Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!
I’ve always been curious if command centers are a thing in cyber security. Is there a room full of people at every major bank monitoring infrastructure health and network traffic for signs of infiltration or compromise, ready to pounce? And if so, is that as cool of a job as it sounds or am I delusional?
Something I don’t think is talked about enough in offensive cybersecurity training / skill development are communication skills. Too often we are seeing folks try to enter these roles without the ability to write reports and give presentations to audiences with a mix of technical and business attendees. My recommendation to folks considering these roles is to put in the time to get communication skills to a very professional level. Train it just like report writing or public speaking was a new shiny hacking certification. It will improve your chances of landing the job.
Agree, when I have held talks for cybersecurity students I usually tell them that a lot of the work time goes into writing report. Because the customer (be that internal or external) does not care about what cool thing you did during the test, they care about the risk and your findings have to reflect that.
Having minimal professional IT experience, yet an IT degree, what should I focus on to get into the cybersecurity field?
Got your 3 C’s right here --> Code, Cloud, Collection (and by collection I mean document what you learn in a blog or GitHub or something). For coding, I’d say go with Python and for cloud, get a free AWS account and learn the basics.
I am hosting multiple services, but my application/web security knowledge is lacking. Is there a guide or framework to check for common or risky mistakes? Is there a list of things I should check every application for, or guide on how to harden hosted applications? That is a topic that I am going to tackle in the near future, and would appreciate some tips in advance.
There’s a browser extension you can use by owasp, I think it’s “Penetration Tool Kit” or ptk
I stopped using it because it was slow (being a browser extension and all) but I do like how easy it was to use while needing to be logged in or get past captchas
Owasp zap is good for reconnaissance scanning
I really like burp suite for reverse engineering a web app. You can use the proxy to intercept http packets and see what every change illicits
OWASP is arguably the standard for web application assessments. They cover most of the areas and testing guidance. Burp Suite web academy offers labs that cover many web application security issues. For secure coding, you’d need to look for references aligned with your language of choice.
Looking for resources (books/blogs/videos) on how to get started with getting into cyber security. I’ve got 13 years of work experience of which 10 as a Linux sysadmin/SRE/DevOps (it’s a culture, not a role) and 3 years as a software developer. I understand the field is wide and there’s many positions I could look getting into.
I get along with people well and have worked as a consultant before, so I could see doing that at some point as a contractor once I’ve got more experiencing in the field. Generally I’m not a big fan of working at big companies, but don’t mind doing gigs for them.
I guess familiarizing myself with pentest and other tooling would be a good start?
I wrote this up a few years ago on the topic of breaking into the field. Maybe it could be useful to you! https://shellsharks.com/getting-into-information-security
