This title left intentionally blank

This title left intentionally blank

Speakers: Toni James, Organizer

Conference: CHCon

YouTube: https://www.youtube.com/watch?v=Y1dUfL2EBS4

Overview

In a departure from typical technical presentations, Toni James, a seasoned organizer of CHCon, delivered a deeply personal and reflective talk titled "This title left intentionally blank." This unconventional title, born from missing a submission deadline, perfectly encapsulated the essence of her narrative: a journey of self-discovery, career evolution, and the profound impact of community in the often-demanding world of cybersecurity. Rather than detailing specific vulnerabilities or attack vectors, James offered a candid account of her decade-long involvement with CHCon, tracing her path from a software engineering intern to a security engineer, and highlighting the pivotal role the local hacker community played in her professional and personal growth.

The talk serves as a powerful testament to the value of community engagement, mentorship, and resilience in navigating a cybersecurity career. James articulates how CHCon, which celebrated its 10th conference (though not its 10-year anniversary) at the time of this talk, transformed from a small, intimidating meet-up into a vibrant, supportive ecosystem that nurtured her talents and provided a safety net during challenging times. Her narrative underscores the critical importance of human connection in an industry often focused on technology, demonstrating that a strong community can be as crucial as technical skills for career advancement and personal well-being.

Ultimately, "This title left intentionally blank" is an invitation for attendees to reflect on their own journeys and the meaning they derive from their involvement in the security community. It champions the idea that everyone has a unique story to tell and valuable contributions to make, regardless of their perceived expertise. James's story is a compelling argument for active participation, volunteering, and mentorship within the cybersecurity landscape, positioning these activities not just as altruistic endeavors but as fundamental pillars for individual and collective success.

Background

▶ Watch: Introduction and talk title explanation (0:00)

The genesis of Toni James's journey, and by extension, the CHCon community, dates back to 2016. At the time, James was a computer science student and software engineer intern in Christchurch, New Zealand. She, along with a friend, stumbled upon an Information Security Interest Group (ISIG) meeting held above a local establishment. Her initial impression was one of discomfort, walking into a room of "12 to 15 people, all wearing black hoodies, all men." This common portrayal of the hacker community, often perceived as insular and exclusive, quickly dissolved as she and her friend were "immediately swarmed" by welcoming individuals – Dan, Kevin, Kim, and Chris – who were eager to connect.

These individuals were the nascent organizers of what would become CHCon. Recognizing James's enthusiasm and her connection to the university, they enlisted her help to promote their inaugural conference. James's proactive suggestion for "some type of hacker 101 or infosec 101" training was embraced, leading to her successful recruitment of 25 students to attend the training at the first CHCon, held at ERA Institute. This initial event, drawing 100 attendees, proved to be a pivotal experience. It was here that James witnessed seminal moments, such as Grace delivering a talk on the history of lockpicking (a talk that would go on to be presented at 12 other conferences) and Alex Mango PDF "pickpocket[ing] someone's wristwatch." She also learned what fuzzing was, marking her first exposure to advanced security concepts.

This early involvement laid the groundwork for James's deep integration into the CHCon community. From attending as a student, she quickly transitioned into a speaker role. In 2017, despite being a junior software engineer, she delivered her first conference talk, a 15-minute presentation on Capture The Flag (CTF) competitions, which she was asked to extend to 45 minutes on the spot. Her success in converting audience members to CTF players further solidified her commitment to the community. The following year, in 2018, she officially joined the organizing committee, taking on the demanding role of a conference organizer alongside her full-time job. This progression highlights the organic growth of both James's career and the CHCon community, evolving from informal gatherings to a structured, impactful annual event.

Key Findings

▶ Watch: First conference talk and becoming an organizer (5:45)

Toni James's narrative, while personal, yields several profound "findings" that resonate broadly within the cybersecurity industry, particularly concerning career development, community resilience, and personal well-being. These are not technical discoveries but rather critical insights into the human element of a highly technical field.

Firstly, the talk powerfully illustrates the transformative power of community and mentorship. James's journey from a curious intern to a respected security engineer was not a solitary endeavor. Her initial discomfort at the ISIG meeting quickly turned into a welcoming embrace by the CHCon founders, who actively encouraged her involvement, speaking, and organizing. This sustained mentorship and support system provided her with opportunities she might not have otherwise pursued, directly leading to her career transition into cybersecurity. The "three offers in her inbox" on the very day she lost her job, attributed directly to her community involvement rather than her resume, stands as a concrete testament to this finding.

Secondly, James highlights the critical importance of proactive community building and inclusivity. The early efforts of the CHCon organizers to welcome newcomers, like James and her friend, were foundational. Creating an environment where individuals felt comfortable asking questions, volunteering, and eventually speaking, fostered a diverse and engaged community. The evolution of CHCon badges, from simple identifiers to interactive, build-your-own soldering projects, exemplifies how the conference actively sought to engage attendees in hands-on, educational experiences, further deepening their connection to the community and the technical aspects of the field.

