Simon: Got it. I am coming to the very realistic conclusion that I hate computers. How about you?
Alex: For years, years.
Simon: Right. So I have an idea for today and I’ve set recordings starting. So seeing as there isn’t a responsible adult in the room because Christa isn’t here, I thought we could go a bit free form and go down that route. So, in her fabulous methodology, she does an introduction at the beginning.
So I’ll crack on with that, which is welcome to the Forensic Focus podcast. We are your hosts today. Christa’s not with us, she’s off doing exciting things at DFRWS in the US and is also going to take a bit of leave after that, which is well deserved. She’s an incredibly hard-working lady. So Alex and I are here to shoot the breeze today without adult supervision and we’re going to crack on.
Alex: Which just means no script for us, really.
Simon: No scripts, no topics, no clue what we’re going to talk about, but I’m excited.
One thing I did notice is that for any listeners that weren’t aware, apparently we’re on Spotify, which I had no idea about. There was a comment from LinkedIn about our introduction, which came out sort of on Monday this week for us. And by the time you listen to this podcast in future, if you’re listening to it probably about four or five weeks ago because we have…
Alex: Yeah, we got, we did get told to make evergreen content. So this could appear now between now and like 2040.
Simon: Yeah. By the way, we are your new co-hosts. Yes, so if you’ve not met us before, so yeah, we’re on Spotify. And somebody has actually subscribed to the Forensic Focus podcast. So we have at least one listener and that’s great apart from us, or you and Christa listening back to it, ‘cause I refuse to hear my own voice played back in my headphones.
Alex: Yeah. I think if there’s definitely a listen count, it’s just me re-listing to podcasts being kind of cringing at my own voice, and picking up errors that I make all the time, which Christa has promised that she will try and edit out more which I’m very thankful for, which will be great.
Simon: Yeah, so she’s going to love this. I’m slightly nervous because I went into court on one occasion, and I was scheduled to give evidence. I didn’t in the end. And then the prosecution barrister came up to me and he goes, “Oh Mr. Biles, it was really great to see you. I’ve been watching the videos of you on YouTube and I’m really interested to get you on the stand,” and I’m like, “Fuck, what?” (Sorry, that’ll probably be bleeped out by the way.)
What did I say? What was it that I’d said that he was so interested to cross-examine me about? And occasionally I’ve been perhaps slightly more critical of the prosecution cases than I should have been perhaps in some conversations I’ve had. I know I’ve cherry picked the worst ones to talk about because that’s what’s entertaining.
But yeah, so I have a slight fear of the future of things that I may say on this podcast coming back to haunt me on the witness stand, so…
Alex: Yeah, and it’s always a bit of a roller coaster ride. ‘Cause I have the similar feeling, like, whenever you get up to do a presentation, you know you haven’t prepared well enough for it and you’re doing it, and you’re like, “Oh, this is the worst presentation that I’ve ever done in my life.”
And then it finishes, and you have that endorphin release of, “Thank God that’s over.” And then you either get your marks back if it was an assessment, or you rewatch it back or re-listen like I do with the podcast and I’m just like, “What was I on back then? Did I just have three shots before I started that and thought that that was a good idea?” But yeah, we’ll see on this one.
Simon: We’ll see on this one. So in the day-to-day for you as an incident response, how much interaction do you end up doing sort of giving presentations to our customers?
Alex: Yeah, so I guess because I’ve shifted away from I guess, incident response a little bit, when I was in incident response, it was quite a lot, so it took up huge amounts of my time to investigate and collect all the evidence.
But then the presentations were like, it’s different from when you’re in university or like you think back to school and you think back to public speaking and you have this fear of just having to do a public speech every year when you’re at school.
Whereas when you’re in the technical field and you’re doing it, you kind of don’t have that fear because you’re so intimate with the knowledge of what you’ve just looked at. So, and you get to a point where no one can kind of question that and if they do, it is a really good question.
And you’re like, “Okay, I forgot to mention that. But here’s the evidence that I haven’t, and here’s what I have for you.” But it doesn’t feel like it’s public speaking anymore. It doesn’t feel like it’s a presentation because it’s, you’ve lived that for the last two weeks and you get to it and you’re like, “Okay, I can’t stop telling you about all the stuff that I want to tell you about” that kind of thing.
