The Importance of Deep Work & The 30-Hour Method for Learning a New Skill

https://azeria-labs.com/the-importance-of-deep-work-the-30-hour-method-for-learning-a-new-skill/

The tech industry, especially the security industry, seems outrageously overwhelming to newcomers and even as an intermediate “InfoSec Pro” there seems to be an overwhelming number of paths and topics one can focus on. The problem most of us, especially newcomers, encounter is that we don’t know what to focus on. Even when we find a topic to focus on, we seem to get stuck in the vast pool of resources that are available to us.
Take the GitHub repository Awesome Hacking (highly recommended), for example. Many people are aware of its existence. The very same people are sending me messages and asking where to start and how to not be totally overwhelmed by what seems to be a structured collection of valuable resources but doesn’t seem to solve our problem. But what exactly is our problem? It’s certainly not the lack of resources. Why is it, that although we have access to all the resources we need for developing a new skill, we fail to do so, even if we have the time or could rearrange our schedule to make time for it? Perhaps we have forgotten that the distractions we face on a daily basis prevent us from performing to the best of our abilities.
We all know this feeling when we want to learn something new. We wait until motivation strikes us out of nowhere, then we tinker around for a few hours without a clear direction, checking notifications, and as soon as we realize that we’re not getting anywhere, we get discouraged and give up. Side note: if you wait for motivation, you’re doing it wrong. The formula to induce motivation, in my experience, starts with action, which sparks inspiration, which sparks motivation, which leads to action, and the loop continues.
We also know and have experienced the feeling of flow. The moment when you’re fully focused on a task. You lose all sense of time, and everything seems to flow effortlessly; you forget everything around you and have a feeling of control over the task. This rewarding feeling of flow is best described by Psychologist Mihaly Csikszentmihalyi:

“The best moments usually occur when a person’s body or mind is stretched to its limits in a voluntary effort to accomplish something difficult and worthwhile.”

Mihaly Csikszentmihalyi

Why is it that this state of flow seems so arbitrary and rare, like something that we happen to stumble upon by mere coincidence? Why don’t we strive to create a state of flow as often as possible? After all, it is not only satisfying, but also very productive and yields positive rewards. The reason we rarely reach this state is that we constantly need to remind ourselves that we live in a world full of distractions. And sometimes it is difficult to press the pause button.
To create a state of flow, one must follow certain rules and embrace deliberate practice through a concept called deep work. In order to produce the absolute best results you’re capable of, you need to commit to deep work. The key to developing the ability for deep work is to move beyond good intentions and add routines and rituals designed to minimize the amount of your limited willpower necessary to transition from a distracted state into a state of stable concentration. The rule of thumb is that it takes approximately 25 minutes of focus without distraction to reach a state of flow. If you’re checking your Twitter notifications every 20 minutes, which seems harmless, you prevent your brain from reaching that state and therefore prolong the time required to complete your task.

The Law of Productivity: High-Quality Work Produced = (Time Spent) x (Intensity of Focus)

Don’t make the mistake of confusing productivity with busyness. Doing lots of stuff in a visible manner does not mean you’re being productive. Most of what we do is Shallow Work:

“Shallow Work: Non-cognitively demanding, logistical-style tasks, often performed while distracted. These efforts tend not to create much new value in the world and are easy to replicate.”

Cal Newport

Cal Newport is the author of the book Deep Work: Rules for Focused Success in a Distracted World (which I highly recommend!) and he argues that if you spend enough time in a state of obsessive shallowness, you permanently reduce your capacity to perform deep work. Social Media overuse is exactly the type of obsessive shallowness he’s referring to here, but not the only one. He defines Deep Work as follows:

“Professional activities performed in a state of distraction free concentration that push your cognitive ability to their limit. These efforts create new value, improve your skills, and are hard to replicate. Deep work is hard and shallow work is easier and in the absence of clear goals for your job, the visible busyness that surrounds shallow work becomes self-preserving.”

Cal Newport

Deliberate practice cannot exist alongside distraction. You get better at a skill as you develop more myelin around relevant neurons, allowing the corresponding circuit to fire more effortlessly and effectively. Therefore, to be good at something is to be well myelinated. Through deliberate practice and by focusing on a specific skill, you’re forcing the specific circuit relevant to that skill to fire, again and again, in isolation. This repetitive process triggers cells called oligodendrocytes to start wrapping layers of myelin around the neurons in the circuits, which in turn effectively strengthens the skill.
Ok. This all makes a lot of sense, but I can tell from experience that simply knowing these things won’t put you any closer to your goal. I’ve read an entire book on Deep Work and the biggest lesson I learned when trying to implement Deep Work into my daily/weekly schedule is that if you don’t plan it carefully and make it a strong habit, you will fail to develop this skill and automatically fall back to unproductive tinkering. After all, you have a finite amount of willpower that becomes depleted as you use it. As it turns out, we all have approximately 4 hours of willpower available each day. Trying to force yourself to finally get started while procrastinating is exactly where your willpower gets depleted in the most unproductive way. If you have a fixed plan, a habit, you save your willpower for the actual task.
Another important lesson I’ve learned is that practice != deliberate practice. Deliberate practice refers to a special type of practice that is purposeful, systematic, and stretches your mind to its limits. Regular practice might include mindless repetitions of the same task, while deliberate practice requires focused attention and is performed with the specific goal of improving performance. The natural tendency of the human brain is to transform repeated behaviors into automatic habits. The more we repeat a task the more mindless it becomes. Mindless activity is the enemy of deliberate practice. Behavioral psychologist James Clear confirms,

“Too often, we assume we are getting better simply because we are gaining experience. In reality, we are merely reinforcing our current habits — not improving them.”

