Where Should We Go?

As I mentioned in the previous chapter, the Chamber began to suffer a series of attacks against its IT infrastructure. They were denial-of-service (DoS) attacks and exploitation attempts against the main site, which, for the most part, were blocked by the WAF I had deployed. Still, there’s always the possibility that a protection mechanism will fail, allowing attackers to cause damage to the organization.

With that, I managed to convince my bosses it would be important to set up an incident response team, also known as a CSIRT (Computer Security Incident Response Team), and to begin participating in information-sharing networks with other similar teams. I already knew that much of the best material in the field came from the CERT in the United States, linked to Carnegie Mellon University. In my research, I discovered that those same courses were offered in Brazil by CERT.br, maintained by NIC.br under the Brazilian Internet Steering Committee and responsible for incident response coordination for Brazilian internet resources.

The training took place in São Paulo, at CERT.br’s headquarters. I explained to my boss that this would be an opportunity not only for learning but also for meeting the people at CERT.br in person, which could make future interactions during incidents easier. So Conrado and I headed to São Paulo for the course. During the training, we met professionals from CERT.br and from other organizations that were also setting up their CSIRTs. The course was very worthwhile, and we left with several ideas to implement at the Chamber. The main one was to join the communications network of the country’s CSIRTs, which was coordinated by CERT.br. To do that, we would need to register and would receive a VoIP phone that would allow direct communication with other teams.

Back in Brasília, we started working on formalizing the Computer Security Incident Response Group of the Chamber of Deputies (GRIS-CD). It was a long process, but we managed to officially define the group and its responsibilities. Next, we registered with CERT.br and became part of the network of Brazilian CSIRTs. The part involving the VoIP phone ended up taking longer than expected, due to a shortage of equipment. It took so long that I had already left the Chamber by the time the device finally arrived. I only heard about it because my former boss sent me a message saying my project had finally been completed.

One of the things I had always wanted was to spend some time abroad. I’ve already mentioned that I applied for some jobs at international companies. At the time I was at the Chamber, Gisele worked with a Cuban colleague whose Brazilian wife worked for the United Nations. That sparked our curiosity. Gisele started gathering information and telling me how those careers worked, and I also started researching on my own. One of the first things I discovered was that Brazilian civil servants are entitled to unpaid leave to work in international organizations in which Brazil participates. That gave us important job security: we could try living abroad without having to give up our jobs. I also started to understand better how the hiring process worked at those organizations. Unlike Brazilian civil service exams, positions are specific to roles and experience levels. There’s no such thing as a general entry with later assignment of functions.

I decided to try, with Gisele’s support, and put together a plan. The first step was to identify all international organizations of which Brazil was a member. I found a list from the Ministry of Foreign Affairs and began using it to locate those institutions’ job sites. I also installed a browser extension that notified me daily about new opportunities, which let me keep track of openings and apply whenever something compatible with my profile came up. Over time, I applied to several positions until, at one point, I was called in for the final stages of a process at the World Bank. I did tests and interviews and was told I had reached the last phase, with only internal approvals remaining. The wait was long, until I got the news that the position had been canceled. It was both frustrating and motivating: frustrating because I had come so close, but motivating because it showed that I had real chances.

There was also a process for the UN Secretariat, for a position focused on network security, an area in which I already had plenty of experience. I did the written test and a phone interview, and waited for the final answer. They asked for a month, then another, and then simply stopped answering. After some time, I concluded that process wouldn’t move forward either. I kept trying other opportunities until Gisele and I started considering alternatives. It was clear that getting a UN position could take a long time, with no guarantee of success. So we began evaluating the possibility of requesting leave to do a graduate program abroad. Through contacts Gisele had from her master’s degree, she managed to be accepted into the computing PhD program at the University of Coimbra, in Portugal. This happened shortly before my trip to the OWASP conference in Beijing.

While I was in Beijing, I got an email informing me that I had been selected for a position at the UN, in New York. Since Gisele had already been accepted at Coimbra and was starting the process of requesting leave from work for a PhD, we faced a difficult decision: Coimbra or New York? PhD or UN? The time difference between Beijing and Brasília made communication very difficult. Besides, at that time, internet access wasn’t as trivial as it is today, and I depended on specific places with Wi-Fi to connect. I forwarded the email to Gisele, but I needed to talk to her before making any decision. It took about 24 hours until I was able to reach her, though anxiety made that time feel much longer.

When we finally managed to talk, I discovered that everyone was already celebrating the move to New York. While I was anxious in Beijing, the family in Brasília was already treating it as a decision made. Still, the process wasn’t entirely over: there was plenty of paperwork to sort out before everything became concrete. But that’s for another chapter.