Getting Into Security

How does one get into security?

I get asked this from time to time. There is no single answer, but here
is a collection of information, mostly culled from others, that can be
used as a starting point.

Advice from Practitioners

If they have been in the industry for a while, most people you ask about
getting a job in security will not have a good answer applicable to you.

That's not to say it won't be an interesting answer, and you should
definitely ask people about their background. However, many have come up
through circuitous means and other than "be curious, try everything, and
just add security to your job description" our advice isn't that
applicable in many cases. For example, you probably do not want to spend
6+ years going to law school, passing the bar exam, and practicing law
before you get started. You could, and there are many practicing and
former attorneys doing security work, but maybe that's not the best way
for you to approach it.

One place to start is the Develop Your CyberSecurity Career Path
book, a part of the CISO Desk Reference series and written by Gary
Hayslip, Christopher Foulon, and Renee Small.

My Advice

In the vein of "advice from practitioners", here is mine:

Do things the hard way

Put differently, "do things a different way than that to which you are
accustomed. At his or her core, a hacker is someone that is curious and
always learning, and the best security professionals share this trait. A
good hiring manager -someone that you'd want to work for- will identify
and value the always-exploring, always-learning trait in you.

This is something you can do, even if you don't have time to take a
bunch of courses or learn a programming language. By getting yourself
out of your comfort zone and then figuring out how to make the
uncomfortable comfortable and workable, you're gaining a valuable
hacker skill.

Building a Foundation

When information/cyber security started to become its own discipline,
the people that gravitated to it were network and system administrators.
These were people with a lot of operational experience and were tired of
having their systems interrupted by malicious parties. In the past 30
years, two primary developments have occurred:

  1. Computers have become "easier" to administer. By this, I mean a
    lot of the low-level configurations have been obfuscated and taken
    out of the hands from all but the most core of administrators
  2. An industry has sprung up around cybersecurity, with actual
    collegiate curricula developed for people wanting to get into the
    space.

These are great advancements, however, in my experience –and more
importantly, in my hiring practices– practical, first-hand knowledge
of the fundamentals is a crucial foundation for anyone looking to get
into cybersecurity. So, what does that mean? What knowledge is important
before one even gets to security concepts?

The following subsections list a few that I think are absolutely
critical for either an IT or cybersecurity career:

DNS

Know how DNS works. A couple tasks that would help.

DHCP

TCP/IP

Docker / Containerization

Use docker. Use it to run some common tools, and know how to construct a
Dockerfile in order to run some arbitrary application or service.

Security Tooling and Practices

Run the Security Onion on your home network. Collect information, dive into the logs, explore the tools. This will provide you with an entire SOC-in-a-box type environment for experimentation.

Researching a job in security

For those that are just starting or looking to move from a completely
different industry, these are some collected resources. They are ordered
so you can get a taste and then go deeper depending upon what you find
interesting. Remember: the security field is big, and there are so
many niche areas where you could dive in and spend the rest of your
working career learning. You have to decide what is of interest to you
and determine your goals.

Initial Reading & research

Continuing to look into the field

If the above was interesting and you find that you're interested in
security, follow and use these resources.

Build a home network lab

A #homelab is a must for both the experienced and the just-getting-started cybersecurity practitioner.

Going Deeper

(if you're brave) Follow & engage with InfoSec Twitter

Learn something about hacking/red-teaming/penetration testing:

Social Obligations

Networking (the social kind) is extremely important in any career.