James Clear

We all have the capacity to improve our performance in any area of life if we train our brain in the correct way.  This is easier said than done. Let’s be straight here. Deliberate practice is not a comfortable activity and it requires sustained effort and focus. It is basically the process of failing, over and over again, because through failure we know that we have stretched our limits. Take lifting weights as an example. You lift weights until you fail and have to take a break, which is exactly where your body learns to expand its current limits and prepare to be stronger the next time you perform this activity. Force yourself to take on challenges that are beyond your limits. Pick a project that forces you to learn new concepts and techniques. When you read a scientific paper, systematically look up the words and concepts you don’t understand rather than discarding it with a “I don’t understand half of it anyway” attitude.

When performance psychologists began to explore what separates experts, in many different fields, from everyone else, the single coherent answer was: deliberate practice. Our culture loves the story line of the prodigy and the notion that experts posses a inherent talent that separates them from everyone else. But in reality, to master a cognitively demanding task requires this specific form of practice. There are only a few exceptions made for natural talent. K. Anders Ericsson introduced the concept of deliberate practice in his 1993 paper “The Role of Deliberate Practice in the Acquisition of Expert Performance“, where he stated:

“we deny that these differences are immutable, that is, due to innate talent. Only a few exceptions, most notably height, are genetically prescribed. Instead, we argue that the differences between expert performers and normal adults reflect a life-long period of deliberate effort to improve performance in a specific domain.”

K. Anders Ericsson

Putting it into Practice

You need to choose a strategy/philosophy that fits your specific circumstances, as a mismatch can derail your deep work habit before it has a chance to solidify. Here are some strategies I extracted from the book Deep Work: Rules for Focused Success in a Distracted World:

• Monastic: “This philosophy attempts to maximize deep efforts by eliminating or radically minimizing shallow obligations.” — isolate yourself for long periods of time without distractions; no shallow work allowed.
• Bimodal: “This philosophy asks that you divide your time, dedicating some clearly defined stretches to deep pursuits and leaving the rest open to everything else.” – dedicate a few consecutive days (like weekends, or a Sunday, for example) for deep work only, at least one day a week.
• Rhythmic: “This philosophy argues that the easiest way to consistently start deep work sessions is to transform them into a simple regular habit.” – create a daily habit of three to four hours every day to perform deep work on your project.
• Journalistic: “in which you fit deep work wherever you can into your schedule.” — Not recommended to try out first, since you first need to accustom yourself to deep work.

For my current lifestyle, I prefer to switch between the Rhythmic and the Bimodal. You don’t have to fit on one box, but you can use these strategies as reference points when developing one that fits your circumstances.

“But I don’t know which topic to focus on”

Fair enough. It’s difficult to know in advance what could become “your thing”, since our interests vary from person to person and only because I like ARM exploit development, doesn’t mean it is something you would enjoy doing yourself.
Here’s an idea:

• Pick a skill that can be useful to your current path
• If you don’t have a path yet, pick a skill that is generally useful or one that you could potentially transform into a career.
• Give it a try for minimum 30 hours (deep work!). You might not like it at first. Don’t get discouraged right away. Things we’re not good at are scary and we don’t like doing what we suck at. The trick is to overcome the initial frustration until you get your first rewarding experiences.

Split your 30 hours into seven 4-hour sessions (plus buffer). Set clear goals of what you want to accomplish with this project. Remember, the goal is not to become a master within 30 hours but to use your time efficiently to learn enough so you can judge if you want to continue or switch to another subject.
Use your first session to perform extensive information gathering. Look at the resources available to you and pick the ones that stick out as the most useful for completing the project you’ve chosen. If necessary, use the second session to set up the environment (e.g. an analysis environment for Malware analysis including all tools you could possibly need for your first analysis) and define clear goals (e.g. Analyze Malware x). It is important to set clear goals and split them into structured parts.
If you complete two sessions per week, you’ll be done in 3 weeks. Worst case scenario: You realize that you don’t like it, but you have spent 30 hours learning something challenging and new that you wouldn’t have otherwise learned. Best case: You realize that this is actually fun and want to continue it. Having already started, you overcame the most annoying part and can now happily continue developing your skill further.

Example: ARM Exploitation

Let’s say you would like to explore ARM exploitation. Here’s an abstract example of how you could structure your seven deep work sessions:
Session 1: Information Gathering and Reading

• Read my Introduction to Assembly Basics tutorial (Part 1 – 7)
• Read the section about Process Memory and Memory Corruptions on ARM
• Go through the Exploitation on ARM-based Systems slides by Sascha Schirra
• Read about writing ARM Shellcode (Execve Shell, Bind Shell, Reverse Shell) if you want to use your own shellcode
• Have the ARM reference manual handy in case you need to look something up

Session 2: Setting up the Environment & Goal Setting

• Set up your ARM environment. No wait, I already did that for you. Just download the Azeria-Labs Lab VM
• Get familiar with GDB/GEF
• Use the rest of the time to google and look up the usage of common tools like objdump, strace, as, ld.

Session 3: First Steps – start simple

• Start practicing with simple Stack Overflow challenges and read this guide on how to get started. You can get the source code from exploit-exercises.com and compile them inside your ARM environment

Session 4: Continue with Session 3 if not completed
Session 5: Solve ARM challenges

• Once you’re done with simple stack overflow challenges, you can get more advanced challenges at root-me.org

Session 6: Continue solving advanced challenges
Session 7: Continue solving advanced challenges