Getting Started
Not long ago, I gave some presentations at a local high school on cybersecurity, and one of the questions that was asked was, "how do I get started in cybersecurity?" Given that my alma mater will establish a minor in cybersecurity this coming fall, I thought that it might be interesting to put some thoughts down, in hopes of generating a discussion on the topic.
So, some are likely going to say that in today's day and age, you can simply Google the answer to the question, because this topic has been discussed many times previously. That's true, but it's as blessing as much as it is a curse; there are many instances in which multiple opinions are shared, and at the end of the thread, there's no real answer to the question. As such, I'm going to share my thoughts and experience here, in hopes that it will start a discussion that others can refer to. I'm hoping to provide some insight to anyone looking to "get in" to cybersecurity, whether you're an upcoming high school or college graduate, or someone looking to make a career transition.
During my career, I've had the opportunity to be a "gate keeper", if you will. As an incident responder, I was asked to vet resumes that had been submitted in hopes of filling a position on our team. To some degree, it was my job to receive and filter the resumes, passing what I saw as the most qualified candidates on to the next phase. I've also worked with a pretty good number of analysts and consultants over the years.
The world of cybersecurity is pretty big and there are a lot of roads you can follow; there's pen testing, malware reverse engineering, DFIR, policy, etc. There are both proactive and reactive types of work. The key is to pick a place to start. This doesn't mean that you can't do more than one...it simply means that you need to decide where you want to start...and then start. Pick some place, and go from there. You may find that you're absolutely fascinated by what you're learning, or you may decide that where you started simply is not for you. Okay, no problem. Pick a new place and start over.
When it comes to reviewing resumes, I tend to not focus on certifications, nor the actual degree that someone has. Don't get me wrong, there are a lot of great certifications out there. The issue I have with certifications is that when most folks return from the course(s) to obtain the certification, there's nothing that holds them accountable for using what they learned. I've seen analysts go off to a 5 or 6 day training course in DFIR of Windows systems, which cost $5K - $6K (just for the course), and not know how to determine time stomping via the MFT (they compared the file system last modification time to the compile time in the PE header).
I am, however, interested to see that someone does have a degree. This is due to the fact that having a degree pretty much guarantees a minimum level of education, and it also gives insight into your ability to complete tasks. A four (or even two) year degree is not going to be a party everyday, and you're likely going to end up having to do things you don't enjoy.
And why is this important? Well, the (apparently) hidden secret of cybersecurity is that at some point, you're going to have to write. That's right. No matter what level of proficiency you develop at something, it's pretty useless if you can't communicate and share it with others. I'm not just talking about sharing your findings with your team mates and co-workers (hint, "LOL" doesn't count as "communication"), I'm also talking about sharing your work with clients.
Now, I have a good bit of experience with writing throughout my career. I wrote in the military (performance reviews, reports, course materials, etc.), as part of my graduate education (to include my thesis), and I've been writing almost continually since I started in infosec. So...you have to be able to write. A great way to get experience writing is to...well...write. Start a blog. Write something up, and share it with someone you trust to actually read it with a critical eye, not just hand it back to you with a "looks good". Accept that what you write is not going to be perfect, every time, and use that as a learning experience.
Writing helps me organize my thoughts...if I were to just start talking after I completed my analysis, what came out of my mouth would not be nearly as structured, nor as useful, as what I could produce in writing. And writing does not have to be sole source of communications; I very often find it extremely valuable to write something down first, and then use that as a reference for a conversation, or better yet, a conference presentation.
So, my recommendations for getting started in the cybersecurity field are pretty simple:
1. Pick some place to start. If you have to, reach to someone for advice/help.
2. Start. If you have to, reach to someone for advice/help.
3. Write about what you're doing. If you have to, reach to someone for advice/help.
There are plenty of free resources available that provide access to what you need to get started; online blog posts, pod casts/videos, presentations, books (yes, books online and in the library), etc. There are free images available for download, as part of DFIR challenges (if that's what you're interested in doing). There are places you can go to find out about malware, download samples, or even run samples in virtual environments and emulators. In fact, if you're viewing this blog post online, then you very likely have everything you need to get started. If you're interested in DFIR analysis or malware RE, you do not need to have access to big expensive commercial tools to conduct analysis...that's just an excuse for paralysis.
There is a significant reticence to sharing in this "community", and it's not simply isolated to folks who are new to the field. There are a lot of folks who have worked in this industry for quite a while who will not share experiences or findings. And there is no requirement to share something entirely new, that no one's seen before. In fact, there's a good bit of value in sharing something that may have been discussed previously; it shows that you understand it (or are trying to), and it can offer visibility and insight to others ("oh, that thing that was happening five years ago is coming back...like bell bottoms...").
