Looking to branch into security

gabrielle.l · 2016-10-04T19:37:04.000Z

This blog post has lots of great suggestions on how to build an infosec career:

How to Build a Cybersecurity Career [ 2019 Update ]

Education Building Your Lab You Are Your Projects Practicing with Bounties Have a Presence On Certifications Making Contributions Networking With Others Confere

jamie · 2016-10-04T19:41:28.000Z

At this point, I don’t really know what I want to focus on. I want to start off general, and find what most interests me. Pen testing sounds like a lot of fun, but I’m concerned that it’s a fad to the people that spend the money for it. Again, I’m not in any hurry to rush out and get any specific certification. If I test for a certification, I want it to be something that I feel I’m fully competent to be certified for.

I found this in another post, and it’s great:

sactownchad · 2016-10-04T20:24:12.000Z

I know that in our organization, the security group functions as auditors and policy makers / project managers. They DO NOT IMPLEMENT fixes… So if you like writing reports, scanning things, going to meetings and not necessarily doing hands on system and network administration, it might be a good career choice.

zuphzuph · 2016-10-04T20:46:44.000Z

Chad.w:

I know that in our organization, the security group functions as auditors and policy makers / project managers. They DO NOT IMPLEMENT fixes… So if you like writing reports, scanning things, going to meetings and not necessarily doing hands on system and network administration, it might be a good career choice.

Do they actually do pentesting?

@sactownchad

sactownchad · 2016-10-04T20:51:01.000Z

zuphzuph:

Chad.w:

I know that in our organization, the security group functions as auditors and policy makers / project managers. They DO NOT IMPLEMENT fixes… So if you like writing reports, scanning things, going to meetings and not necessarily doing hands on system and network administration, it might be a good career choice.

Do they actually do pentesting?

Well, kind of… They manage the Dell Secureworks and Qualys reporting systems which scan for vulnerabilities and attacks. They also interact with outside pen testing vendors as well as Wombat and other training vendors. They do not patch servers or applications, they basically just make a bunch of tickets for my group.

ceciforemazzanti · 2016-10-04T21:29:40.000Z

Hi Jamie! Whatever area of security you’re looking to dive into and what you’re looking to accomplish, you can find a lot of helpful resources throughout community, such as the How-To’s in the Security group.

You might find this write up helpful to get started: How to Build a Cybersecurity Career [ 2019 Update ]

Here are a couple of other threads in the community covering similar situations that you might want to check out as well:

Getting started in security IT & Tech Careers

Hello fellow Spiceheads! In a bit of a dilemma, currently working at my first real IT job (used to do some part time stuff while at college, not the American college but British college), working quite a bit with general troubleshooting, networking and currently doing some software development as well...getting To the point: my end goal career wise is to be in IT security but I have no idea where to get started. Currently I have my A+ certification, hoping to do my Network+ and CCNA later th…

Suggestions for Security Certification Training? IT & Tech Careers

Long story short… CCNA R&S isn’t a replacement for experience for a true networking position at any level (IE: I’m not a SysAdmin, I can’t do a “One-man-show” for a small shop with no IT staff, and the main company that hires entry-level network techs has yet to reply to my applications in two years). There’s an opening (several, actually) for entry-level security positions, with very minimal requirements (specifically, “minimal security experience required, OR a current Security+ or similar ce…

Hope that helps! Best of luck

apsutcliffe · 2016-10-04T21:48:26.000Z

I’d suggest start with the basics; learn some simple things, such as packet analysis. Then get into some of the pen testing utilities.

There are some specialist university courses out there; I did one on forensics, which was really interesting and very informative. But I’m not sure that any will help you get any specific work.

johnmctaggart5616 · 2016-10-04T23:06:32.000Z

I’d look into CASP, CCNA Security and/or the new Cisco CyberOps cert…if you’re really geeky with lots of command line and Linux experience, then the C|EH would be a good one to look into as well.

maxsec · 2016-10-05T05:34:49.000Z

setup a home lab if you’ve not got one and start having a look at stuff you can afford to break… got an interest in something have a look into it.

go to local bsides and other events and help out where you can. Get your face (real or virtual known)

the last couple of episodes of the pvcsec podcast also cover alot of good advice

john2542970083 · 2016-10-05T06:50:05.000Z

You need to build some skills, not just get a certificate. A lot of the credentials such as CISSP require up to 5 years of verifiable experience in order to be eligible.

