Thread by @cynicalsecurity

To honour the 8th of March I shall tell the story of a student of mine when I still taught for SANS.

I was teaching the “Hacker Techniques & Incident Handing” course in London and one of the attendees came from DEFRA (the Department of something something and Agriculture)…

and was the only lady in a class of 50+.

After the first day she came up to me, terribly flustered, saying that she thought she had signed up to the wrong class because she was lost compared to her neighbours.

It took a lot of reassuring: the class was filled with überhaxxors…

but she agreed to stay on and give both of us a chance.

All I did was, during exercises, to make sure that she was trying them by walking past her screen as I made my rounds. At best I helped her once or twice with a bit of Linux.

We eventually got to Saturday, the hacking day

which, unlike the US courses, I always ran as a “team exercise” (I like building APTs not solo rockstars). Unfortunately she was in a team of überhaxxors who turned up with two laptops each and immediately set up an IRC server.

By the first coffee break the first flag had fallen

and her team was one of those which had managed to capture it.

Funnily enough the überhaxxors were rather upset so I walked to them and asked what the problem was. The lady from DEFRA was beaming: she had the flag.

Why? Because she used her brain instead of her testosterone...

and instead of hitting the machine with all the technology they had (i.e. installing all the hacking tools which Google provided) she actually thought about the problem, caught the hints I had dropped during the week and put it all together.

Moral: brains > testosterone. Always.