So I’ve definitely shifted away from that. So I’ve shifted my focus, I guess, presentation-wise to more training delivery. So the stuff that I do now, I try and create training content and I try and record it and it takes me way too long to record it, because I kind of will listen back to myself or watch back and I’m like, “Oh, that was terrible. And I have to rerecord that piece.”
And I’ve learned tricks over time to make sure I can have content that I can cut and replace really easily. So the best way to do that is not to video record yourself. So hot tip for anyone who wants to record training material: voice is so much easier to edit than video content. Yeah.
Simon: I’ve heard that, and I’m not good at this and, you know, you guys listening back and probably picking up on this more, but you need to be really careful not to run your words together so that you can go in and cut sentences in the right places to make it work. When you are recording, do you have a screen reader? You know what I mean, prompt or auto cue? That’s the word I’m looking for, cue.
Alex: I do. So it depends on the content. If it’s like me trying to tell facts or I’m trying to get across a very complex argument or complex procedure, I will have like, not a screen reader, but just like a Word document.
Again, ‘cause like for my training materials, I don’t record my image. So it’s just whatever I’m training on and my voice. So I don’t have to worry about not looking at the camera or like looking off to the side, that kind of thing.
But then if I’m kind of demoing content, it’s the easier version of a live demo. So you can kind of make mistakes and when you do make mistakes, I kind of pause if I make a mistake and make sure I’m quiet while I’m figuring it out, because when I’m editing and it’s very easy to see where I’ve gone quiet, because there’s no jumping in the sound when I’m editing.
So it’s very easy to go back to that point and go, “Oh, I’m back here.” Whereas I used to talk a lot to myself while I was trying to troubleshoot and that was just like, I was like, “Oh, I don’t know where.” I can understand why they use those clappy things in movies. I don’t know what they call, but, you know, they, they come in and they like go, and that sound bite is for them to be like, this is where we cut. I almost need a mini one of those, or a maraca. I could use one of them.
Simon: Yeah, next one we do with Christa, I’ll bring a maraca, that’s it. When she has the editing points, I’ll just sit here and shake a maraca occasionally.
Alex: But what about yourself? Like, you used to well, I’m not sure whether you still do teach, but I used to teach at least.
Simon: Not, not at the moment. I’m hoping to go back into teaching in another university placement in six months, 12 months’ time, depending upon how things work out there.
No, I mean, I taught live in front of a studio audience. Although I have to say, I mean, there were huge issues for me over COVID. I used to go along to Warwick near Coventry in England, stand up in front of a class and talk to them, and you can see, a little bit at least, when people are looking confused or you can see that what you’re talking about is sinking in.
And then we went into COVID and the university wasn’t enforcing the idea that they had cameras on. So you were talking to, at best my first-year class, they’d all decided that they were going to have avatars of frogs. So all of their Teams’ images were of different frogs, which was great and great fun and they persuaded me to change mine. So my university avatar for the entirety of the COVID season was a frog sitting on the log. Anyway, but still…
Alex: Just quickly, talking about rebranding, I have a perfect image for this episode. So we’re set talking about frogs and we need to release this on a Wednesday for this to work.
Simon: All right. Okay. I’m sure that can be arranged. We’ll talk to the powers that be. And I’m going to say, but at worst, it was just those, you know, the standard Teams set of initials. And you would sit here and we did, you know, the way the lectures were done is this that we were given three hours.
Okay, we break it up with exercises in the middle of that, but I’m sitting here like I’m talking to you and there’s a conversation, I’m sitting here, just been talking and talking and talking to emptiness with no feedback, no understanding of whether they’re getting this or not, whether they’re even there.
You know, occasionally I would try and get interaction and you could tell the usual suspects. The people who were paying attention, were the ones that always responded when you said, you know, “Can somebody let me know that you can hear me?” even, you know, and it’s a bit of a shame, but in sort of in the last sessions of teaching, it was back in the lab and it was great, it was really nice, and it was there.
But no, I don’t script. I tend to have slides, which give me a good sort of overview of the material I’m supposed to be covering in the session. Because obviously we address it on a topic-by-topic basis.
The thing is though, is that I tend to do them out of order in my head cause the slides are behind you, and I start talking and I was going to say, I’m a terrible pacer. I can’t sit still. You can probably tell. You know, I keep moving here.
