Getting Started in Cyber Security
Cybersecurity is a field with an increasingly vast gap between what is needed and the talent available to do the job. When interviewing candidates or interns, five things that resonate with me. While there are many, many ways to get started in this or any career, I find these the most valuable: learn how to talk to people, be a technology generalist first to learn how things are supposed to work, build a lab to develop hands-on technical skills, understand how people work and think, and most important of all, have passion for the field.
Talk to People.
Communication is perhaps the most underrated skill in any career, and it is one of the two most influential skills to develop for cybersecurity (the other being analytics). ‘Risk’ is the language of cybersecurity, and while the very technical and the very business-focused may not be able to understand the nuances of each other’s area, the cybersecurity professional can make risk a common ground.
Develop communication skills.
You must communicate with both technical and non-technical people. Practice presenting and writing often; learn to be clear, crisp, and succinct. The ability to break down and present complex concepts or the impacts of threats into everyday language is a very powerful skill. Learn to clearly articulate complex concepts and develop active listening skills; this is a key attribute in attaining leadership positions in this field.
Build a network.
The best way to know what good looks like is to build a personal network of peers and experts that you can trust. User groups can be effective for general knowledge, both local or online, and trade shows can be a useful way to stay in touch with trends and changes in the industry. Find a mentor that you can relate to. Learning from a mentor has been proven to be effective in building technical knowledge, critical thinking, leadership skills, and overall acumen. You will find that people in the field are willing to help others who are just getting started and can demonstrate passion.
Know the culture.
Whether you are technical or not, understanding the culture of interconnected computer networks will help to relate to the perspective of people and the connected systems they use to communicate, do business, and be entertained. Knowledge of the cultural history and the current online communities, multi-player games, and social media platforms will help you better understand how they work or can be manipulated.
Be a generalist first, then a specialist…if you must.
Take the time to learn about the foundational technical knowledge that supports your practical hands-on experience, things like how ports and protocols work and internetworking services like name services, IP addressing and subnetting, and application coding. A broad understanding of interconnected technologies is necessary, even for non-technical roles. Experience different roles to get a better understanding of the administration and architecture of networks and operating systems. Develop a basic understanding of firewalls, scripting platforms like Python or PowerShell, and general programming and software development concepts. If you can’t, you’ll always be dependent on those who can.
A few words about degrees and certifications.
A four-year degree is ‘table stakes’ in most organizations; cybersecurity teams need a rich set of backgrounds to be successful, so it doesn’t necessarily need to be in computer science. The only certification I look for is the CISSP. That is not to take away from other worthwhile certifications, but the CISSP is the closest thing to a standard ‘license’ that the cybersecurity community has. Getting a master’s degree early in your career is unlikely to support what you need later in your career and if you are just getting it to be an ‘MBA,’ you are likely wasting your resources. I suggest taking your time to understand the field more before specializing with a masters. Cybersecurity is like the medical profession, in that a practitioner needs this strong technical education to know what they are doing, but also need the hands-on knowledge and skills that can only be learned through practice or apprenticeship.
Build a Lab.
There are things you can only appreciate with practical, hands-on experience. A lab gets you two things: you will know first-hand how thing work together and why they do not; and you have a place to experiment with any of the new threats or vulnerabilities you learn about. Fortunately, there are free and open-source tools available to build an experimenting environment without spending a lot of money. To save cost and keep configuration options open, use as much virtualized “hardware” as possible and leverage Raspberry Pis for your nodes. There are a lot of different approaches to building a lab, I’ve listed a few good ones at the end, and the exact specifics of your configuration are not nearly as important as the journey in putting it all together. Here are some key components for your ‘starter pack.’
A network to plug in all your nodes or at least connect wirelessly is foundational.
This can either be a virtual machine (VM) or a dedicated single-board computer (SBC) like those distributed by Netgear which have pfSense and some physical ports, along with a wireless option. You can also get extra ethernet capability for your computer and build PfSense on a Linux-based VM. PfSense is easy to manage and has many advanced features built-in, such as Snort IDS/IPS, Squid Proxy, SSL Inspection, Antivirus, and VPN. You also want to run your own DNS and DHCP services here or on a Windows VM if you prefer. Once you get the hang of it, you want to try setting up a DMZ and multiple VLAN’s in PfSense as well as your own VPN.
Have some servers on a VM.
The host Operating System (OS) can be whatever you like using and you can use free versions of VMWare to host your guest servers. I recommend having at least one Windows server and one Linux server. Many different virtual hosts can be installed and connected with virtual networks and virtual switches. To emulate a typical office, you will need an Active Directory forest on one of your hosts. The other systems you will need will be a database server (like MYSQL), an email server (like Postfix), and at least one Windows or Apache web server with PHP for Linux and a WordPress server.
You will want another VM for your monitoring system. Splunk Light is free, and it can be installed along with their universal forwarder (for log collection). PfSense can send logs to Splunk, and the universal forwarder will ingest what you want into a selected Splunk index. You can also experiment with other VM’s with no-cost SIEM technology like AlienVault OSSIM (pronounced Awesome).
Set up some nodes to generate traffic.
As an alternative to all virtual switches and nodes, you can have physical nodes hooked up to your network to watch traffic flow between them. Raspberry Pi’s are relatively inexpensive and can be made wired or wireless; if you support manufacturing systems, be sure to install some Modbus nodes.
Make a Kali Linux workstation for you the investigator.
This is where you will launch your attacks and research. Windows 10 lets you install Kali natively now, so you can use it on any of the platforms.
Understand how people work and think
Cybersecurity is a field that encompasses more than one kind of work and more than one profession, and a wide range of backgrounds, tangential skills, and technical skills are needed to be successful. It’s more than just the technology; a cybersecurity professional will need to develop a talent for solving problems, not all of which are technical. Appreciating psychology, data analytics, human behavior, finance, and criminal investigations helps understand the people and process elements. Countering the activities of malicious actors requires the presence to think like them, beyond basic technical problems and into areas of complex puzzle solving.
Problem-solving is crucial in cybersecurity; you will constantly face scenarios that need troubleshooting where you need to know how to approach a problem systematically. Analytical thinking is an innate ability for some people, but others can develop this skill by applying curiosity in situations, being observant, learning how things work, asking questions, and analyzing the decisions made.
Have Passion
As you enter the workforce, consider this – roughly half of your waking hours will be spent working. When you have passion for what you do, it hardly seems like work at all. Find something you love to do, and then find someone to pay you to do it. Strong security talent has a passion for their work and a desire to share that knowledge – this is the most important attribute of them all – you can’t teach passion. If you find the things mentioned here exciting, interesting, and natural, then a career in cybersecurity will be very rewarding; if not, it will be very frustrating.
