On todays episode:
I’ll be talking with Ermis Catevatis, who is an offensive security professional, with a background in red teaming, physical penetration testing and software development. We’ll be talking about a new platform that he developed to help upskill red teams, and provide organizations with capabilities to test their internal security posture against new and emerging threats without the need for external engagements.
Below is the transcript of the podcast and links to some of the references as well.
https://youtube.com/@redstack1111
https://twitter.com/redstackio
https://www.linkedin.com/in/ermis-catevatis
[00:00:00] Daemon: Today I’m joined with Ermis Catevatis. He’s the principal security consultant for Cyberology and for Archetype security, and also the founder of DC604, the Defcon community in Vancouver.
Thank you for joining us today, Ermis. Now what I usually do when I get guests on here is I get them to talk a bit about how they got to where they are, because there’s different ways that people can approach getting into the industry and I always find it very interesting to see those different avenues.
So I’ll pass it over to you and if you could please give me a bit of a background on how you got to where you are.
[00:00:36] Ermis: Sure. Yeah. Well, let me start off by saying I’m the ex-founder of DC604. I left in 2018. So, I had founded the group with two friends of mine, but that’s, that’s no longer happening. So, for my beginnings I started hacking when I was really little.
I didn’t come from the academic space or the IT space. I actually started just being interested in hacking into things. So, when I was really little, my dad bought me an [00:01:00] IBM model 25 and it had a modem in it, and I was lucky to have older cousins that knew how to dial into BBSs. So, they trained me and then I started wardialing.
I hacked into some pretty big BBSs, and I was just a child. So, I kind of grew up from that and moved over into IRC. I think that was like a natural progression for me to go from there and look. I was looking for other hackers on IRC, so I came up with a couple hacking groups on F-Net.
One of them was developing exploits at the time, so I really early on, got into assembly and c programming and trying to learn how to write my own exploits with this group. And then that kind of led into the, I’ll call it a grey-hat hacking career cuz I was never super malicious. I was just more curious.
So , that was kind of the early beginnings of, my life. And that’s what I spent a lot of my free time on. I would tend to skip a lot of school and sit in a library and hack their computers or read books or skip school, go home and work on my [00:02:00] computer. So that’s kind of my, early on. . After that I, I got a job for some reason as a Safe and Vault technician, and then I worked for the National Banks of Canada.
A lot of them, like ScotiaBank and RBC, I was one of their vault technicians. I worked on their ATM machines. was one of the technicians that would break into these ATMs and vaults when they broke or had a malfunction. So that was a great experience. I worked in that industry for a while.
I even did some jobs with the Vancouver Emergency Response Team. It’s like the Canadian SWAT team. So I was the lock picker for drug raid for the E R T. So that was a lot of fun when I was young. After that I went to UBC kind of to get my, degree to shift off of that kind of work and go into the professional side of cybersecurity and IT.
I’d worked as a consultant for a bit even, even before UBC. I worked as a consultant. And then at UBC, I remember you were one of my professors, which was kind of awesome. Yeah. And even during school there, like I was [00:03:00] shot for cash and you were hooking me up with jobs and you helped me land some client and get some work and make some money on the side, which was great as a student. So, you know, this kind of person Daemon is if anyone’s wondering.
[00:03:12] Daemon: . You know, you always gotta pay it forward, right. Always, help people that are emerging into the industry.
[00:03:17] Ermis: Yeah. And that was very cool, man. I, I super appreciated that you even helped me get my first job outta UBC.
Actually I’m not gonna name the name, but they were a subsidiary of Parallels and they had a lot of servers and a lot of datacentres. So yeah, after school I got into full-time work and I was building virtualization clusters and networks and security into datacentres and across multiple datacentres.
So I worked on some pretty big, networking projects like 20. , full duplex, cross datacentres doing a lot of BGP stuff, pretty decent, CIDR blocks , like public IP, for the group. So that was a lot of fun projects. After that, I moved over into a couple things. I got more [00:04:00] into professional pen testing out of that job.
