Managing Your Own Career by Dr. Beverly Kaye

Have you ever asked yourself, "Is it really possible to manage my own career?" Well if you have, you're not alone. And let me tell you, it's not only possible, it is an imperative. Nowadays, no one can take charge of your own career more than you can. No one can be accountable for getting what you want from your career but you. Maybe years ago, the organization managed it for you or your manager managed it for you; no more. Today, you are accountable for the satisfaction you get in your own career.
Now truly, it's not you alone. I believe in something called the 3S Model, meaning for the individual, you bring the spark. You think about what you want, you knock on your manager's door and you say, "Here's what I want from my career." For your manager, they add the S for Support. They don't give you the answers. Instead, they support you in a good conversation about your career. And the third S is your organization. Their job is to provide the systems and the structure that, in fact, help you develop a career within the confines of your organization. So it's spark for you, support from your manager, and systems and structure from the organization.
So let me tell you what it takes to have that spark. There are five steps in really managing your own career -- no matter what level you are, no matter what function you are, no matter where you are in your organization. Number one, it takes knowing yourself. That means knowing your skills, your interests, your values, the preferred kind of environment you like to work in. Number two, it takes knowing how others see you. You must step out into the world and get feedback from other people. Have them tell you the truth. Have them tell you what you need to do to grow and get better. Number three, it is know the world of work. Understand what's changing and understand how your particular job or position or function might have to change as, in fact, we hit this changing world of work. Now number four is know your options. The most important letter in the word options is the letter S at the end of the word. You must have more than one. I wrote a book years ago called Up is Not the Only Way. Biggest mistake I made was not making sweatshirts and mugs to match. Because up is still not the only way. And there are numerous ways for you to move in the organization. You can move laterally. You can enrich. You can move back to something else. You can explore a new possibility. And the fifth step is know what you need learn and how you're gonna learn it. Develop a plan of action.
So there are five knows. You've got to know yourself. You've got to know how others see you. You've got to know how the world of work is changing. You've got to know your options in that world of work and you've got to know a plan of action, what steps are you gonna take. And let me tell you, this is not just a nicety. It's a necessity. It's not just for you personally. It means you have to align your goals with the direction of your organization. The more aligned you are, the more your organization will be able to use your talent well. So when you ask yourself, "Is it possible to manage my own career?" It absolutely is possible and you are in charge.

Being Accountable for Mistakes

Being Accountable for Mistakes by Linda Galindo
When someone at work is mad at you because you didn’t get your project finished on time, or you arrived late for a meeting, or you made a big client mad, you’ll get an earful about how badly you messed up. You might even hear that you’re irresponsible for doing it.

Your accountable response: “You’re right.”
The simplest, quickest and most-effective way to defuse an angry confrontation over your mistake or shortcoming is to acknowledge what is true.

Don’t argue. Don’t offer excuses. Don’t blame someone else. Don’t deny it. Acknowledge it, just as you would any other fact—because that’s what it is: a fact.
It’s your best chance of stopping an avalanche of finger-pointing, blaming, lying, gossip and wasted time—both for you and for anyone else involved in the confrontation.

Say What You Did
My No. 1 rule for success in your business or career: Acknowledge what you did: “I didn’t give you what I said I would. I wasn’t on time. I provoked the client.” In other words, be accountable.
Then state: “Here is how I will fix this so I can move this along. Agreed?”
This response accomplishes three things: First, it stops the blame game, which is never a good use of anyone’s time. Once you have acknowledged that you’re at fault, those who want to make sure you take the blame won’t have anything else to say. Second, being accountable creates forward motion. Until you accept responsibility for what you did, the haters are going to badger you. During that waste of time, no work will get done. And third, it changes everyone’s focus from, “You’re horrible” to, “Here’s what to do next.”

Everyone might still be annoyed with you; what you did is annoying, after all. So own your choices. Fix it. Learn from it. Do better next time.

