The Force

In this engaging conversation, Chris Glanden interviews Kevin Johnson, a seasoned expert in IT and cybersecurity. Kevin shares his extensive journey from system administration to becoming a leader in penetration testing and ethical hacking. He emphasizes the importance of hands-on learning, the evolution of penetration testing standards, and the role of open source in the industry. The discussion also touches on the significance of community, acknowledgment, and charity work in cybersecurity, along with personal anecdotes and insights into the future of the field.00:00 Introduction to Kevin Johnson03:39 Kevin's Journey in IT and Security06:29 The Evolution of Penetration Testing09:35 Transitioning from IT to Security12:30 The Importance of Hands-On Learning15:28 Involvement in Open Source Projects18:38 The Role of Mentorship in Career Development21:14 Ethical Hacking and Its Misconceptions24:23 The Future of Cybersecurity27:27 Understanding Risk in Cybersecurity29:14 The Evolution of Penetration Testing Standards31:00 The Human Element in Penetration Testing32:46 The Challenges of Automated Pen Testing35:26 Transparency and Knowledge Sharing in Cybersecurity39:36 Standing on the Shoulders of Giants44:41 The Importance of Acknowledgment and Gratitude48:26 The 501st Legion: Charity Through Cosplay53:08 Creating a Cybersecurity-Themed BarSYMLINKS[Secure Ideas Website] Kevin Johnson’s cybersecurity consulting and training firm, offering penetration testing, security assessments, and educational resources. It also hosts blog posts and tools created by the Secure Ideas team.[Kevin Johnson on LinkedIn] Kevin’s professional LinkedIn profile, where he shares insights on cybersecurity, career development, and industry leadership.[@secureideas on Twitter (X)] – Kevin’s Twitter/X account, where he frequently shares thoughts on InfoSec, pen testing practices, open-source contributions, and industry transparency.[Samurai WTF (Web Testing Framework)] – An open-source Linux distribution for web application penetration testing. Co-created and taught by Kevin, this toolkit helped train thousands of security professionals in hands-on ethical hacking.[BASE (Basic Analysis and Security Engine)] – A fork of the discontinued ACID project for Snort, created by Kevin to continue development and improve IDS event analysis. This project marked a pivotal moment in his open-source journey.[SANS Institute] – A premier cybersecurity training organization where Kevin became a senior instructor, authored multiple courses, and earned the GCIA, GCIH, and GCFA certifications that shaped his professional trajectory.[Penetration Testing Execution Standard (PTES)] – http://www.pentest-standard.orgAn industry-defined standard for performing thorough and ethical penetration tests. Kevin is actively involved in modernizing this standard to reflect current tools, risks, and methodologies.[OWASP (Open Worldwide Application Security Project)] – A nonprofit organization focused on improving software security. Kevin previously served on the global board and has long supported OWASP's community-driven tools and educational efforts.