And I was also shifting over into the cloud at the same time. So I started doing a lot of DevOps and DevSecOps. and then also pen testing, cloud infrastructure et cetera. So from there, my career just kind of took off and that’s basically been the last 10 years professionally, this industry. So, yeah.
[00:04:23] Daemon: Yeah. That’s awesome. Thanks for that.
One of the, main things that I wanna talk to you about , in this podcast is something that you helped develop and brought over to market, which I think is, really interesting because it changes the way that people that are getting into the industry can learn about pen testing and red teaming and so forth.
So perhaps you can jump in and, tell me a little bit about RedStack, and what was the idea behind it and, who’s using it, and how people can get on that platform.
[00:04:56] Ermis: Sure. So I’ll tell you the origins of Red Stock and I’ll tell you the [00:05:00] use cases for it. The origins of RedStack, it started off as a personal project for me to remember all the commands that I used while I was hacking. Because early on in my career I was trained to remember the whats and the whys of what I was doing. It was like, remember what you’re doing and remember why you have to do it. The how you can always kind of look up and always reference. That really helps when you work as a consultant for a long time you really need to remember your what’s and your why’s, and then you can always kind of reference your notes and you know, we take good notes and we look at old projects and old reports.
So I started building the ver first version of RedStack for myself. This is before I actually got funding and built it. It was a custom project called Hack Cheat Sheets, and I’d shared it with some members of DC604. And we were just kind of using it as our own little private repository of an aggregation of hacking commands for me and a couple other members.
So that’s where the project started when I went and got funding for it. One of the use cases was to close the skill gap for people that are doing this professionally, that are penetration testing professionally, [00:06:00] and we wanted to give them the ability to provide a pentest at a higher level than what they’re currently capable of.
So the idea was to give them an entire attack in the right steps, give them all the right commands and provide that information contextually to them during a pentest. So this is something that a senior or a lead would’ve provided them, they would give them a bunch of attack chains and be like, Hey, we’re working on a Windows domain, go through these attack chains and pentest the Windows domain. So by doing that, the junior or the intermediate pentester would actually be looking at concepts of hacking that are. Even beyond their current knowledge level, but it’s guiding them on how to do it properly. So they’re learning, right?
And , they’re improving and they’re evolving their skillset, which is the nice thing. Versus using automated tool sets or automated adversary simulation tools that are out there. , ? Like they’re just really testing very specific things and you’re not really gaining any knowledge from them.
You’re getting value from it as a business, but [00:07:00] the engineer that’s running it isn’t getting the same educational knowledge from it. Yeah. So that’s kind of what differentiates RedStack. So that was one of the first use cases. The second use case to using Red Stack is education which is funny. It’s even the first one’s education, but it’s in the professional career area. Yeah. The second one is actually using it in the education space by connecting it with a course. So say you’re doing your OSCP of offensive security, the OSCP, everybody knows that, it’s popular certificate.
Offensive security could create a content pack, that provides useful commands for attacking their lab. And then they could provide that content pack and access to it, to all of their members that sign up to their course. So it’s additional educational material on top of the PDF and the videos that they provide. It’s like, Hey, here’s a bunch of commands. Here’s access to a bunch of attack chains and these are things that could potentially help you. So there’s an educational side about keeping knowledge. because I think the part of the downside of the current education [00:08:00] space is that after about six to 12 months, a lot of the content is getting outdated.
Now just things are moving so fast on the defense side, companies like Microsoft are putting so much money into it, and all the defense companies and all the EDR solutions, they’re just going crazy. Any public tool that they find they’re patching everything. Right. They’re making signatures for everything. They’re, adoption is really quick. Right now. So the offensive side needs to find a way to keep up with that. And that’s kind of where I was like, Hey, RedStack could be really helpful for this. You know, kind of keep up the pace. And the course content creators could continually update the content and curate it.
So as the industry evolves, the content in their content pack could evolve, even though the content that they have in their books or their courses may not need to evolve as quickly. So you might build one course for like, hacking windows and, you can cover a lot of topics. And then the content packs on Red Stack could stay continually updated. So that was the second one.
