I built the first Coast Guard Red Team, open-sourced thousands of attack techniques, then left to help businesses secure their infrastructure. Ask me anything!

[u/RoseSec_]

My name is RoseSecurity, creator of Red-Teaming TTPs and Anti-Virus-Evading-Payloads. I'm also an active MITRE, OWASP, and Debian contributor/maintainer, although more of my recent projects have been cloud-focused. I went from cybersecurity in the government to helping businesses build secure infrastructure in the cloud. Ask me anything about contributing to open source projects, security research, or cloud security!

Edit: I helped build the Coast Guard Red Team. I was just a small piece in an awesome team doing great stuff. Sorry if I ruffled any feathers 🤙

[u/TheOGgeekymalcolm]

Wondering what tools you used as your "daily driver" / go to tools?

[u/RoseSec_ → u/TheOGgeekymalcolm]

For development or cybersecurity specific? My daily driver is a MacBook Pro, and some of my favorite "tools" are Chezmoi for configuration management of my dot files across different workstations, Neovim for file editing, and lots of self-service scripts. gh-dash is another great one for managing open source projects and notifications in the CLI

[u/gothichuskydad]

I work in the field on the blue team side. While there's no question here, I just gotta say I really appreciate the level of detail and how thorough you are in answering these. For an AMA it's rare to see a "no stone left unturned" method and it's much appreciated.

Been working for 9 years and have actually used some of your resources. Fantastic work. Thanks a ton!

[u/RoseSec_ → u/gothichuskydad]

You have no idea how much I appreciate this. My biggest motivator is writing tools and TTPs that are actually used, so I’m thankful they are helping you defend! If you ever have find anything that you think would benefit the greater community, feel free to open a PR or an issue and we can get it added. We’re all in this together

[u/gothichuskydad → u/RoseSec_]

Don't worry, I definitely will. I'm pushing to make threat hunting a more community driven process at my current org and they are jumping on the train like it's the next best thing.

Keep doing what you do. On the blue, red, and even purple side we appreciate it a ton! I'll let you get back to answering questions though haha.

[u/intelw1zard]

Thanks for doing this AMA!

Some questions:

• What advice would you have for someone first getting into cybersec?
• What is the most challenging cert you've studied for?
• In your opinion, what do you believe to be the most serious cyber threat?

[u/RoseSec_ → u/intelw1zard]

Love these.

My advice for those getting into the infosec field is to stay curious and take time to understand the underlying concepts and technologies rather than just the tools. It's easy to run a command, but what do the bytes actually look like going across the wire? That creates great learning opportunities from both the offensive and defensive perspectives.

The most challenging for me was GIAC Exploit Researcher and Advanced Penetration Tester (GXPN). I took it too early in my career when I was primarily working in the SIEM space and wasn't diving into OS internals, so I got completely lost in the sauce. I'd definitely revisit the materials although many of the techniques are now legacy.

No comment ;) I'm sworn to secrecy

[u/I_am_BrokenCog]

Were you involved with the NSA Red Team Certification process? How bureaucratic did that get?

[u/I_am_BrokenCog → u/[deleted]]

I know the Ft. Meade team very well. They can be very helpful -- once all the hoops are lined up :).

[u/RoseSec_ → u/I_am_BrokenCog]

They’re a great group and taught me a lot. I worked on the other side of the house on the UNIX blue team there.

[u/I_am_BrokenCog → u/RoseSec_]

What years were you there?

I was there from '07 until '13

[u/RoseSec_ → u/I_am_BrokenCog]

Heck yeah, I was there from ‘19 to ‘23 so a little more recent but same old same old I’m sure

[u/Responsible_Minute12]

Thoughts on honey pots and deceptions?

[u/RoseSec_ → u/Responsible_Minute12]

I developed an open source project called Gaspot over the past few years that emulates a Veeder Root Guardian AST, the tank gauging system commonly found at gas stations across the United States. After deploying it in my homelab with internet exposure, it generated interesting insights into how various tools and actors interact with these systems. I also created a simulation of a local water tower control system, which revealed additional attack methodologies due to its web-based interface. I wrote a blog here if you're interested in the technical details. The honeypots had some fascinating data on threat actor behavior, but the scariest experiment I did involved embedding a canary token in our password manager to monitor for potential breaches...

[u/Soberaddiction1]

Have you been on or would you go on u/jackrhysider podcast? The subreddit for it is r/darknetdiaries

[u/RoseSec_ → u/Soberaddiction1]

Not sure if my career is exciting enough to have a narrative written about and podcasted, but I have some war stories from the trenches 🤙

[u/Soberaddiction1 → u/RoseSec_]

He can make the boring and mundane worth listening to. He’s got a great podcast.

[u/DamianDaws]

Thanks for being here to answer questions. I’m new to hacking and engineering. How did you get started and what tools would you recommend for beginners?

[u/BALLSTORM]

Kudos, Debian is sort of my fave.

[u/RoseSec_ → u/BALLSTORM]

Gotta love stability

[u/yard_ranger]

Did you set up your own consulting firm or do you work for someone else?

[u/intelw1zard]

also what is your favorite open source project to contribute to?

[u/RoseSec_ → u/intelw1zard]

My favorite has to be the entire Cloud Posse ecosystem of Terraform components, modules, and tools to manage infra. Being able to write features and improvements for code that is downloaded millions of times is super fulfilling. Other than that, I'd definitely say Trufflehog is an awesome group. They are super responsive to pull requests and fun to work with.

[u/wifihack → u/RoseSec_]

thank you, that's kind to hear! -OG TruffleHog maintainer

[u/Deadlydragon218]

Whatup TISCOM

[u/RoseSec_ → u/Deadlydragon218]

Yessir, I miss those $3 civie breakfasts

[u/Deadlydragon218 → u/RoseSec_]

I worked at OSC as a contractor for about 5 years NaaS Ops. Miss you all dearly, I had fun being the email security guy and thinking through ways to block some spam/scam campaigns. The sextortion campaign was of particular interest as the entire body of the email was variable save for a few select words. Printed out a bunch of those in my cube and was highlighting similarities.

[u/Spiritual-Matters]

How did you get started and what got you hired?

[u/RoseSec_ → u/Spiritual-Matters]

I joined the military after high school and got to go through lots of cool training. I decided to shift from traditional vulnerability assessments and red teaming into the world of infrastructure so I could help organizations design and build securely. Something about infrastructure as code and automation that makes for a fun time

[u/FK1627]

Thanks for doing AMA! Here are some questions

1. How have your interests and focus evolved—from government red-teaming to cloud, and now what’s capturing your curiosity?

2. What new attack surface or tool do you now focus on especially one that you wish you had earlier in your career?