Diana Initiative 2021-Julie Carres-A N00bHacker's Guide to the Infosec Galaxy

### Overview In this Diana Initiative 2021 session, speaker Julie Carres—a math teacher with an art history degree who transitioned into infosec via DEF CON and was accepted into the SANS Women's Immersion Academy—delivers a comprehensive guide for beginners ("noobs") looking to learn information security. Emphasizing that reading dense technical books late at night after work can be exhausting, Carres advocates for gamified, hands-on learning aligned with personal learning styles to keep self-study engaging and sustainable.

### Key Topics - **Learning Archetypes (Alice vs. Jill):** Carres categorizes learners into two profiles based on how they explore topics: - *Alice (Deep Dive Specialist):* Tends to go down rabbit holes, demanding to understand underlying mechanics completely before moving on. Alices benefit from resources that push them to broaden their scope across multiple disciplines rather than getting stuck on a single challenge or topic. - *Jill (Broad Generalist):* Curious about everything, skims many topics, and is quick to experiment, but risks lacking deep foundational knowledge. Jills benefit from structured curriculums that force them to narrow their focus and follow paths through to completion. - **Capture the Flag (CTF) Platforms:** CTFs provide structured, low-pressure, gamified learning environments that cater to both archetypes: - *TryHackMe:* Features guided learning paths (such as complete beginner tracks, web security, and offensive pentesting), succinct modular lessons, and in-browser VMs/attack boxes. - *PicoCTF:* Created by Carnegie Mellon, offering jeopardy-style challenges covering cryptography, binary exploitation, web exploitation, and more across varied difficulty levels with built-in web shells. - *OverTheWire:* War game site (notably the Bandit track) focused on practical Linux command-line skills, SSH, and search methodology using a repetitive, scaffolding pedagogical approach. - *SANS Holiday Hack Challenge:* An annually updated, MMO-style puzzle environment with avatars, narrative quests, and community write-ups available after winners are announced. - **Learning to Code:** While not every infosec role requires development experience, familiarity with scripting, web technologies, or reverse engineering concepts is highly valuable. Recommended pathways range from academic courses (edX CS50, Coursera Princeton Java, Georgia Tech Python) to gamified interactive tools (Scratch block coding, CodeCombat RPG, and Codecademy). - **Crypto Challenges & "Chall" Sites:** Static challenge resources like Rank.org, NewbieContest.org, NotPron, and US Cyber Command Valentine's Day crypto challenges provide puzzles that test mathematical reasoning, cryptography, and problem-solving without easily accessible answer keys. - **Projects and Family Engagement:** Practical suggestions for applying skills and demonstrating aptitude without a formal tech resume include writing technical blog posts/write-ups, setting up home lab hypervisors with VulnHub machines, configuring a network-wide ad-blocking Pi-hole, and engaging family members through Scratch Jr, cryptographic scavenger hunts, or CyberStart America.

### Technical Details - **CTF Fundamentals:** Digital security competitions revolving around locating hidden text strings ("flags"), typically enclosed in curly brackets and often written in leetspeak. - **Linux CLI Mastery:** OverTheWire's Bandit builds essential terminal skills incrementally (connecting via `ssh`, exploring directories with `ls`, finding files, inspecting permissions) where the output of one level serves as the credential for the next. - **Home Networking & DNS:** Running a Raspberry Pi-hole serves as a hands-on project to learn local DNS configuration, network traffic troubleshooting, and basic server management.

### Takeaways - Align study resources with personal tendencies: "Alices" need structure to broaden their perspective, while "Jills" need curriculums to maintain depth and focus. - Gamified platforms and write-up walkthroughs provide safe, accessible environments to reverse-engineer solutions when stuck. - Developing a technical blog and documenting CTF write-ups or hands-on home projects acts as an effective portfolio for career transitions into infosec.