[00:08:56] Daemon: So yeah, I saw that there’s community content packs that come when people [00:09:00] log in and then there’s the contact packs that are curated by RedStack and then you can add additional ones.Different types of them. Once they’re in as contact packs, can they be exported into like a SCORM format that can be important to an LMSs or is that something on a roadmap?
[00:09:19] Ermis: Yeah, that’s a good question. So users can create their own content packs and they can share it with their team or with their students or whomever, right now there’s no export feature out of it. I think that’s something that we would consider like a monetized feature. It’s something that we would build for some use case. Which to me hasn’t come up yet. It hasn’t been requested. And I’m open to do beta tests and feature beta testing with clients that are interested in using RedStack in those ways and building that kind of functionality. And I’d even be open to like some kind of sponsorship to, to develop features like that if it’s wanted.
[00:09:51] Daemon: Yeah, I think that people that are building courses especially in, the educational community, they usually have some sort of [00:10:00] LMS that you need to import content in. So this would be great for them to populate the courses and help them build out those courses so that they can stay relevant to the industry.
[00:10:11] Ermis: Yeah, that’s valid. I’m talking to one company right now that built a platform on the Azure marketplace and we’re in the phase of them requesting for me to build API access to them, to their platform because they want to ingest and use all of my hacking content.
Because we have like over 200 web hacking procedures in there. They’re all really nicely done. If you go look at the web hacking content the guy that built it Mash who’s a really good web hacker, he’s amazing. So that company is looking to ingest this as an API and then display our procedures inside of their platform for not just threat intelligence, like their platform is working with like aggregating sims and launching Sims and, and AppSec stuff.
It’s doing threat intelligence, but they also want to provide instructional material to the developers. [00:11:00] So the developers can actually go and try hacking into things themselves and testing things out.
And that’s kind of where RedStack comes in. And that’s gonna segue right into the third use case that’s been coming up recently is people that aren’t professional pentesters and they’re not trying to become professional pen testers have been using this platform. It’s just regular IT people, like everyday IT people started using this platform. To test their own company security and I’m like it. That’s something I never really thought of when I started building this, but that idea keeps coming up. And it’s even coming up on that API request. Yeah, that’s exactly why they’re requesting it cuz they’re like, Hey, there’s a big use case here.
There’s developers, they understand what this stuff means. They understand what XXC means or XSS is. They understand some of the topics, but they don’t actually know which commands to run or what to do or how to use Burp or whatever. But it’s well described in your content on Red Stack. Yeah. So it looks like another avenue that I’m gonna start, looking into [00:12:00] and seeing if , , everyday IT people have, have a big interest in this. , I’d love to support that space as well.
[00:12:06] Daemon: Yeah. Okay. So it’s kinda like a democratizing the capabilities of a redteam so that other people have some capabilities of that. Like they won’t have the full skillset set, but they’ll at least be able to provide some level of that, within their organization. So yeah, I can definitely see the, the value for that.
[00:12:25] Ermis: I wanted to touch on that. If, if it’s okay. It’s like, consider that you hand over your developer team, say you’re working on an AppSec project. You give them a report and they’re looking at a, a list of things and you itemize and you’re like, Hey, you’re vulnerable to this, you’re vulnerable to this, you’re vulnerable to this. . But anyone that’s worked as a developer, I’ve worked as a developer as well. Not just, a hacker. I’ve worked on the dev side. Sometimes you can look at this stuff and go, well, what is that? What does that actually do? And why do I need to patch it? Like, I know you’re telling me, I know the report says I need to do it, but I don’t actually understand what the hell this is doing.
And these sometimes they don’t wanna go test it themselves. Like, I’ve worked with a lot of developers [00:13:00] that are incredibly smart people, yeah. Much smarter than I. And they run circles around me in the dev world, in DevOps world, in every world, man. Like, we’re all students perpetually. But they want to go test it out themselves. And then your reports that you’ve handed them doesn’t include any of the commands or specifics or like, here’s the procedures and here’s how you do it. It’s like hey, go research OWASP top 10 and go watch some YouTube videos and go do like your burp course and go figure out on your own, essentially.