How to Own, Act On, and Answer For The Results You're Producing In Your Life
Stay away from “It’s not my fault.” Whether you think so or not, this is just as much an admission of guilt as “You’re right.” But instead of deflecting attention away from your bad deed and onto the work, “it’s not my fault” stalls all progress while everyone listens to your list of excuses that a) nobody believes and b) annoys them further because they’re waiting to be right. Just get it over with. Tell them they’re right.
Avoid saying “You’re wrong.” If you go for this out-and-out lie, you’ll have to invent a way to convince everyone that they didn’t see what they did see. Good luck with that. And with your reputation.

Some people, of course, won’t take “yes” for an answer. You can be accountable, admit what you did, make it right and even salvage the project, and that still won’t be good enough for the colleague or boss who simply wants you to feel bad. That person isn’t interested in productivity; she just needs to be right. So tell her again and again, “You’re right. Let’s move on.”

Be Outstanding by Standing Out
Every time I hear a news story about a government official or politician who is making up excuses or revising history to try to get out of acknowledging a past mistake, I wonder how much more powerful that response would be if the accused simply admitted the truth. Try it next time you get yourself into a fix at work. Simply acknowledge what is true without offering any excuses for it. Instead of being the one who lied, blamed and finger-pointed, you might just earn yourself a reputation for being accountable—mistakes and all.

How to Disrupt Yourself

5 Tips to Increase Leadership Presence

Tips to Increase Your Leadership Presence
By Carol Kinsey-Goman
Leadership presence, is that hard to define, but “we know it when we see it” quality. It is a blending of personal and interpersonal skills that when combined, send all the right signals. It’s how we show up, how we make others feel, and how effectively we communicate both verbally and nonverbally. It's that illusive factor that sets you up for the next promotion and gives your career that extra boost.
But here is what leadership presence is not:
• It is not an attribute that is automatically assigned to you because of your business results.
• It is not necessarily reflective of your true talents, qualities, and potential.
Instead, leadership presence depends entirely on how other people evaluate you. So it’s all about impression management. As one savvy executive told me: “You need to show up each day the way you want to be perceived–which is simple to say, but difficult to accomplish unless you do your homework and really know yourself.”
That’s why leadership presence needs to be rooted in your character–in those traits and values that define you–and the “homework” of truly knowing yourself is a crucial place to start.
But if the foundation for leadership presence is Character, the five qualities that demonstrate it are Confidence, Credibility, Composure, Connection, and Charisma.
Confidence is the personality trait most responsible for an individual being seen as having leadership presence. Confident people attract followers by appearing to be assured, self-motivated, and willing to take risks.
Many strategies help you display more confidence, but one simple tip is to change your physical posture: Stand straight, keep your head up and pull your shoulders back. When you slump, you condense your body, making you look smaller, more submissive, and less sure of yourself. As you expand your posture (even for just 2 minutes) holding a “Superman” or “Wonder Woman” pose, you actually change your blood chemistry. Your testosterone level (that’s the power hormone) increases and your cortisol level (a stress hormone) goes down. So not only do you look more confident, you feel that way too.
Of course, you wouldn’t want to assume the Wonder Woman pose during a meeting, but doing so in private just before a meeting would ensure that you enter the room looking your confident best.
Credibility is all about how you communicate. It’s about being truthful, diplomatic, empathetic, succinct, and decisive. But certain words and phrases have an almost magical power to instantly increase your credibility. The word “because” is one of them.
A study at Harvard, asked people to break into a line of strangers waiting to make photocopies. When research subjects asked simply if they could use the photocopier (“Excuse me, I have to make 5 copies, may I use the machine?”), they were successful 60% of the time. However, when they added the word because to their request (“May I use the photocopier because I have to make 5 copies), they gained instant credibility, and their success skyrocketed to 94%.
Composure is keeping your poise under pressure. It’s remaining calm in difficult situations and thinking effectively on your feet.
One of the things that can throw you off your game might surprise you. It’s the snap judgments you make about other people’s expressions. A negative expression from the person you’re dealing with can trigger all sorts of unwanted reactions, including anxiety, self-doubt, and insecurity.
It’s helped me to realize that most of the time, what I’m seeing is more about them (and their state of mind for a variety of reasons) than it is about me. So try this trick the next time you are greeted with a less-than-welcoming expression: Just say to yourself, “It’s not about me!” You’ll be surprised at how this small phrase can help you maintain your composure.
Connection is measured by how well you relate to others. It’s well known that people won’t always remember what you say, but they’ll never forget how you make them feel. And how you make others feel has a lot to do with your body language. The body language of connection is warm and inclusive. Nonverbal tips to connection include giving people your full attention (so no checking your texts while others are talking), facing people directly, using positive eye contact (that’s looking at the person you are dealing with about 60% of time), smiling, nodding, mirroring the other person’s expressions, gesture, and postures, using open postures in which legs are uncrossed, arms are relaxed, and gesturing with palms exposed (that's the universal “I have nothing to hide” gesture).
Charisma is all about your power to attract others. There are no tips that will increase your charm or appeal other than realizing you are the most charismatic when you have a deep belief in your own talents and uniqueness and when you are genuinely passionate about the topic you’re discussing.
Confidence, credibility, composure, connection, and charisma are all key elements of leadership presence. But remember, the foundation is character–and the goal is to align people’s impression of you with your best authentic self.

