The first chapter had a line that forced me to write here, though. In the middle of a discussion about how women are still underpaid in America, this quote appeared (pg. 45):

“Over the first fifteen years of their careers, women work fewer hours than men, 52 per week versus 58. Over fifteen years, that six-hour difference adds up to six months’ less experience”

These are the average working hours for MBAs that graduated from the University of Chicago. (Original Paper Here)

This is something that applies to me. Early in my career, I had no social life. I spent all of my time working on computing projects through college and the first 4 years of my career. I ported a version of Gnome to OpenBSD for fun because I wanted it to run on my laptop. I figured out how to run my home firewall with the OS unbooted. We found the first remote vuln in Windows 2000. And I worked at crazy startups non-stop. I worked 70, 80, 90 hour weeks for years.

And it gave me a huge advantage. After 3 years, I was doing what people who had been in the business for 5 were doing. After 5 years, I was doing what the 10 year people were doing.

I always felt like hard work was the biggest advantage. I’m excited to see it in an academic paper (and in Super Freakonomics.

And I realize that I’m an extreme example. But you don’t have to be so extreme. How many of your peers work 35-40 hour work-weeks? If you average a 58-hour week (like the majority of the male MBAs in the study), after 5 years, you’ll be six months ahead of them. After a decade: a full year.

While we often counsel people on their careers and give advice on resumes, interviewing, career planning, etc., I think the best advice I can give is simple:

Love what you do and work hard. The more you love it, the harder you’ll work. And the harder you work, the more successful you’ll be in the long-term.

Not quite Tim Ferriss. But definitely true.

When it relates to your career, this concept comes in handy as well.  Simply put, many Information Security professionals that , when interviewing, approach the interview with the belief  that their skills and experiences are more valuable then they actually are.   This generally leads to looking for more compensation then their market value and searching for more responsibility then they have proven they can accept.

Well, why is this dangerous?  Shouldn’t we all aim high.   Aspire for greatness.  Stretch ourselves to the limit.   The answer to these questions are a resounding, “Yes!, Yes!, and Yes!!”  However, it is also critical that you are able to honestly assess your skills and market value, so that you can make the correct career choices. 

When you do not understand the “market value” of your skills, it greatly affects your attitude in the interview process.  There is nothing wrong with being confident, but if you believe you are more valuable than you are, a dash of “cockiness” gets mixed in.  With most interviewers, this can be a deal breaker.  All employers are looking for Information Security “Rock Stars,” however they can all do without the “Rock Star attitude.”

In addition, overestimating your self worth can cause you to overlook opportunities that are better suited for your career development.   Simply put, there are many roles and opportunities that will help you acquire skills that are important for your career, that may not give you more responsibility then you currently have.  If you always believe that you are ready to move up the corporate ladder before you have developed the necessary experience, chances are you will not be as equipped as you should be,  and your probability of failure will increase.   You definitely do not want to have to explain a short duration of employment  to your next employer.

Finally, it could cost you financially.   There have been many occasions that people have called my office, stating that “I am underpaid for my skills”, but can not articulate why they think so, accept for the fact that they have “a friend” in another company that earns 20K more than them, and that they “do the same thing”.    When you place in your mind that your skills are worth a certain amount, you often overlook good opportunities that could elevate your financial situation, but not as much as you have perceived.  Last time that I checked, 5-10K more than you were previously earning,coupled with a better career opportunity,  is superior than maintaining status quot.

It is important to be confident in your skills and abilities, however unwarranted confidence can truly hinder your career development. 

A full house is a great poker hand, unless of course your opponent is holding a royal flush!

The financial stress is quite easy to figure out.  Severances are running out, savings are depleting, and resposnibilites remain.  The personal stress traditional begins with a deflation of one’s self -esteem.  People question their value, their roie in their profession, and their overall usefulness.   The idle time does not help.

The idle time is mostly spent worrying about the future.  It illustrates how liitle control that you currently have over your present situation.  The silence  and lack of feedback becomes deafening.  You become consumed with questions /statements  that include- “Why have I not heard back from that company”, “Is my resume correct?”, “When is the right time to follow-up?”,  “Am I being a pest?”, “Have they decided to go another direction?” etc. 