And that’s what these devs are looking at. And then, hey, here’s another option. It’s like, oh, I’m just handing you like an attack chain and this is exactly what I did and you can go and validate it yourself now and you know what it’s doing to your code. And then they can kind of go into that debug mode as a developer and start debugging it and figuring it out and going a little deeper into it, more than just the surface level of a report that they’ve been.
And maybe a consultation or a presentation that they’ve been handed. Which is great. But yeah, sometimes it helps to give them more and then they can actually dig into these problems. And again, they’re devs. Maybe [00:14:00] they find more long-term solutions to some of these things. Maybe they leave that company and then go build another product that can help people. So I think Education, between the industries, between cybersecurity, between devs and engineers is huge. We, we need to fill that space and close that gap as much as we can.
[00:14:18] Daemon: I also think that being able to take an existing risk management framework and current vulnerability management that a company has where they can see all the different vulnerabilities that they have, but they really need to validate what is the true risk for the organization. They can take some of these TTPs and then start chaining them and see where they’re at risk so they can prioritize their focus. Because if they have just a huge list of vulnerabilities in their environment, it doesn’t necessarily mean that they can be compromised against all them. There may be some that can be chained together in order to provide the keys to the kingdom that they can’t [00:15:00] see. And it may seem like minor vulnerabilities, but chained together, it’s a lot more impactful. So by chaining together these TTPs in a campaign that would be developed in Red Stack, they can actually test those things without getting an outside consulting agency to do it.
[00:15:17] Ermis: that’s a really good point. So let’s look at a scenario, your company doesn’t have its next pentest scheduled for six months down the road and a new exploit is released in. Something for some kind of whatever, LDAP with , Azure Active Directory or something, and your company is, is looking at the severity of it.
And you have your committee look at it, your vulnerability committee and patch management. You’re trying to prioritize it. And you have a lot of DevOps engineers on your team and you’re looking at it and you’re like, well how concerned are we about this? How badly is it gonna affect us? You don’t really have time to wait for your next pentest, you have to make some decisions and it’s really easy to throw a DevOps person a list of commands. Because if Red Stack gets to that commercial point, and we’re back to having [00:16:00] staff again like we used to we’ll be pumping out all those zero days within a couple of days of them coming out, so you don’t really have to wait six months anymore.
Now within a couple days, you can test your own environment, so literally by the time most companies even have that meeting on a vulnerability severity. Go to RedStack, look up the content, test it out yourselves and be like, oh, it’s a big deal. We gotta patch this now. I’ve dealt with small companies and big companies. I know you’ve dealt with small companies and big companies. If you have to patch things at a big company, it’s a lot of work, yeah. Like there’s a large cost that goes into that. And, and there’s a lot of considerations that come down from the directors, sometimes from the C-suite, and especially budgeting around patching and vulnerability management, It’s not something that’s taken lightly. There’s usually a committee in an enterprise or a large corporation. So it really helps to be able to validate something extremely quickly. And this could , be one of. platforms that could help close that gap.
[00:16:52] Daemon: yeah. So can you import TTPs directly from Mitre?
[00:16:56] Ermis: That is on my backlog. Currently I’m the only developer for the [00:17:00] platform. When I did get it funded, we figured out a lot of the r&d we built the editor, we built the search, the search engine, the back. And it was just kind of like a bare bones platform. So after that, the company kind of got shut down for Covid, which sucked. We ran outta funding cuz you know, a lot of startups lost their funding at the beginning of the pandemic. And then I’ve been coding it ever since on my own. So I’m one dev like one single dev, single content creator. But yes.
Sorry to preface all that, I’m just like, I set the stage for. It’s just me. But yeah, I have a massive backlog. I have like multiple sprints that are laid out, and like things that I want to develop and implement in the platform. But the good news is that this platform right now is in it’s current position, like it’s released 2.1.
Everything that I’m adding to it is additional functionality built on top of the base product that we R&D’d in the beginning. Yeah. With our start. So now I’m actually just building cool things. So I can tell you a couple of things that are coming out now. One of them is actual projects. Mm-hmm. [00:18:00] So this next feature is going to start implementing the feature that you’re asking about, like being able to import mitre TTPs but it also allows you to create assets where you can import Nmap scans or Nessus scans, so you can export your Nmap or your Nessus scan, import that right into RedStack. Yeah. And it populates your asset list and then you can start going into your project campaign. So the project campaigns are gonna be really cool.