Looks around your current work - what can you get involved in to start? Does your infosec policy need rewriting? Firewall due an upgrade? (or do the rules need to be audited?), can your patching process be improved? etc

With 2017 on the horizon, are there any security projects you can get in the budget for next year?

kate-att-cybersecurity · 2016-10-05T11:59:12.000Z

Here’s a good blog on security certifications and their worth. Are Information Security Certifications Worth Your Time?

Bud-G · 2016-10-05T12:33:33.000Z

As previously stated, security encompasses a lot of things. The CISSP is easily recognizable and highly desired. But it doesn’t involve just taking the exam. Documented experience and knowing other CISSPs are also required. Security+ is easily the most common of the “general” certs. CEH is another easily recognizable.

You might want to start with Security+ and some networking stuff. The Net+, as your profile indicates, is a good starting point. Make sure you know about securing your network. Some of the advanced networking certs cover these things. Knowing stuff about hardening an OS is also an asset. Linux skills will help you, especially when using some of the more common tools, like Kali Linux.

The SANs certs, like GIAC, are great to have. They have them for all kinds of security aspects.

There is a lot out there and it is a field that has a lot of unfulfilled jobs.

jamie · 2016-10-05T13:45:12.000Z

Thanks everyone. As previously stated, I’m not overly concerned about running out and getting certs; it’s the knowledge I’m after. Can anyone recommend any websites that offer online training in various security disciplines?

I’ve heard about the Kali distro several times now. I think I’ll play around with it.

010101000110100101101101 · 2016-10-05T14:00:38.000Z

Jamie K:

Thanks everyone. As previously stated, I’m not overly concerned about running out and getting certs; it’s the knowledge I’m after. Can anyone recommend any websites that offer online training in various security disciplines?

I’ve heard about the Kali distro several times now. I think I’ll play around with it.

So you want to learn something new, but you don’t want to learn by means of school, certs, or classroom training?
.
You aren’t left with much else except unorganized random youtube videos and googling random related articles.
.
If you want to learn something, the best way is in an organized and proven method.
So you don’t care about certifications… that doesn’t matter. You don’t need to do the tests. You can still pick up a certification book or watch certification videos. They are typically organized and in order to make learning the content you are interested in learning easier and more efficient to take in and follow.
.
Don’t want school or classroom training? That doesn’t matter either… you can still pick up course books or watch course videos, as those will also be tailored to teaching in an efficient manner.
You can’t just jump in at random places and expect to pick it up and understand it. If you do that you’ll never get on track. Sure, you might learn how to use one tool in Kali Linux, but you will have no idea about the how’s and why’s, no idea about the technology, etc. etc.
.
It seems you want all the benefits of knowledge, but don’t want any part of the learning process, and just want to tinker around with things you don’t understand hoping to pick it up and become an expert with it.

jamie · 2016-10-05T14:19:34.000Z

Tim_G:

It seems you want all the benefits of knowledge, but don’t want any part of the learning process, and just want to tinker around with things you don’t understand hoping to pick it up and become an expert with it.

I’m not sure where the miscommunication happened, but the learning process is exactly what I’m after. Many people have posted “you can get x cert or y cert”, and I just wanted to clarify that I’m not after the piece of paper; I’m after the knowledge. Once I have the knowledge and feel I’m proficient in a particular discipline, I would certainly consider a certification, but I’m not at that point right now.

I cannot afford to go back to school, and I do not want the time away from my family.

If the certification books are a good learning tool, I will certainly explore them. I, perhaps foolishly, made the assumption that they were more aimed at the folks who already had the knowledge and are just prepping for a specific exam. Much like you said “Sure, you might learn how to use one tool in Kali Linux, but you will have no idea about the how’s and why’s”. The “how’s and why’s” are what I’m after.

Would you please share a little more information regarding the course books/videos you referred to? Anything specific you would suggest as a starting point?

Thanks.