SysInternals Malware Analysis (notes only)

by Mark Russinovich (for more details, please see the YouTube video presentation)

NOTE: do not let the notes below be a substitute for the YouTube video, as the notes below include no screenshots of the tools used!
Also, I haven't checked if there's an update to the information below, so if anyone thinks of it as obsolete, I apologize!

#######

Learn about the SysInternals tools and techniques for analyzing and cleaning malware
- professional anti malware analysis requires years of deep training
- even for professionals, Sysinternals tools can prove useful

Analyzing:
- understanding the impact of malware
- can be used to understand malware operation
- generates road map for cleaning infestations

Cleaning:
- removing an infestation of a compromised system
- attempting a clean can also reveal more information about the malware's operation

Pave&Nuking a system, should be the last and most extreme alternative!
If there's no expertise and time left, to understand/analyze the malware, then pave&nuke the system!

Malware cleaning steps:
- disconnect from network
- identify malicious process and drivers
- terminate identified processes
- identify and delete malware autostarts
- delete malware files
- reboot and repeat

What are you looking for when you identify/investigate processes:
- it has no icon
- it has no description or company name
- unsigned Microsoft images
- live in Windows directory or user profile
- are packed
- include strange URLs in their strings
- have open TCP/IP endpoints
- host suspicious DLLs or services

How many people look at processes with Task Manager?
Use Process Explorer (from Sysinternals)!
Process Explorer:
- is the Super Task Manager
- has lots of general troubleshooting capabilities:
    - DLL versioning problems
    - handle leaks and locked files
    - performance troubleshooting
    - hung processes
- we're going to focus on its malware cleaning capabilities

The Process View:
- the process tree shows parent-child relationships
- icon, description and company name are pulled from image version information
    - most malware doesn't have version information
    - what about malware pretending to be from Microsoft? Will talk later
- Use the Window Finder (in the toolbar) to associate a window with its own process
- use the Search Online menu entry to lookup unknown processes
    - but malware often uses totally random and pseudo-random names

Refresh Highlighting:
- refresh highlighting highlights changes
    - Red: process exited
    - Green: new process
- change duration (default 1 second) in Options
- press space bar to pause and F5 to refresh
- cause display to scroll to make new processes visible with Show New Processes option
- we'll see how to spot short-lived processes later

Process-type Highlights:
- blue processes are running in the same security context as Process Explorer
- pink processes host Windows services
- purple highlighting indicates an image is 'packed'
    - packed can mean compressed or encrypted
    - malware commonly uses packing (ex: UPX) to make antivirus signature matching       more difficult
    - packing and encryption also hides strings from view
- there are a few other colors, but they are not important for malware hunting