They’re gonna have methodologies that your penetrations are gonna go through. So you can have like ASVS methodology for web hacking, or you can have your own custom made methodologies. Ones that I develop, ones that other people develop things for attacking, like AWS Cloud or Kubernetes or whatever.
And basically there are gonna be like large campaign checklists. They’re gonna be like, Hey, test this, test this, test this, test. And as you test it, you can connect your different assets to things and be like, oh, I tested it for these. No, didn’t find anything. I tested it for these assets. I found something for this asset and this asset.
I tested it for these assets, [00:19:00] et cetera, et cetera, et cetera. So already, going through this process, one, it’s helping to create stability for penetration testing. Mm-hmm. and repeatability. So when you’re done this, you can actually pump out an entire report and hand that over to a client and then the client will be able to log into RedStack and look at your project with the report and they can see all the chains, all the commands, everything that you’ve done to test everything at every stage of this campaign.
[00:19:27] Daemon: Yeah. I think that documentation’s a really important thing and correct me if I’m wrong, but, you do have some chatGPT integration into there now. Right? So tell me about that.
[00:19:38] Ermis: Yeah. Okay, sure. So I had a little over 1300 commands on the platform and there was no explanation for the commands, and I thought it would be really cool if I could use OpenAI’s ChatGPT three model. Well, one of them I used the DaVinci 003, which is the closest model that they have on their AI right now to ChatGPT three and [00:20:00] I wrote a bunch of code and I fed it each one of my commands and I got it to explain to me what the command is doing and then it fed me back its report.
And then I took all that information and I started in my backend and now it’s showing up on RedStack. So you can actually go onto the platform and look at a command, click on Explain, and then there’s your AI explanation of what the command is doing. So one of the reasons I did that was because at scale when this platform starts to get busy, you’re gonna have like 5,000, 10,000, 20,000.
Who’s gonna write all the explanations for them. Yeah. You know, so I started testing with AI, so that was successful. My next project right now that I’m working on is I’m writing some markdown transformation code that’s going to ingest all of Payload All The Things. If you know that project there’s a couple projects there’s payload all the things and there’s hack tricks.
And they’re two really big git repositories with a lot of markdown and they have a lot of commands. So what I’m writing right now [00:21:00] is code that’s gonna ingest their Git repositories into RedStack and then get some AI that’s gonna write some explanations for the commands and also help build out the procedures.
And those are gonna go into a staging area. And then I’m manually gonna kind of go through them. Maybe me, maybe a friend of mine if somebody wants to help me and validate and then push those over into red stock as proper content. So for the content creation side, I’m gonna be leveraging more AI because it can help speed things up but it can also help scale out the content on the platform. So instead of being at 500 procedures, I’m probably gonna jump closer to like five or 6,000 procedures within the next month and a half by doing this project.
[00:21:40] Daemon: That kind of makes me think of another thing that I was pondering. That is, before this was really created, a lot of the ways that people would have this type of information is they’d have various repos and then they’d have repos of repos, and then you know, you go over to GitHub and then you see the master list of all the, red teaming [00:22:00] resources, and then you go to another one, and then you go to another one.
It’s like you choose your own adventure and then nobody really would keep them up to date. So then you’d have to create your own spreadsheet of what is up to date and, and so on.
And I know one person that really created a lot of interesting info, like back in the day. I got the book Ben Clark made, you know, the RTFM book. Shout out to Ben. But I think that what you’re doing with the RedStack aggregates that all together and keeps things current. So I think that it’s a really innovative platform that allows for the aggregation and the metadata and the documentation, so on.
I think that it’s got a lot of potential in so many different use cases. But yeah, one of the things that I was thinking of as well and maybe you can validate this for me is, when somebody’s going through the OSCP, there’s certain things that cannot be used. Like you can’t use ChatGPT, you know, that’s been banned, you can’t do that.
