@Anthony Certainly sounds on topic here. It would help to post a single brief question. It sounds like you are asking "How do I help my staff develop a sense of intuition without specific evidence about security matters?"

@this.josh isn't that just going to be opinion based/

@Anthony As for answering the question, I think it's partally down to experience, and learning not to jump to conclusions too

I'm not an expert in jdlr, but I am led to believe that some people are. If he can't ask it here, is there anywhere he could ask it?

I work on a help desk right now, and the new guys tend to jump to conclusions about issues, before gathering all the required information - I'll see them continue to run with whatever conclusion they've come to, even after there's information going against said conclusion

Experience is.... something that can't be taught

jdlr?

True but particular insights can be developed.

Ah googled it

yup

but I'd say 50% of it isn't trusting your gut as well

Or is trusting to not trust yourself because 'While it makes me think it's normal, maybe it's not...'

No, of course its not trusting your gut, its developing a System 1 response, so that your System 2 thinking can do analysis.

en.wikipedia.org/wiki/Thinking,_Fast_and_Slow re system 1 and system 2 thinking

Nod

You can train people to be artistic judges of ice skating, dance, etc. I think you can also train their intuitions about security.

is it intuition then?

:/

that's my point.

The problem with 'training' someone in this, is that you can never train all circumstances

Its a more subconcious type of thought than strictly analytical thought.

yup

Prior to this job I also worked monitoring water plants and reservoirs

Of course not, you can only train them against broad patterns or specific well knowns.

now that was deeply intutional

What looked like a 'oh crap!!' moment, would turn out to be a farmer just filling up his tanker..

It was developed after you were trained with the right stimulus.

There'd be no previous matching event for around a year at a time

Sure, but it seems ok to at least ask the question. Compared to most questions we seem to attract these days...

haha yeah

@JeremyBanks Sure. I know many of the regulars here work for consulting companies that would be happy to help, some with specific expertise in software security (disclosure, I am one of those too :-) )

@JeremyBanks d'oh! I was wrong, I take no credit at all! It was BugCrowd I was talking to, I can never keep those two straight :D

I guess my talk with him didnt work though, so I get ZERO credit for that ;-)

well, except for originally suggesting / asking for it, 5 years ago...

@this.josh this is why I recommended @Anthony come here first - I think there is a core question here which is valuable and on topic, we just need to make sure we avoid the opinion-based bits

@Anthony from skimming, I'm not really sure exactly what you are trying to teach them to have intuition about

like just recognizing when a situation needs more attention?

I do tend to agree it is more of an experience thing if that's the case. You can certainly "train" it more quickly by having multiple people look at something and have the person who is good at it point out the things that were missed

that way it's a shorter cycle between what they looked for and what they missed

but you develop a feel for things by experience

having a set of good and bad examples might help too

as far as how to ask the question on the site, probably asking about particular mechanisms and how they work could be good subjective. People can give any ideas for how to help refine people's experience and provide support for the effectiveness

the mechanism of gaining benefit from a particular practice is pretty supportable

Hi, I will participate to trendmicro.com/en_us/campaigns/capture-the-flag.html this weekend. I don't know much about reverse engeneering, cracking & others but i'll give a try to easy challs. I'll register tommorrow, let a message here if you wish to form a team :)

@Xavier59 I'm unfortunately shooting for the streaming tv series I'm working on on saturday and then driving to delaware for a funeral on sunday

@Xavier59 I have no idea what they mean with "targeted attacks and ICS challenges" in a jeopardy ctf context...

You're forming your own team oooor sec.se ctf team?

@HamZa I don't neither. I'm just guessing this will be the same type of challenge that the previous ctf.

github.com/ctfs/write-ups-2016/tree/master/…

I'm not decided if I should form sec.se team or my own one, as I will be probably pretty useless in this ctf. But if there is more than 3-4 people, sure we can

@Xavier59 I guess i'm in the same situation as yours... Plus maybe sunday is "feast day"

@HamZa I should be present the whole weekend but still, this ctf seems a lot to be about reverse engeenering, something I'm not good at all.

@Xavier59 not my forte either. Let's just sign up as a random team and see if we can do something?

@HamZa Sure. I'll wait till tomorrow to see if some others want to join. (benoit seemed interested)

@BenoitEsnard @Arminius ^^

@Xavier59 ok, I think we need to register before the competition starts. Some CTFs close registration after it has started

I forgot that we still had time to register tomorrow