The take-away from all of this is that when you're ready to put your resume out there and apply for a position in cybersecurity, you're going to have some experience in the work, have visible experience writing that your potential employer can validate, and you're going to know people in the field.
So, some are likely going to say that in today's day and age, you can simply Google the answer to the question, because this topic has been discussed many times previously. That's true, but it's as blessing as much as it is a curse; there are many instances in which multiple opinions are shared, and at the end of the thread, there's no real answer to the question. As such, I'm going to share my thoughts and experience here, in hopes that it will start a discussion that others can refer to. I'm hoping to provide some insight to anyone looking to "get in" to cybersecurity, whether you're an upcoming high school or college graduate, or someone looking to make a career transition.
During my career, I've had the opportunity to be a "gate keeper", if you will. As an incident responder, I was asked to vet resumes that had been submitted in hopes of filling a position on our team. To some degree, it was my job to receive and filter the resumes, passing what I saw as the most qualified candidates on to the next phase. I've also worked with a pretty good number of analysts and consultants over the years.
The world of cybersecurity is pretty big and there are a lot of roads you can follow; there's pen testing, malware reverse engineering, DFIR, policy, etc. There are both proactive and reactive types of work. The key is to pick a place to start. This doesn't mean that you can't do more than one...it simply means that you need to decide where you want to start...and then start. Pick some place, and go from there. You may find that you're absolutely fascinated by what you're learning, or you may decide that where you started simply is not for you. Okay, no problem. Pick a new place and start over.
When it comes to reviewing resumes, I tend to not focus on certifications, nor the actual degree that someone has. Don't get me wrong, there are a lot of great certifications out there. The issue I have with certifications is that when most folks return from the course(s) to obtain the certification, there's nothing that holds them accountable for using what they learned. I've seen analysts go off to a 5 or 6 day training course in DFIR of Windows systems, which cost $5K - $6K (just for the course), and not know how to determine time stomping via the MFT (they compared the file system last modification time to the compile time in the PE header).
I am, however, interested to see that someone does have a degree. This is due to the fact that having a degree pretty much guarantees a minimum level of education, and it also gives insight into your ability to complete tasks. A four (or even two) year degree is not going to be a party everyday, and you're likely going to end up having to do things you don't enjoy.
And why is this important? Well, the (apparently) hidden secret of cybersecurity is that at some point, you're going to have to write. That's right. No matter what level of proficiency you develop at something, it's pretty useless if you can't communicate and share it with others. I'm not just talking about sharing your findings with your team mates and co-workers (hint, "LOL" doesn't count as "communication"), I'm also talking about sharing your work with clients.
Now, I have a good bit of experience with writing throughout my career. I wrote in the military (performance reviews, reports, course materials, etc.), as part of my graduate education (to include my thesis), and I've been writing almost continually since I started in infosec. So...you have to be able to write. A great way to get experience writing is to...well...write. Start a blog. Write something up, and share it with someone you trust to actually read it with a critical eye, not just hand it back to you with a "looks good". Accept that what you write is not going to be perfect, every time, and use that as a learning experience.
Writing helps me organize my thoughts...if I were to just start talking after I completed my analysis, what came out of my mouth would not be nearly as structured, nor as useful, as what I could produce in writing. And writing does not have to be sole source of communications; I very often find it extremely valuable to write something down first, and then use that as a reference for a conversation, or better yet, a conference presentation.
So, my recommendations for getting started in the cybersecurity field are pretty simple:
1. Pick some place to start. If you have to, reach to someone for advice/help.
2. Start. If you have to, reach to someone for advice/help.
3. Write about what you're doing. If you have to, reach to someone for advice/help.
There are plenty of free resources available that provide access to what you need to get started; online blog posts, pod casts/videos, presentations, books (yes, books online and in the library), etc. There are free images available for download, as part of DFIR challenges (if that's what you're interested in doing). There are places you can go to find out about malware, download samples, or even run samples in virtual environments and emulators. In fact, if you're viewing this blog post online, then you very likely have everything you need to get started. If you're interested in DFIR analysis or malware RE, you do not need to have access to big expensive commercial tools to conduct analysis...that's just an excuse for paralysis.
There is a significant reticence to sharing in this "community", and it's not simply isolated to folks who are new to the field. There are a lot of folks who have worked in this industry for quite a while who will not share experiences or findings. And there is no requirement to share something entirely new, that no one's seen before. In fact, there's a good bit of value in sharing something that may have been discussed previously; it shows that you understand it (or are trying to), and it can offer visibility and insight to others ("oh, that thing that was happening five years ago is coming back...like bell bottoms...").
The take-away from all of this is that when you're ready to put your resume out there and apply for a position in cybersecurity, you're going to have some experience in the work, have visible experience writing that your potential employer can validate, and you're going to know people in the field.