But could you possibly use RedStack to build a campaign that can help you in doing certain aspects of, of the OSCP?
[00:23:00] Ermis: Yeah. Right now you can. RedStack hasn’t been banned yet from OSCP. I actually sent offensive security a beta key, like for beta access a while ago cuz I’m certified by them. I have my OSCP Cert. So I wanted to be above board and be like, Hey, I built this platform, check it out. Let me know if you’re gonna ban it or not. So I know if I can tell people they can use it for their OSCP. I gave them an access Key, they replied and said, thanks, we’ll take a look. And then I never heard back from off sec ever again. That was it. So as of right now, it’s not banned.
I’m hoping by the end of the year that RedStack is banned, at least for using for their certification. I don’t think you should be using this platform on an exam, at least their exam for the way they operate, which makes sense, but it also doesn’t make sense. I think it’s, kind of like an old school way of thinking saying you can’t use ChatGPT3 because if you do a real life pen test, you’re a hundred percent gonna be using every tool at your disposal. Especially, knowledge sources. Because the industry has changed. When I came up using Linux, I was using Linux since like the nineties, Mid nineties.
[00:24:00] We, would build things off of a man page in a kernel. We didn’t have Google back then. It didn’t exist, right? Lycos sucked. Alta Vista sucked. Like you, you wouldn’t find great guides anywhere. Right. So we, were forced, and that was the old mentality that seems to have stuck around for exams for some reason, right?
They want to test people, considering like, Hey, you’re stuck in the nineties, like, take your exam as if it’s just you. But that’s not how jobs work anymore. Now everyone has a browser open with Google and they’re searching everything because the industry has grown, it’s so vast and there’s so much information and there’s so many different sub fields of tech that nobody can possibly know it all.
Even as a hacker, I’ve touched on some mobile stuff and then I dropped it. I touched on some web hacking stuff and then I dropped it. I go, oh man. It’s just, there’s too much knowledge to stay current. Like, I stay current with infrastructure virtualization network and containerization, cloud. Like I hack that stuff. That’s, that’s my profession, but there’s so many other areas of hacking that I’ve had to drop.
It’s kind of like we’ve become, like the concept of surgeons. You’re not gonna have a [00:25:00] brain surgeon doing foot. It’s just a different profession. It’s a different expertise.
So it’s not really fair to tell people like, Hey, you can use a knowledge source when you’re doing your job, but you can’t do it while you’re testing. Yeah. Then use the cert to go get that job. I think their bigger concern should be about people hiring other people to take the certs for them, or brain dumping certs. I think people that are faking, going through a course or faking the certification process, like, yeah, that, that’s a bigger problem. But an individual that knows how to use Google fast enough to ask a certificate within 24 hours, like, good for them. They, figured out where the knowledge is.
And you gotta understand that not everyone’s brain works as a storage device. Some people’s brains work as a processor, right? Some people are a lot faster thinkers and they’re way more analytical. Versus just memorization, like blank memorization. And I think those individuals, the processor individuals, I think they struggle more with interviews.
I think they struggle more with certifications. But when you actually put them in a job, they’re the critical thinkers. [00:26:00] They’re the innovators, because they’re not thinking about, Hey, I read this in a book. I’ve memorized it. They’re more on the other side. They’re thinking in a different way.
Yeah. Right now Red Stack isn’t banned. I, wanna get banned, I want to be the guy that built the platform that’s banned by every certificate company out there, because I want all those students to then use my platform when they go do their jobs right after they get those certs. Yeah. So, yeah, I mean, follow the guidelines for whatever cert you’re taking, don’t take all my advice do it right. Don’t listen to the hackers, listen to the cert people. But when you’re done the cert, do whatever the hell you want, like get the job. Yeah.
[00:26:33] Daemon: I think that the way that education is being approached really has to change and I think fundamentally the institutions and the people that put together training plans have to adapt to that because of the changing nature of how knowledge is acquired. And also being able to understand that. Like you said, people approach things differently.
But that’s a huge hurdle. I think that the next evolution or I guess, incremental step in where it needs to go is teaching Students how to access as much information as possible and then distilling it down into the relevant things that are applicable to that moment in time.