Thirdly, the talk offers a stark and honest finding regarding burnout in cybersecurity. James candidly shares her experience in 2021, where despite achieving her "perfect job" and remote work, she found herself "incredibly depressed" and burned out. This finding underscores that career success alone does not guarantee well-being, especially in high-stress fields like cybersecurity. Her recovery was significantly aided by the community, which sent a "care package" and offered unwavering support, demonstrating that a strong community acts as a vital buffer and support system against professional exhaustion and personal crises, such as her house flooding.

Finally, James's story reveals that everyone has a valuable story or contribution. Her initial reluctance to speak, contrasted with her eventual success and the encouragement she received, is a powerful message. The talk itself, initially "intentionally blank," embodies this finding, proving that even an unscripted, personal narrative can deliver profound insights and inspire others. This encourages individuals, regardless of their perceived technical prowess, to engage, share, and contribute, recognizing that diverse perspectives strengthen the collective.

Technical Deep Dive

▶ Watch: Running an in-person conference during COVID-19 (12:30)

While "This title left intentionally blank" is fundamentally a narrative about community and personal growth rather than a traditional technical deep dive into specific vulnerabilities or security architectures, the talk provides glimpses into the technical landscape that shaped Toni James's career and the CHCon conference itself. The "technical deep dive" here is therefore interpreted through the lens of the speaker's engagement with technical concepts and the technical components integrated into the conference experience.

James's first exposure to a specific technical concept at CHCon 2016 was learning about fuzzing. While she doesn't elaborate on the specifics of fuzzing techniques (e.g., generational, mutational, protocol-aware fuzzing), its mention signifies her entry into understanding methodologies for discovering software vulnerabilities. This foundational learning moment, alongside witnessing a talk on lockpicking, illustrates the broad spectrum of technical security topics presented at the conference.

Her progression into a penetration tester role in 2019 marks her direct involvement in offensive security. James describes the "fun moments" of pen testing, such as identifying critical vulnerabilities within 30 minutes of assessing an application and immediately advising customers to halt operations. This highlights the practical application of technical skills in identifying security flaws, understanding risk, and recommending mitigation strategies. However, she also notes the frustration when clients failed to implement these mitigations, leading to recurring issues – a common challenge in the security industry that touches upon patch management, security debt, and the operationalization of security findings.

The conference itself incorporated technical elements designed to engage attendees. The 2018 CHCon, themed "Tron," featured highly interactive badges designed by Jeremy and Ryan. These weren't just static identifiers; they were programmable devices that attendees could customize. The conference even provided a soldering station for a "build your own badge competition," implicitly teaching basic electronics and hardware manipulation. James specifically mentions Metaltorm, who spent the entire conference "playing with the badge and programming that particular badge," showcasing the appeal of hands-on technical engagement. This integration of hardware and software interaction transforms a conference badge into a miniature proof of concept for embedded systems security or hardware hacking, albeit in a playful context.

Furthermore, James's early involvement in Capture The Flag (CTF) competitions, which she spoke about at CHCon 2017, points to a crucial technical learning methodology. CTFs are hands-on cybersecurity challenges that require participants to apply various technical skills – ranging from reverse engineering, cryptography, web exploitation, forensics, and binary exploitation – to solve problems and find "flags." Her success in converting attendees to CTF players underscores the effectiveness of these gamified technical exercises in skill development and community building.

Finally, her ultimate career transition to a security engineer role for an international company in 2022 represents a culmination of her diverse technical experiences. A security engineer typically bridges the gap between development and operations, focusing on integrating security into the Software Development Life Cycle (SDLC), designing secure architectures, implementing security controls, and automating security processes. This role requires a blend of offensive (from pen testing) and defensive (from understanding mitigation) technical expertise, demonstrating the comprehensive skill set fostered by her journey through the CHCon community. While the talk doesn't delve into the specifics of her security engineering work, it signifies a deep engagement with the technical aspects of building and maintaining secure systems.

Demo / Proof of Concept

▶ Watch: Experiencing burnout and receiving community support (14:40)

This particular talk by Toni James, "This title left intentionally blank," did not include a live technical demonstration or a traditional proof of concept for a security vulnerability or tool. The nature of the presentation was a personal narrative and reflection on her career journey and the role of the CHCon community.

However, the talk did feature a brief video segment showcasing an innovative aspect of a past CHCon event: the Tron-themed conference badges from 2018. This video demonstrated the interactive and programmable capabilities of these custom-designed badges, which attendees could build and customize themselves at a provided soldering station. While not a direct security demo, this visual element served as a "proof of concept" for how a conference can integrate hands-on technical engagement and community participation through custom hardware. James highlighted Metaltorm, an attendee who spent the entire conference "playing with the badge and programming that particular badge," underscoring the success of this interactive technical feature.

Additionally, James referenced a previous talk she gave at CHCon 2017, where she delivered a 45-minute presentation on Capture The Flag (CTF) competitions. For that specific talk, she mentioned being "never more prepared," having "video," "screenshots," and a successful "live demo" which helped convert many audience members to play CTF. While the details of that demo were not revisited in this talk, its mention serves as an example of her past engagement with technical demonstrations at the conference.