Tool tips:
- process tool tips show the full path to the process image
- malware more often hides behind Svchost, Rundll32 and Dllhost
    - tool tip for Rundll32 processes shows hosted DLL
    - Dllhost tooltip shows hosted COM server
    - tool tip for service processes shows hosted services
        - services covered in detail shortly

New in v15.2:
- autostart locations
    - reports where image is registered for autostart or loading
    - not necessarily what caused for process to execute, though
- process timeline

Detailed Process Information:
- double-click on a process to see detailed information
- pages relevant to malware analysis:
    - image: signing status, start time, version
    - TCP/IP: open endpoints
    - strings: printable strings in main executable

Image Verification:
- all (well, most) Microsoft code is digitally signed
    - hash of file is signed with Microsoft's private key
    - signature is checked by decrypting signed hash with the public key
- you can selectively check for signatures with the Verify button on the process image tab
    - select the Verify Image Signatures option to check all
    - add the Verified Signer column to see all
- note that verification will connect to the Internet to check Certificate Revocation List (CRL) servers

Sigcheck and ListDLLs:
- scan the system for suspicious executable images
    sigcheck -e -u -s c:\       (it will discover great places to hide malware)
- look for same characteristics as suspicious processes
    - be especially wary of items in the \Windows directory and the \Users          \<username>\AppData directories
    - investigate all unsigned images
- ListDLLs will can running processes for unsigned DLLs
    listdlls -u

Strings:
- on-disk and in-memory process strings are visible on the Strings tab
    - there's only a difference if the image is compressed or encrypted
- Strings can help provide clues about unknown processes
    - look for URLs, names and debug strings
- you can also dump strings with the command-line String utility from Sysinternals
    strings <file>

The DLL View:
- malware can hide as a DLL inside a legitimate process
    - we've already seen this with Rundll32 and Svchost
    - typically loads via an autostart
    - can load through 'dll injection'
    - packing highlist shows in DLL view as well
- open the DLL view by clicking on the DLL icon in the toolbar
    - shows more than just loaded DLLs
    - included .exe and any 'memory mapped files'
- can search for a DLL with the Find dialog
- DLL strings are also viewable on the DLL properties

Terminating Malicious Processes:
- don't kill processes
    - malware processes are ofter restarted by watchdogs
- instead, suspend them
    - note that this thing might cause a system hang for Svchost processes
    - record the full path to each malicious EXE and DLL
- after they are all asleep then kill them
    - watch for restarts with new names

Investigating Autostarts:
- Windows msconfig.exe falls short when it comes to identifying autostarting   applications
    - it knows about few locations
    - it provides little information
- it uses the Task Manager (which is REALLY bad)

Autoruns:
- shows every place in the system that can be configured to run something at boot &     logon
    - standard Run keys and Startup folders
    - shell, userinit
    - services and drivers
    - tasks
    - winlogon notifications
    - Explorer and IE addins (toolbars, Browser Helper Objects...)
    - More and ever growing
- each startup category has its own tab and all items display on the Everything tab
    - startup name, image description, company and path

Identifying Malware Autostarts:
- zoom-in on add-ons (including malware) by selecting these filter options:
    - verify code signatures
    - hide Microsoft entries
- select an item to see more in the lower window
    - online search unknown images
    - double-click on an item to look at where its configured in the Registry or       file system
- has other features
    - can display other profiles
    - can also show empty locations (informational only)   
    - includes compare functionality
    - includes equivalent command-line version, Autorunsc.exe

Deleting Autostarts:
- delete suspicious autostarts
    - you can disable them if you're not sure
- after you're done do a full refresh
- if they come back, run Process Monitor to see who's putting them back
    - you might have misidentified a malware process
    - it might be a hidden, system or legitimate process

Tracing Malware:
- tracing activity can reveal the system impact of malware
    - malware shows initial infection, before cloaking is applied
    - can reveal the internals of 'buddy system' and other infection-protection       mechanisms
- Process Monitor makes tracing easy
    - a simple filter can identify all system notifications
    - investigating stacks can distinguish legitimate activity from malicious       activity


