SANS ISC: What are YOU doing to give back to the security community? - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

• Ask yourself regularly "Who can I share that lesson with”
• Establish an informal mentoring program at your $DayJob
• Serve in the leadership of your local security group such as BSides, ISSA, InfraGard, ECTF, OWASP
• Volunteer at your next local information security event 
• Reach outside our information security community

20 Critical Security Controls: Planning, Implementing and Auditing - SANS Security East 2019

I go through and statically analyze many pieces of open source software for potential bugs and write the necessary patches. I just had 11 different tickets for OpenSSL-1.0.2 reviewed and committed for the next release of OpenSSL...

Static analysis of open source software? You certainly earned a hearty sense of gratitude from many. Thanks so much for giving back in that manner.

Russell

Welcome addition to our list of ideas from Ivy via social media - Reach outside our information security community in order to make an impact to other industries.

Russell

I try to do the following, hopefully it helps
- simply share IPs, hashes, etc. on sites like Open Threat Exchange, Virus Total ... so that others can see what you've seen
- also make sure to add meaningful comments/notes when I post things on sites like Open Threat Exchange, Virus Total, etc. so others can understand and have context around why the IoC was posted
- blog about how malicious traffic or scripts work for ones that I understand so that others don't have to re-invent the wheel
- share malicious or suspicious scripts and traffic that I do not understand so at a minimum others can know that it exists and has been seen by others

Teaching at the local school has been one of the most rewarding things I have ever done. Using Rasberry pi's and IOT devices you can really bring out the talent with the kids.
Teaching them about the engineering processes for requirements, analysis and design. Highlighting the different testing strategies and the SDLC, Top 4, OWASP & general auditing tools really gets them excited once they've completed a system. Also how to greenit (re-use old tech) and of course the importance of ethics. Give it a go and share with the next gen.

A great way to give back to the community while gaining experience is by becoming a CyberPatriot mentor. At the center of CyberPatriot is the National Youth Cyber Defense Competition. The competition puts teams of high school and middle school students in the position of newly hired IT professionals tasked with managing the network of a small company. In the rounds of competition, teams are given a set of virtual images that represent operating systems and are tasked with finding cybersecurity vulnerabilities within the images and hardening the system while maintaining critical services. Teams compete for the top placement within their state and region, and the top teams in the nation earn all-expenses paid trips to Baltimore, MD for the National Finals Competition where they can earn national recognition and scholarship money.
There are teams all over the US looking for industry volunteer mentors. I've been one for 6 years and find it very fulfilling to develop next-generation cyber professionals.
See http://www.uscyberpatriot.org/.