It’s just, I’m a fidget, but when I’m talking it’s great fun, cause I’ve got a, not a Fitbit, it’s a Garmin watch that tracks my steps. And I can tell the days that I’ve been lecturing because my step count quadruples on a given day because I literally, I just pace up and forth across the lab in front of the students and keep walking backwards and forwards.
But it means inevitably, when I need to change slide I’m on the opposite side of the room from the space bar on the computer to walk back over and press it. And also I can’t see what the next slide is and all of that fancy stuff.
So I usually talk and then I go either, “Oh, we’ll talk about it in a minute.” And the slide comes up in about, you know, 15 slides’ time, or I’ve covered off the things when I get to a slide and go, “Oh yeah, we’ve talked about that already.”
Sort of skip through six slides like that. I like doing it this way. I mean, on the one hand, it means that it’s kind of less preparation work. So there’s not the sitting down, the writing the script and being prepared in that regard.
But actually, I heard a truly amazing public speaker, a guy who — he talked on technology, the history of technology, in fact, and it was fascinating. And he was so slick and so good and I listened to him and I thought, you know, I really want to be like that. I really want to get to that stage, being that good.
And then I heard him talk again and he said, word for word, exactly the same thing. He gave the same speech more than once to different audiences.
And on the one hand, you know, it was a great speech and all of that, but I realized that actually, and, you know, with due respect, the guy’s, you know, an expert in this field, but he was a one trick pony when it came to public speaking. It was like that.
But, you know, I was really excited to hear what his new lecture was going to be. And although the title had changed to fit the audience and the event, the content was 90-95%, the same. There was only 5% that had actually been edited.
And I found that hugely disappointing, whereas I think the way that I like to do it involves, okay, arguably making it up on the spot, I’m better prepared in court than this, I hasten to add.
But for lecturing, you’re live, you’re there, you’re interacting and you’re listening to the feedback of the audience, whether that’s visual confusion in what’s coming to you or actual genuine questions, and then you tailor your message to who you’re talking to. And I think that’s a much more honest way of doing it.
And I think certainly from a student perspective, there are maybe students who are listening to this who wish to disagree, but I think that it’s a more practical learning experience for them. They get to hear something that is more tailored to them.
I know, talking to my own children about their university experience, they are very unhappy when a lecturer stands there and reads off the slides when they might as well have just sat at home and read the slides themselves. And yeah, they’ve gained no additional information.
Yeah, I go off on a tangent, yes, I’ll talk about something different or follow off on a question and maybe we wouldn’t cover all the material we’re supposed to in that given lecture and we move it around between different lectures or whatever.
But actually, there is an interaction that happens there, which doesn’t happen if you’re just reading from slides. And given that certainly for me learning, I need to be able to interact with the material. I’m going to assume the same of my students, so…
Alex: Yeah, I suppose like, in that scenario, like, was that guy a lecturer as well, like at a university or was it just kind of like a…
Simon: Yeah, no, he was a senior lecturer.
Alex: Yeah, okay. Cause I guess, like, it also depends on your audience and how the material’s delivered. Because universities, I would say, are definitely meant to be more collaborative between the students and the lecturers.
And that should be more of a natural conversation almost particularly for your more senior years as you’re going through uni. Like, first year, you can kind of imagine the lecturers would probably just have the same content.
And I know, like, I had a lecturer in first year and I was always laughing. Like, he always had such great jokes, and then in my third year I was a tutor for the class and I was like, just in the lecture and I just remember it was very similar, but he told all the same jokes and I was like, “Oh, okay.” He just must get a kick out of this, that he can get a laugh every single year from telling like the same hundred jokes over a semester, because he has a new audience every time.
So unless someone fails and has to resit the course I’m sure, and then they’re probably sitting there going, “I will never fail another course in my life because of this.”
Simon: My issue is that at one point I was teaching a master’s course on forensics and a third-year undergraduate course on incident response and forensics, pretty much simultaneously. And I just got confused about what I’d told each class, because there was the material, which was one thing, and I knew where we were in the lectures, and then I was like, this story happened and I started talking about it and I was like, “Did I tell the third-years that? Or did I tell the master students that?”