When people start asking these questions to themselves, they begin to create a feeling of anxiety.  When these feelings begin to creep up on you, many times it clouds  your judgement, and produces a feeling of desperation.   When you begin to have these feelings internally, it is almost impossible for them to not come out in conversations with perspective employers and during interviews.  Many times, without realizing it, candidates will share some of their personal hardships during these discussions and it creates an uncomfortable mood.   It also creates the feeling of desperation.  This  causes these potential employers to believe that you are searching  for “any position” as opposed to “their position”. 

So, how do you avoid “Wanting a Job Too Much?”   Here are some things that you might want to consider:

1)   Remember that you have talent, and know what that talent is.     Talent is the key to any professional,s career.  Chances are if you have built a career in the Information Security profession, you have built it on a foundation of skills.  Knowing those skills, and how to apply them to the role that you are searching for is key.

2) Think back to the time when you were “over recruited.”  You all remember those times when you were gainfully employed and you had multiple employment offers from competing companies.  You remember how it felt to be wanted and to be in demand.  That was a good feeling to have.  Those people who came looking for you in the past, will come looking for you again.  It just may take a little longer to find you.   Carry that attitude into any interview situation.  Exhibit confidence, without being “cocky”.

3) Take your mind off the job search.  Regardless of how much stress that you are under at home or financially, you have to take your mind off that for a period of time each day.  Use that time to do something that makes you happy or that you have neglected due to your work schedule.  Maybe this will remind you why you do work, and give you more incentive to balance your career and your life.  It might also provide you with some clarity as to what type of position that you are searching for. 

The three items above are geared to help you more mentally then financially.  However, if you take care of the mental aspects of a job search, you should find yourself with the abillity to think clearly,  be exposed to more opportunites and leave yourself with better options. 

In closing, I think that everyone should look around what is happening to themselves or to their peers.  This can happen to anyone.  Plan accordingly.  The better you plan, the less stress you will have.

While I’m not suggesting extreme paranoia, there is always the potential that anything you say gets back to people around you. Especially in the age of Twitter, Facebook, and other online sites.

Read the great conversation here.

I have to give credit, the new stadium is beautiful.  The design captures many of the features of the old stadium (it really looks the same), but has all the amenities of a modern ballpark.  The “sight lines” were great, all of the refreshment stands had calorie content (make you think twice about ordering a chicken parm), and the bathrooms were clean. 

As game time approached, the sun came out, 40,000 plus settled in their seats as rose for the National Anthem, one thing stood out.  A majority of the best seats were empty.  I am no genius but I believe that it has something to do with the ticket prices.  That started me thinking – could you social engineer your way into sporting events and wind up with the best seats, without forking over the equivalent of a mortgage payment?

Hackers and pen testers have made their names by claiming the various trophies of the digital world, NASA, the White House, the NSA, but could the sports and entertainment venues be hacked?

Earlier this year I read an article by Rick Reilly, about a life-long Philadelphia Phillies fan, Lionel Rodia,  who worked his way onto the field after the final out of the World Series, participates in the on field celebration and then works his way into the Phillies clubhouse where he joins the Phillies in the champagne spraying ritual that comes with sports championships. 

I thought that the Reilly’s account of Lionel Rodia’s sport’s hack was a one shot deal.  A perfect storm of activity.  But could it be done consistently.  What about a “Grand Slam” of Event Hacking?

To me the trophies would include the following:

Seats behind home plate at a Yankees vs. Red Sox playoff game (where you are in the TV shot)

50 yard line seats at the Super Bowl?

Floor Seats at the Staples Center next to Jack Nicholson at LA Lakers Playoff Game

Entry into the Oscars or the Emmys (including a walk on the Red Carpet and interview with Joan Rivers)

Front row tickets to a Springsteen Concert in the Meadowlands

I wonder if anyone from the Information Security/Hacker community had tried this, and what it would take to accomplish such a feat.  I thought it would make a great realty show! 

