Nutt. - **Challenging Industry Dogma:** Fuller critiques several pervasive assumptions in cybersecurity, such as the belief that one must live and breathe information security 24/7 or maintain an extensive home lab to excel, citing colleague Matt Saburn who excels in application security without touching a computer outside of work. He also addresses collaboration, stating red teams and blue teams are on the same side and that claims of "cheating" or theoretical posturing in reports should be abandoned. - **Leadership, Communication, and Strategy:** Fuller underscores the mantra "short steps, long view" for long-term career planning, detailing how he systematically acquired credentials (MBA, CISSP, CISA) to work toward executive roles like CISO. He also stresses the necessity of clear communication, noting that "unspoken expectations is premeditated resentment," and calls on companies to actively train their managers.

### Technical Details & Industry Practices - **Report Writing & Scoping:** Fuller criticizes pentest and red team reports that speculate on unproven impact (e.g., claiming one "could have deleted all databases"). He advises either demonstrating real impact within the rules of engagement or modifying future scope rather than complaining about constraints. - **Attack Surface Reduction (ASR):** Fuller advocates for white-box attack surface reduction engagements over drawn-out stealth exercises, emphasizing that real organizational value comes from finding root causes directly rather than prioritizing evasion. - **Active Directory and Infrastructure:** Briefly citing past operational mishaps, Fuller notes how adding certain DNS entries into Active Directory domain controllers can break enterprise environments, reinforcing the adage that infrastructure issues frequently tie back to DNS.

### Takeaways - **Outwork and Persist:** Success often comes down to work ethic and determination rather than raw intelligence; be willing to take any job or role necessary to move forward. - **Communicate Expectations Explicitly:** Boundaries and expectations must be actively shared to avoid setting teammates, leaders, or partners up for failure. - **Embrace Failure as Learning:** Failure is central to the hacker ethos. True learning occurs when things break or do not go as planned, making humility and openness to feedback essential for both practitioners and leaders.