And I was sort of like asking people, “Did I say this before? I remember saying it, but was it to you?” You know, so yeah, I have sympathy for that. I think there’s a bit of an issue of, I don’t know, it’s an interesting question actually. How many jokes does one person actually know anyway? You know, I probably have a repertoire of about a hundred jokes if that, that I would roll out to people who I thought were a new audience.
Alex: Yeah, I do get it. Like, when you’re presenting, I find it an interesting thing in incident response and in the cyber industry, when you have so much of your work was half remote and then the pandemic happened and we kind of switched to fully remote and the different cultures from particularly when you work for an IR company or a vendor from outside other organizations, what their cultures are like with cameras.
Because especially coming from the outside, like, I always come on with my camera on. And that’s just something that I’ve always done. Like, I picked it up at the last place I worked at. I think it’s a level of etiquette and it’s a level of you’re engaged. Particularly for someone who’s had an incident, it shows that you’re invested in their situation at the moment.
And then sometimes like, people would then be like, “oh, okay, I’m going to either turn my camera on,” or they’ll be like, “oh, my place is a mess at the moment. Like, we just had an incident, I’m sorry.” Like, but then later on they’ll turn on their cameras.
And even this, like, I think body language is very hard to read just over camera. And I find job interviews really weird, like over Zoom and Teams these days, because you can’t read your interviewers, or if you have multiple ones, like, the person who’s talking gets highlighted and they’re the big image, but then anyone who’s in the background and kind of get shifted into smaller images. So it’s hard to read the room’s body language when you are there.
So yeah, and like I always find it horrible when people like all the people have their cameras off and I’m just the only one. And I’m like, “Are you guys judging me? Like what’s happening? I can’t tell whether you’re engaged. Like, did you just hear what I said? Are you trying to talk or are you on mute? ‘Cause I can’t tell, ‘cause I can’t see your mouth moving.” kind of thing. So that’s always super difficult to deal with, I think.
Simon: Yeah. I’m trying to think what my default is actually. I think generally speaking, yeah, if I’m going to deal with a customer or a colleague, you know, the camera is generally on. I think there have been sort of, I did some slightly larger project work in security during the pandemic. And there were again, 20-30 people sitting around a virtual table.
Alex: When it’s classes of thousands, it’s different, I think.
Simon: Yeah, and I was definitely turning my camera off for that, but actually part of it was to save the bandwidth because, you know, my son, my wife were both working here, also doing Teams meetings.
And to be honest, you know, when you’re saying nothing and just sitting and listening, there’s no point in saturating the link when they were, you know, actually relevantly using their cameras and being engaged more.
The one that got to me is that obviously you know, you and I were using Zoom at the moment. I mean, I use Teams, but the blur, the background so that you can’t see the mess behind me is fabulous. I’ve given evidence in court using their systems and you can’t blur the background, so I have a pop-up photographic screen.
It’s not a green screen, it doesn’t actually do a green screen, but it’s a sort of neutral background that will sort of come up and fit behind me. And I was angling the camera so all you could see was me sitting in front of basically a studio backdrop. So that was quite a good one.
But I see now that they print ones that look like bookcases so that you can put yourself in front of what appears to be an intelligent bookcase as opposed to…
Alex: Alright. Yeah, I didn’t even think that’s like a good opportunity to come for some people out of the pandemic, I guess, to make some money by printing these backgrounds and selling them. Cause I’m sure they wouldn’t be cheap for such large prints.
Simon: No, no, no, not at all. I mean, even a plain one was a hundred and something pounds, so…
Simon: So yeah. My son bought a green screen blanket at one point because I’m going to say it was something like 12 quid off Amazon or whatever it was; it wasn’t expensive. But they were doing sort of the staff team building stuff. They had a drinks evening or whatever, and they were supposed to be sort of fancy dress. It must have been sort of Halloween or whatever. I mean, he just sort of draped this green screen blanket around his shoulders and just went as a disembodied head for the entire team of this, which I thought was genius.
Alex: When is a formal head?
Simon: Yeah. So…
Simon: Yeah, I like that, but yeah. How are we doing for time? Cause, oh, that’s right, we’re still good. Plenty of time. So, you know, in terms of creating your presentation materials, what are you using? Are you using any particular tools or is it just sort of open source stuff or…
Alex: Ooh, good question. Yeah. I try to use the easiest tools ever, so I don’t have to have a high learning curve. So to record, I use OBS. For that I use, I think it’s called, let me have a quick look, Xsplit Vcam, which, I watched some YouTube videos on people recommending programs use to record training materials or streaming and that, and I was on my work laptop doing this and this lady was giving all this advice and she said, “Use XSplit BCam.”