And one way of of doing that is using AI and, and using AI as, as the means of accessing all the information, putting some context to it and then distilling it down so that they can make the useful interpretations almost like pattern of recognition to see what’s applicable in the certain situations that they’re trying to work with.
Ermis: Well said, well said.
Daemon: That’s what I really like the evolution of prompt engineering as a discrete field. Being able to communicate with large language models, generative AI and so forth, so that you can get an outcome and you let the, the platform do all the dirty work for you, but you have an intent and you structure it in such a way that is able to [00:28:00] create the outcome of the intent that. That’s what I see as the incremental step for the future for academia.
[00:28:08] Ermis: A hundred percent. Yeah. The prompt engineer is a great example. I love that. It’s learning how to use the new tools properly.
You could even consider using RedStack professionally. Like you would have one person on your team that knows how to access the info for the rest of your team and then delivers them that content. You know, touching back on the, the OpSEC thing or using this for your certs like the OSCP, I think it just takes one cyber security, education company, look at TCM, they’re changing things, right?
It takes one company like that to actually just build some content on Red Stack and hand it to their students and be like, Hey, use the platform. Use it for your certs, and then every other company’s gonna be like, oh, we’ve banned that platform. And they’re jumping into it and it’s helping their students, and now they’re getting better at their jobs.
You know, so it really just takes like one early adopter to jump in and be like, Hey, this is a great idea. We see the usefulness of it, want to partner, something like that. So [00:29:00] there are possibilities there, and I think it just takes one to start making that change, and then the rest are gonna have to follow suit.
[00:29:08] Daemon: What would be the best way for somebody that wants to get more information about RedStack or start using the platform?
[00:29:14] Ermis: Yeah, so right now you can just log in to RedStack.io, create an account. Start using it. You can create your own content. There’s an editor that everybody has access to. You can make your own procedure. You can add those procedures into the community content pack so everybody can see them. You can do a bunch of stuff. Sorry, I’ll, I’ll keep answering your question before I go into like how to use the whole platform.
Yeah. Go to RedStack.io If you wanna talk to somebody about it, just come message me, talk to me directly. If you’re a corporation, I can do a demo for your team. We can look at use cases for how you can use it. I can describe to you what’s built right now, that there’s a lot of functionality. You have to remember it’s a framework.
It’s not just a search engine or something like that. There’s a lot of data that’s interconnected. So it can be used in a lot of different ways right now. So essentially early [00:30:00] on, as early adopters talk to me, have me do a demo I’ll show you a team how they can use it and gain value out of it.
And if your company has any interest in additional functionality, just talk to me. And the idea is that if I get enough companies that are all aligning on the same use cases and the same functionality, that’s what’s gonna get built first, definitely have that conversation with me.
Have that convo and tell me what you want. Tell me how your team is using it. Maybe there’s use cases that I haven’t even considered and people are like, Hey, like you could add three little features over here and it would just solve everything for our team right now. Like add in a little bit of reporting functionality or something to export something and then we’re golden.
And I’ll be like, cool. Those will go to the top of my list because I’ve heard requests for it. I mean, I’ve just heard one from you today on the exportation. The import, yeah, definitely working on that one. So that one will come, for importing Mitre stuff . Definitely gonna be recording from that. So yeah, just reach out to me.
We have a Twitter site. There is a YouTube site.
[00:31:01] Daemon: And then so what was the best way to reach out to you?
[00:31:05] Ermis: Just reach out to ermis@redstack.io or find me on Twitter.
My handle is xopt1x I’m also known as opt one. That’s my current hacker alias. There’s no affiliation to any of my old aliases, so it’s, a good clean one. Yep. So those are probably the best ways, and I can, send you those. I don’t know if you wanna put them on the screen.
Yeah, it’s right here somewhere. right there. . Thank you, Daemon.
[00:31:30] Daemon: All right. Awesome. Well, thanks a lot for spending this time with me.
[00:31:33] Ermis: I appreciate it. Yeah. Well, thank you for having me on.
Designing Risk in IT Infrastructure 