Event Properties:
- event details
    - duration, process, thread, details, etc
- process information
    - command line
    - user
    - session and logon session
    - image information   
    - start time
- thread stack at time of event

Filtering:
- to filter on a value, right-click on the line and select the attribute from the   Include, Exclude and Highlight sub menus
    - you can select multiple values simultaneously
- when you set a highlight filter you can move through highlighted event properties

Advanced Filtering:
- multiple-filter behavior:
    - values from different attributes are AND'd
    - values from the same attributes are OR'd
- more complex filtering is available in the Filter dialog
    - Outlook-style rule definition
- you can save and restore filters
- filter for watching malware impact: "Category is Write"

The Process Tree:
- Tools-Process Tree
    - shows all processes that have been seen in the trace (including parents)
    - can toggle on and off terminated processes
- the process tree provides an easy way to see process relationships
    - short lives processes
    - command line
    - user names


Real World Analysis and Cleaning (minute 44)

The Case of the SysInternals - Blocking Malware
- friend asked user to take a look at system suspected of being infected with malware
    - boot and logons took a long time
    - Microsoft Security Essentials (MSE) malware scan would never complete
    - nothing jumped out in Task Manager
- tried running Sysinternal tools, but all exited immediately after starting:
    - Autoruns
    - Process Monitor
    - Process Explorer
    - Even Notepad opening a text file named "Process Explorer" would also terminate

- Looking through Sysinternals suite, noticed Desktops utility
    - hoped malware might not be smart enough to monitor additional desktops

- Sure enough, was able to launch Process Monitor and other tools:
    - Malware probably looks for tools in window titles
    - Window enumeration only returns windows of current desktop

- Nothing suspicious in Process Explorer
- Next, ran Process Monitor
    - noticed a lot of Winlogon activity, so set a filter to include it
    - could see a once-per-second check of a strange key
        (e.g acdcacaeaaacb...)
    - saw name of random DLL in the key:
        (e.g Yellow folder named acdcacaeaaacb...)

Solved:
- tried deleting the key, but after refreshing, it was back
- went back to MSE and directed it to scan just the random DLL image file on disk
- after clean, was able to delete Registry key and system was back to normal: problem solved...

Cleaning FakeSysDef Scareware:

- see video in regards to the malware hiding

The case of the Strange Reboots:
- laptop would reboot immediately after connecting to wireless networks:
    - followed by a boot in safe mode
    - then boot back to normal mode
- boot to safe mode resulted in automatic logoff
- tried to run Microsoft Security Essentials (MSE), but it was damaged
- ran Process Explorer and saw many processes exhibiting malware characteristics
- processes with names mimicking Windows processes were clearly malicious
- Autoruns showed system massively infected
- suspended all packed processes that looked suspicious
- connected to network: no restart
- downloaded and ran fresh copy of MSE
    - MSE detected several malware variants
- after cleaning, there were no more suspicious processes and the system behaved normally:
PROBLEM SOLVED!

Cleaning Cycbot.exe backdoor:

- please see video for details
- also do some research on how it works and locations it uses

Analyzing and Cleaning Stuxnet and Flame:
- discovered June 2010 after it had spread for a year
- exploited 4 zero day Windows vulnerabilities
    - print spooler for remote code execution
    - shell link Explorer code execution from infected key
    - Win2k/Windows XP Win32k.sys privilege elevation
    - Windows 7 Task Scheduler privilege elevation
- Drivers signed by certificates stolen from RealTek and JMicron (in Taiwan)
- Rootkit code for Siemens Step 7 SCADA PLC for centrifuges
- suspected to have targeted Iranian centrifuges used for Uranium enrichment at Natanz nuclear facility
    - Iran confirms in September 2010 that thousands were destroyed
    - suspected to be created by Israel and US
- believed to have been spreading through USB keys (at this point)
- there is ONLY ONE lsass.exe on the system (should be anyway)