And I was like, “That sounds like a porn website.” And then I was very worried Googling that. And it was only because I saw her use it and it had it in the title. And then I was like, “For sure, I’m going to Google this and porn will come up just because of the internet.” I didn’t look past page one of Google, but it was all that program. So I think I’m safe.
The other program that I use to then edit is Video Pad Video Editor. So I ended up, that’s the one thing that I did purchase. So it was fairly cheap. I think it was 40 something dollars, maybe, about $50. But that just enabled me to export with no limit to size.
Because I was running into that issue where it was wanting me to keep videos for the free version under, I think like 12 minutes. But some of them with examples and training stuff, like I think the longest video I’ve done for training is about 48 minutes after all the cuts.
Like, pretty, pretty simple three programs and I cut in like a title slide and an exit slide and I went and found some like royalty free music. And I had like a little intro music that just fades into me talking.
I finished it and I was like, I feel like a little kid doing like a macrame art piece. And I kind of take it to my boss and I’m like, “Look what I did.” And he’s just like, “This is amazing. Like this is, this is so good.” He was just like, “Can we share this with customers?”
And I was like, “Yeah, like it’s kind of for them.” Like, I don’t think, because we have like a professional marketing team for the company that I work for. And we’ve recently done a whole marketing campaign and it’s all professionally done and it looks amazing.
And then I’m there just making these little training videos and he’s just like, “No, it’s fine. Like it’s just going to their internal IR teams. It’ll be great for them.” Because like the content itself is good. Like it’s teaching them how to use things and what to look for.
Yeah, it was funny until I started getting some feedback and then yeah, like, feedback’s an interesting thing. Like I always am quite critical of myself when I create stuff.
But then when you ask people for feedback, it’s hard to get. I think it’s hard to get honest feedback from people in terms of whether or not they engage with it enough to give you enough feedback or maybe because they don’t understand the process, they’re not well equipped to give you feedback or maybe they feel like they’re going to hurt your feelings.
Whereas when you’re kind of just like, “No, no like I really need you to tell me what I’m doing wrong or tell me what you think I could do better. Which will just help.” So yeah, I always try and listen back and be as critical as I can.
And then I don’t worry too much at the time. I’m like, I just need to put this out, it’s fine, like I’ll just improve over time, because it’s a learned skill doing these kind of things.
So yeah, it’s interesting. I think it’s the hardest thing to do other than doing public speaking on a topic you’re not that interested in talking to no one. Because like you said, like, there’s no feedback, there’s no kind of, if you are trying to be funny or you’re trying to be entertaining, even though it’s…
Simon: We need to get a laugh track for this podcast, by the way.
Alex: Oh yeah, that would be, well, no, we just need to edit it in. We need to pause and wait for laughter when I say a funny joke or when I say a joke that I think’s funny and then we just have the laugh track over the top.
Simon: Yeah. I like it. We’ll get that, along with beeping out the rude things that I shouldn’t say.
Alex: Well, I was thinking instead of beeping out, we have like our Forensics Focus podcast and then we have the Forensics Focus Australian edition which has no beeps. That’ll be fine down here. If anything, we need to insert more swear words just for the Australian version.
Simon: Oh, I can do that. I actually had to, so obviously guidance in university has changed a little bit over the last few years and you know, we’re supposed to do things like trigger warnings for certain things if we’re talking about them, which in forensics is astonishingly often.
But, I actually, you know, I’ve given up and I start off the year by going, “Right, is there anybody who is massively offended or has any religious…” I worked with somebody who’s deeply religious. And he was, you know, seriously objected on religious grounds to swearing and hey, I hope all’s going well.
And you know, I made a big effort not to do it around him, but I sort of, you know, I stood up at the front of the class and asked them if it was okay if I swore throughout the year and they were all fine with it. So off the filters came and I just carried on as usual.
So that was great. But having said that, I was giving a talk in front of a bunch of barristers. I can’t remember exactly what it was that I said, I misread a line, and I swore out loud and I realized what I’d done and I went, “Oh shit, I just swore.” and the entire room just…
Alex: Dig yourself more of a hole.