010101000110100101101101 · 2016-10-05T14:37:22.000Z

Jamie K:

Tim_G:

It seems you want all the benefits of knowledge, but don’t want any part of the learning process, and just want to tinker around with things you don’t understand hoping to pick it up and become an expert with it.

I’m not sure where the miscommunication happened, but the learning process is exactly what I’m after. Many people have posted “you can get x cert or y cert”, and I just wanted to clarify that I’m not after the piece of paper; I’m after the knowledge. Once I have the knowledge and feel I’m proficient in a particular discipline, I would certainly consider a certification, but I’m not at that point right now.

I cannot afford to go back to school, and I do not want the time away from my family.

If the certification books are a good learning tool, I will certainly explore them. I, perhaps foolishly, made the assumption that they were more aimed at the folks who already had the knowledge and are just prepping for a specific exam. Much like you said “Sure, you might learn how to use one tool in Kali Linux, but you will have no idea about the how’s and why’s”. The “how’s and why’s” are what I’m after.

Would you please share a little more information regarding the course books/videos you referred to? Anything specific you would suggest as a starting point?

Thanks.

I see, I misunderstood then I guess from the off-topic extras about certs and stuff.

I didn’t have any specific course and cert books/videos in mind for “security”… I was just portraying general ideas of it because that is what I have done for subjects I wanted to learn about in the past, and it worked out extremely well.

Self-paced self-study works extremely well if you are genuinely interested in the subject. Once proficient enough, the cert is a great way to put the principles in “practice” because most certs are based on real situations. After that, you can start implementing what you’ve learned at your current job to get real experience. Or, you may be able to find entry-level jobs on that subject… but may be a pay-cut then. Lots of way to go about it, but to sum it up, I definitely recommend purchasing the certification books of the certs that were mentioned as a guide at least. You can find academic course books on amazon for the topics you are interested in most likely. Same with videos.

As a real example, in the past, I had gotten some official Microsoft academic course books from amazon, which helped more than it would have had I not gotten them. So it was worth it.

cyberoptiq · 2016-10-05T21:07:40.000Z

Jamie K:

Pen testing sounds like a lot of fun, but I’m concerned that it’s a fad to the people that spend the money for it.

Trust me…it’s no fad…we had a guy working for us right out of DeVry before they went downhill and eventually the company hired him…he worked with us for a while but his background was Security and eventually he got an offer and was hired by a company doing website Pen-Testing and he’s happy as a clam!! He gets to work from home most days of the week and frequently flies to clients to perform testing at their location…all expenses paid and no headaches of someone breathing down his neck…so don’t think it’s a fad…there are company’s out there that are invested in protecting themselves and will pay to have their site(s) tested…good luck…

richardpeters4 · 2016-10-06T06:53:41.000Z

We had our website and estate pen tested for both internal and external vulnerabilities. They found some of course.

It cost a small fortune and the manager of the three man company came in a brand new convertible Jag XKR…

We’ll be pen testing annually. I imagine we’ll see a new Jag every year or two.

Pen testing is no fad. Any company which holds personally identifiable information on its systems will eventually be forced to have their systems tested to a standard. Large and small external companies (or even one man bands) specialising in pen testing will flourish as even big companies with dedicated security teams will want an external audit completed.

ceciforemazzanti · 2016-10-06T21:37:34.000Z

Jamie K:

Thanks everyone. As previously stated, I’m not overly concerned about running out and getting certs; it’s the knowledge I’m after. Can anyone recommend any websites that offer online training in various security disciplines?

I would recommend checking out SANS Cyber Aces , which offers free online courses that cover the foundations of security for Operating Systems, Networking, and Systems Administration.

Heimdal also put together this list of over 50 cyber security courses that seem to cover all sorts of security topics: 50+ Fresh Online Cybersecurity Courses worth Looking into [Updated]

jamie · 2016-10-10T20:10:51.000Z

In the process of going through Ceci’s 2nd link, I came across this:

MIT OpenCourseWare

Search | MIT OpenCourseWare | Free Online Course Materials

MIT OpenCourseWare is a web based publication of virtually all MIT course content. OCW is open and available to the world and is a permanent MIT activity

Free courses from MIT. That is amazing!