Skip to content

Category: Learning

Using ACTA methodology to Bug hunting writeups

Ideas

In the security industry, we are lucky to have many hunters sharing their write-ups in public. To learn deeper from these write-ups, we should have some methodologies to extract knowledge from these experts.

Applied Cognitive Task Analysis (ACTA) is a methodology used by researchers to elicit knowledge from different domain experts. I think it is an interesting methodology to experiment with to see if we can extract knowledge in a structured way from the bug hunting experts.

Note: I will be experimenting with a few techniques from ACTA and adjusting it to secondary texts like bug write-ups, blogs, youtube videos, news, Github commits etc. instead of the interviews with experts.

The goal is to see the contrast between Novice bug hunters like me and Experts bug hunters and then use the learned knowledge to improve my own hunting methodology.

How do you conduct your Breadth studies?

Breadth studies are any studies which takes you outside of your field of specialization. You want to do breadth studies as it helps you to rest from your field of specialization.

Today, there are so much information about different subjects from books, MOOC and internet blog posts. We need an approach on how to conduct our breadth studies without becoming a dilettante and make the studies to be sustainable.

Criteria for picking subjects

Don’t learn something for the sake of learning or because it is popular (appearing in media and news article). Instead, consider using below criteria as a guide to your decision:

  • Humanity-Natural reason: Subjects that makes you be more connected as a human and to nature.
  • Complementary reason: Subjects which helps to advance yourself further in your field of specialization.
  • Exploratory reason: Subjects in which you might want to add to your specialization but unsure now.
  • Practical-Living reason: Subjects which teaches you how to live practically in modern world.

One of the most practical truths that Daniel Miessler shared is that learning is an integration problem. When you learn something new, you have to decide whether to integrate this new thing into your life and work.

There are many techniques available (e.g. Spaced Repetition) which can help you memorize this new thing that you are learning. At some point, you cannot just remember things. You need to consider whether to integrate this thing into your life or dropped it because it is too difficult to integrate into your work / life.

For Breadth studies, you will face the integration problem. If you cannot integrate what you learned in your Breadth studies to your actual work or life, then it will not be sustainable. Think hard about how you can use this thing that you have learned.

How do you know what truly engages you?

I felt that many news, tweets, YouTube videos, blogs and forum / aggregators are constantly to trying to engage my attention. As a result, I struggle to know what are the things that I truly find it engaging.

Everything seems engaging to me because they looks new and something that I don’t know. But I seldom have any sustainable engagement with these resources. Therefore, I should not use these resources as a measurement of what I truly want to engage in.

Instead, I should try to study and practice the foundations of these resources that I am often trying to look into. Only with a sustainable study of these foundational fields, then you can truly know what engages you the most.

The “question” heuristic

How do you know what truly engages you? Use the simple heuristic: If you have many questions while studying the fields, the chances are that this field of work engages you the most compare to other fields.

You might also find other fields to be engaging as well but not something you want to deep-dive. In that case, you should treat them as breadth studies (just by knowing the fundamental principles should be sufficient).

Beware of judging that a field is not something that engages you just because you have no questions while doing an initial study.

There is also a possibility that you are using the wrong resource to study (that is why you don’t even know what to ask to find out more). A good resource brings out more questions from your mind. Or you are missing some knowledge or real life experience to ask any questions. Thus, you cannot pre-maturely judge that the subject does not engage you because you have no questions now.

But if you have done a thorough study and yet the questions are not flowing out of your mind, the chances are that the field is not engaging enough to your current life context.