Defensive Implications

▶ Watch: Community support after job loss: The ultimate takeaway (19:25)

While Toni James's talk does not present specific technical vulnerabilities or defensive strategies in the traditional sense, it carries profound defensive implications for the cybersecurity industry at a community and individual level. These implications focus on building resilience, fostering talent, and sustaining the human capital essential for effective cyber defense.

Firstly, the talk underscores the critical need for community-driven talent development. James's journey from a curious intern to a security engineer was directly facilitated by the CHCon community, which provided her with learning opportunities, mentorship, and a platform to speak and organize. For organizations seeking to bolster their defensive capabilities, this implies investing in and supporting local security communities. Encouraging employees to attend, speak at, or volunteer for conferences like CHCon can cultivate new skills, foster professional networks, and expose individuals to diverse perspectives that are crucial for adapting to evolving threats. This is a "defensive" strategy against skill gaps and a stagnant workforce.

Secondly, the narrative highlights the importance of combating burnout as a defensive measure. James's candid account of her burnout experience, despite achieving career success, is a stark reminder of the mental health challenges prevalent in cybersecurity. A burned-out workforce is less effective, more prone to errors, and more likely to leave the field, thereby weakening an organization's defensive posture. The community's response to James's crisis – offering support and care – demonstrates a vital "defensive" mechanism against attrition. Organizations should cultivate internal support networks, promote work-life balance, and recognize the signs of burnout to protect their most valuable asset: their people. This is a defense against the erosion of human resilience.

Thirdly, the talk advocates for proactive networking and knowledge sharing. James's ability to secure three job offers on the day she lost her position was a direct result of her extensive network built through years of community involvement. For defenders, this means actively participating in forums, attending conferences, and building relationships beyond their immediate teams. A strong professional network serves as an invaluable resource for sharing threat intelligence, discussing defensive strategies, finding solutions to complex problems, and identifying career opportunities. This constitutes a collective "defense" mechanism against isolation and a lack of information.

Finally, the emphasis on inclusive community building has direct defensive implications. James's initial discomfort as one of the few women in a room of men underscores the historical lack of diversity in cybersecurity. By actively welcoming and nurturing diverse talent, as CHCon did for James, the industry can tap into a broader range of perspectives and problem-solving approaches. Diverse teams are proven to be more innovative and effective, making them a stronger "defense" against sophisticated adversaries who exploit monocultural thinking. Encouraging new voices and different backgrounds strengthens the collective intelligence and adaptability of the defensive community.

In essence, the defensive implications drawn from "This title left intentionally blank" extend beyond technical controls to encompass the human, social, and cultural aspects of cybersecurity. Building a resilient, knowledgeable, and supportive community is presented as a fundamental defense against both external threats and internal challenges like burnout and skill shortages.

Key Takeaways

• Community is paramount for career growth: Active involvement in cybersecurity communities like CHCon provides invaluable mentorship, networking opportunities, and a platform for learning and speaking, significantly impacting career progression and resilience.
• Burnout is a serious threat, and community offers a safety net: Even with a "perfect job," burnout can strike. A supportive community plays a crucial role in providing emotional and practical support during personal and professional crises, acting as a vital defense mechanism against professional exhaustion.
• Networking yields tangible career benefits: Building a strong professional network through community engagement can directly lead to new opportunities, as evidenced by the speaker receiving multiple job offers solely due to her community connections.
• Everyone has a valuable contribution: Regardless of experience level, individuals are encouraged to share their stories, volunteer, and speak. Diverse perspectives and participation strengthen the collective knowledge and vibrancy of the security community.
• Conferences are more than just talks: Interactive elements like CTFs and build-your-own badge soldering stations foster hands-on learning and engagement, making technical concepts accessible and enjoyable.
• Inclusivity drives community strength: The welcoming environment created by CHCon's founders, despite initial discomfort, highlights the importance of fostering an inclusive space to attract and retain diverse talent, which is crucial for the industry's overall health.

About the Speaker(s)

Toni James is a long-standing and integral member of the CHCon organizing committee, with a decade of involvement in the conference and the broader New Zealand cybersecurity community. Her journey began as a computer science student and software engineer intern in 2016, where her initial curiosity led her to the nascent CHCon community. She quickly transitioned from an attendee to a proactive participant, helping to organize the first conference's training sessions.

Over the years, James's career evolved significantly alongside her commitment to CHCon. She progressed from a junior software engineer to a full software engineer, all while taking on the demanding role of a conference organizer for CHCon starting in 2018. Her passion for cybersecurity eventually led her to a role as a penetration tester in 2019, where she gained hands-on experience in offensive security. After navigating a period of significant personal and professional challenges, including burnout, she successfully transitioned into a security engineer role for an international company in 2022. James is known for her dedication to fostering community, her willingness to mentor others, and her belief that everyone has a unique story to share. Her talk reflects her deep gratitude for the support and opportunities provided by the CHCon community throughout her career.