Or at least a great DefCon presentation!

From what I understood when receiving the e-mail invitation, my friend was given the liberty to invite industry colleagues and other potential “customers” to this dinner to forge relationships and potentially develop new business opportunities. I believed that I was added to the guest list for some broad perspective of the security market which would have been beneficial to all in attendance.

The dinner was initially to be attended by somewhere between 9 or 10 people, however for one reason or the other – jet lag, previous plans, not wanting to begin dinner at 9PM PST, the final number in attendance was 5. The final roster included me, my friend, his co-worker, and two representatives from the vendor.

The vendor chose a San Francisco favorite, Scoma’s, an Italian/Seafood restaurant located at Fisherman’s Wharf. After a round of drinks, we sat down at a table. It became very evident to me, whom the most senior member of the vendor team was, as he interacted with the waiter, received the wine list, and quickly accepted the role of “table captain.”

The conversation at the table was free and easy. We spoke about our families (even showed some pictures), sporting events, our college experiences, careers, the economy, and other topics. We did not even begin to discuss Information Security, their products, or anything relative to traditional business.

As this was going on, the “table captain” took the reigns and began to order. He ordered appetizers for the table, an extra course of salad for himself, a main course, and selected the wine. As a guest, I followed his lead. Shared the appetizer, did not select a salad, chose a main course within five dollars of his choice, and had a beer instead of wine. As the meal came to a close, he ordered himself a desert, coffee, and asked everyone if they every had port wine – and ordered himself a glass, I passed on dessert and coffee – but took him up and the port wine. I am not really a wine drinker, but I was up for the experience – and at his encouragement, I thought I would take him up on his suggestion.

The conversation continued throughout the meal, and everyone became more relaxed during the time, and people were obviously comfortable. The one single person discussed his current dating dilemmas, one spoke about raising a special needs child, we even touched on the standard no-nos, religion and politics. But that was the level of comfort, it was really a great dinner, until…

The check came!

The table captain left the table at the end of the meal to seek out the waiter and to call a cab. In his absence the waiter appeared and handed me an itemized copy of the bill and stated “Everything else is taken care of. This is for you.”

I did not know how to react at first. There were many items going through my mind, but I chose to just stare in disbelief for the first couple of moments. My first inclination was to go to see the waiter, and pay for the entire check – just our of principle and make the “table captain” feel uncomfortable, my second thought was to just reach in my pocket, pay cash, and leave on my own, the third option was to refuse to pay, and create more discomfort. The remaining three other people, including the person who invited me, were obviously uncomfortable and this created a very awkward moment.

After the awkwardness subsided, I reached for my money but was interrupted by the other member of the vendor team. Obviously embarrassed, he reached to his wallet and paid on the corporate credit card. It was also obvious to me how embarrassed my friend who invited me was. He remarked to me after how impressed he was on how I handled the awkwardness of the situation.

As we waited for the cab, the “table captain” returned to an much different table. The subject of business took hold and I can tell from the reaction of the two “customers” they were not nearly as engaged as they would have been, if the “table captain” would have just paid the entire check. The actions of the “table captain” gave off the impression that he was only concerned with people who could make him money. Personally, I think this spoke loudly for his character and I believe that I would reconsider sending any additional business in his direction. But that is just me!

There are a number of things we can learn from this. First, if you are going to invite someone to dinner, the expectation is that it is your meeting and you are going to be responsible. Second, it is always a good idea at a business meeting to follow the lead of the “table captain”. Your ordering pattern should mimic theirs. Third, never take advantage of a good gesture. If everyone is ordering $20 items, do not order the 4lb lobster that costs $80 – that is just rude and says a great deal about your character. Also, think before you speak. Know which topics are fair game to discuss, and which ones are a bit taboo for the subject. Finally, never make anyone feel insignificant. In the situation above, if the waiter produced five separate checks, I would not have had any issue. However, singling me out made me feel like a second class citizen, even though throughout the dinner I was treated like an invited guest.

Just remember, people are judging and evaluating you in many different environments. Your are always interviewing.