Flame:
- discovered a few weeks ago
- considered by some to be more sophisticated than Stuxnet
- found by Kaspersky antivirus
- used LUA programming for the code
- the computer clock had to be changed to Tehran


The Future of Malware:
- we've seen the trends:   
    - malware that pretends to be from Microsoft or other legitimate companies
    - malware protected by sophisticated rootkits
    - malware that has stolen certificates
- cleaning is going to get much, much harder:
    - targeted and polymorphic malware won't get AV/AS signatures
    - malware can directly manipulate Windows structures to cause misdirection
    - all standard tools will be directly attacked by malware
    - there will be more un-cleanable malware
- you can't know you're infected unless you find a symptom

Zero Day - A Novel
- a cyber-thriller true to the science
- www.zerodaythebook.com
- book: Trojan a novel horse (Mark Russinovich)

The end :)

Tutorial: Domain Password Auditing

This tutorial is for password auditing of network credentials within your domain. We will use Kali Linux along with some open source software to validate your password policies. As always make sure you have permission to perform this audit at the least every everyone should check to verify that people using privileged accounts are not using the same password for their privileged account and normal user account.

Preparation:
1) Access to a domain controller for the domain that we will be auditing
2) Kali Linux
3) ntdsxtract-master.zip (https://github.com/csababarta/ntdsxtract)
4) libesedb-experimental-20160622.tar.gz (https://github.com/libyal/libesedb/releases)
5) Install ntdsextract and libesedb using instructions given within the archive.

1. Log into your Domain controller using and admin level account
2. Open a command prompt
3. Type ntdsutil
4. Your prompt should change to ntdsutil:
5. Type active instance ntds
6. Type ifm
7. Your prompt should change to ifm:
8. Type create full <location of where you want your backup> (i.e. c:pentest)
9. Once the backup is complete, type quit.
10. Now copy the folder with your backup to your Kali Linux system

Extract the NTDS database:

1. navigate to the ntds.dit file (i.e. /root/pentest/Active Directory)
2. run esedbexport -m tables /ntds.dit

Extract the password hashes:

• run dsusers.py ./ntds.dit.export/datatable.4 ./ntds.dit.export/link_table.7 ./hashdumpwork –syshive ../SYSTEM –passwordhashes –lmoutfile lm-out.txt –ntoutfile nt-out.txt –pwdformat john

Ok, let’s break this command down:

• dsuser.py is the program we just installed for this to pull the hashes out of the database
• ./ntds.dit.export/datatable.4 database table for the ntds database number may be different
• ./ntds.dit.export/link_table.7 same as above number may also be different
• these two tables are need to allow the program to match up usernames with their associated hashes
• ./hashdumpwork just a nice way to keep your directory cleaned up will dump all supported files that will be generated here along with our output files
• –lmoutfile lm-out.txt this is our file for any lm passwords normally will be blank for modern domains
• –ntoutfile nt-out.txt this is our file for ntlm passwords this is where all the good stuff goes
• –pwdformat john this tells our program how we wanted this formatted we will format for john the ripper

We have the user accounts and hashes, now what?
This is where we can now start to audit our passwords I prefer to open as a spreadsheet first. This allows me to sort the accounts by hashes. I can now easily see if my admins are using the same password for their normal account and their privileged accounts, same hash = same password. If you have multiple domains you are auditing you can also easily check if people are using the same password across multiple domains which also is a no-no.
Everything up to this point should be done as a regular password auditing however some organizations may want to go a step further. Make sure you clear this first, if you decide to check for ‘weak’ passwords, as this could become a ‘resume producing event’.
Remember we formatted our output files for john the ripper? Let’s open johnny and load in our password file, and your favorite word list. If you don’t have one yet a quick search will give you plenty to choose from. I always also edit it to contain known default passwords. Remember we are not going overboard to see if we can crack everyone’s passwords we just want to check for ‘weak’ passwords and you would be surprised at what will pop up even with a good domain password policy.