Simon: Yeah, and yeah, they found it funny, so that was a fortunate thing. We’ll see if Christa cuts that and beeps that one out, we can leave it in for the Australian version.
Alex: This is what happens when we’re unsupervised. We’re just creating more work for Christa to edit these before they go out.
Simon: Anyway, I’m running short on time. I have to go and deal with another client unfortunately, but you’ve made a very good point. And as we close out the recording, I think feedback, please, ladies and gentlemen that are listening as the audience, ladies, gentlemen, and people who identify as any other particular assignment, we would love to hear feedback, positive, negative, topics that you’d like us to talk about.
Alex: Whether or not we should include a laugh track.
Simon: Not particularly a laugh track. If swearing is offensive, we would be genuinely delighted to hear from our one listener on Spotify, what he thinks of this.
Alex: Yeah. Shout out to Brennan. He was my old boss, so really good guy. And I’m glad he’s fallen on Spotify.
Simon: So yeah. Anyway, so, looking at Christa’s words does she have. Thanks also to our listeners you’ll be able to find this recording and transcription, along with more articles, information and forums at www.forensicfocus.com. And in her words: stay safe and well. And because I’m not going to kill the track on that. Thanks, Alex. It’s been really fun. Christa should be back in a week or two and we’ll actually have some sensible topics to talk about again.
Alex: Yeah. One topic that I wanted to wait until all of us were back, which I think would be a great one and leveraging your experience is chatting about forensics and incident response courses, like, both university and certifications, what we think about them. I think that’ll be a really interesting topic. ‘Cause you go to job fairs and it’s like all students ever ask you about: what certifications, what courses should I be doing to get into the industry? Yeah. I think that would be great.
Simon: I think so. And it’d be interesting to hear what your personal experience of it is. I mean, I know, and I digress, I have… my ISC2 CISSP bill dropped through the door. It’s due to be paid, so it’s on my mind at the moment as to whether I am gaining value from it or not. So it’s an active thing in my mind as well.
So yeah, it’d be really interesting to hear your thoughts on it and your experience of what it is that you feel the value is, if there is a value. I don’t know if you’ve seen, (he says, digressing with the amount of time he has left).
Alex: It’s all right. We got six minutes.
Simon: We got a few minutes, we’ve got six minutes. There’s quite a big thing going on in the infosec world at the moment, certainly on Twitter, which is not the be all and end all of things.
But somebody wrote a paper and a couple of people sort of popped up and critiqued it. And he turned around and said, “You aren’t fit to critique this. You don’t have a PhD.” I was like, in this industry, that’s not actually, you know a prerequisite anymore in my mind for, you know…
Alex: In theoretical subjects, in today’s modern age of access to all information, is a PhD even needed in a lot of stuff, if you can spend the time to research it? Yeah, that’s a tough one.
I feel like, digressing just a little bit further, the education industry and the people who publish those papers are there running it as a business. So it provides a paywall for them to make money. Cause at least from what I know, a lot of the authors don’t make much money if those papers are recited or accessed later on, because it’s just going to the company that’s providing that service, so…
Alex: And some papers are like $80 to just access or you need a subscription to the library.
Simon: Yeah. I’m going to say, that’s one of the best things I have found about working for a university is the access to the library. In all seriousness, it’s one of my favorite things. I’ve been able to go in and look up any ISO standard I want for free, I’ve been able to go in and look up any academic paper I want, but also things like access to court records and previous court cases; as long as the university has a law school, there’s usually access through to some resources which are tens and tens of thousands of pounds a year if you need to get to them through other means.
Alex: Well, this is why, like, for our industry, things like the SANS whitepaper, most big vendors put out their own whitepapers. So thinking like Mandiant, CrowdStrike, even, who does Secure AI Labs? I forget who’s behind those, but they also put, or even just really good articles that are well researched, well put together so that even someone who’s not familiar with the content can be across it.
So yeah. I think that’s what I really like about cyber is that it’s fairly open in terms of, there’s no real paywalls, I don’t think, to start reading about stuff.
Simon: Yeah. Yeah. I will. It is a good topic. We’ll save it for another day. Well, save more of it for another day.
Simon: And you take care and I’ll speak to you soon. All right, cheers. Thanks, everyone.