Thinking of a Cybersecurity Career?

That's surprising to someone not in CyberSec that so few can do basic tasks of their job. I wonder how they declare the bar for basic or not.

Very interesting article, but at the same time it depicts a very sad truth...

[Disclaimer: also not a certified security professional, but I do follow the topic and practice it hands-on from time-to-time...]

However I think there are multiple (sometimes non-overlapping) types of cyber-security professionals / roles:

* the policy maker / enforcer -- which is what some companies want, and what the most well known people out there (including Schneier, Krebs, etc.) are blogging and speaking about; (to put it metaphorically they are the ones in charge of designing an IT "hygiene", and making sure everyone "washes their hands" properly;) :)

* the operations security -- which should make sure systems and networks are well locked down, patches properly installed, watches out for suspicious activity, and if he is capable enough tries to check the boundaries and limits the firms security; this is another role most companies want, what some courses train for, and what usual bloggers write about;

* "applied cryptography / security" developer (for the lack of a better name) -- which (if he knows better) should make sure proper well-known techniques and best practices are used throughout the developed applications, and when necessary (if not already covered by existing solutions) is capable enough to mix cryptographic primitives;

* "high budget zero-day" researcher (also for the lack of a better name) -- which is mostly employed by state level actors to discover zero-day vulnerabilities, and on the other side employed by large corporations (e.g. Google, Microsoft, etc.) to make sure their most valuable systems aren't vulnerable to those types of attacks; these are the guys that come up with Spectre and Meltdown and other very low-level hardware related vulnerabilities;

* (many others that escape me at this moment...)

Each of these roles require some different traits and focus areas, which most of the time aren't strictly related to IT or security; for example:

* the policy maker should be well versed in social sciences and human behavior, as in the end he has to work with people;

* the operations security person should be as capable (if not more) than any of its "normal" peers in all matters of network and systems administration;

* all of them must understand that in the end security is a spectrum (i.e. from air-gapped-system to no-authentication-internet-connected) and it has to take into account a balance between internal cost (development, operations, etc), end-user costs (e.g. how cumbersome is for the end-user to login), risks (e.g. is the data valuable enough to protect it with 2FA), time-to-market, etc.

So in the end I think the underlying problem is that most companies want "one cybersecurity guy", and most candidates see themselves as that "one guy", when in reality there is no real person that can actually fulfill all these roles. Just like nobody wants to hire "a developer", but a "web developer", or an "embedded developer", so should companies specify what kind of security professional they are looking for...

It's important to note that while there are a lot of skills which can be useful, it's fairly rare to find a job which requires them all.

For example, if you have a mobile application specialist, they probably don't need to worry about, say, VLAN configuration on a regular basis. It's quite likely that even if they do know it, the lack of use will result in them not showing that knowledge well in an interview situation. If you give them a few hours and an internet connection, though, they may well be able to refamiliarise themselves easily. Alternatively, you just need to hire someone who specialises in network architecture and segregation - this does rely on the person doing the hiring to know vaguely what they need, though, which is not always the case.

I work in the industry, and there are people who are well known as experts in specific fields, but who I would never expect to be able to do some other aspects of my job, just as I would struggle to do things they can do without any difficulty.

I think the cyber security industry is at the stage where the web was 15-20 years ago, where a company would hire a "webmaster" who did all the web related stuff, rather than getting a combination of people in different roles each specialising in one area. It's slowly getting better, but it's still common for companies to look for a jack of all trades security person, rather than getting the specific knowledge they need.

In my experience many jobs in "risk management" (under which I'd file a large part of cybersecurity from an organisational perspective) are 'second career jobs'. You first need to have done the job yourself before you start learning how to properly comment, guide, influence and teach colleagues and teams. People are notoriously resistant to outside critique even when you are part of the same organisation and principally on the same boat. So I would advise companies to let medior to senior staff that are not management material but can lead by example to take on more risk management roles.

So how to get into cybersecurity? Don't. Do what you like (programming, systems administration or even IT-procurement) and after a few years start transitioning to cybersecurity. An exception would be the hardcore whitehats but firms usually don't have those on board and rely on consulting. So programmer-consultant is another route. But you won't get hired without quite the demonstrated homework, so you'll need to love it.

> * (many others that escape me at this moment...)

* Threat hunting / attribution

Familiarity with clustering incidents and pivoting between actors by attack signatures.

Or before that, do you even know what an APT is? (Probably only a small percentage of CS grads.)

* Malware re

* Post incident forensics

Random tools and skills that come up...

SQL keeps coming up even though I try to avoid it. There's generally an "SQL person" on the team that drives simple queries but having the basics down will be faster.

Visualization tools that help diagram clusters of incidents, though these might be declining in importance.

Beyond the network stack, understanding common network services, how people (criminals) register for domains and set up virtual services, techniques for c2.

You can play around with riskiq as a free user. You can read some reports from FireEye, Symantec, Crowdstrike, etc. for free to see how they do it. The MITRE attack framework collects a lot of it. Most CS students probably don't know those names though or where to start.

An understanding of criminal law and/or geopolitics doesn't hurt.