Information Security Careers Cheatsheet

[begood]

These are my views on careers in information security careers based on the experience I've had and your mileage may vary. The information below will be most appropriate if you live in New York City, you're interested in application security, pentesting, or reversing, and you are early on in your career in information security.

Employers

In my opinion, there are five major employers in the infosec industry (not counting academia). I ranked them below according to the proportion of talent I think they employ:

• (25%) Government (including consultants)
  
• (20%) Finance
  
• (15%) Software Vendors
  
• (15%) Consulting (non-gov)
  
• (24%) Other (retail, healthcare, etc)
  
• (1%) Academia
  

The industry you work in will determine the major problems you have to solve. For example, the emphasis in finance is to reduce risk at the lowest cost to the business (opportunities for large-scale automation). On the other hand, consulting often means selling people on the idea that X is actually a vulnerability and researching to find new ones.

Roles

I primarily split up infosec jobs into internal network security, product security, and consulting. I further break down these classes of jobs into the following roles:

• Application Security (code audits/app assessments)
  
• Attacker (offensive) <- try not to do this one
  
• Compliance
  
• Forensics
  
• Incident Handler
  
• Manager
  
• Network Security Engineer
  
• Penetration Tester
  
• Policy
  
• Researcher
  
• Reverse Engineer
  
• Security Architect
  

The roles above each require a different, highly specialized body of knowledge. This website is a great resource for application security and penetration testing, but you should find other resources if you are interested in a different role.

Learn

Fortunately, there are dozens of good books written about each topic inside information security. Dino Dai Zovi has an excellent reading list, as does Tom Ptacek, and Richard Bejtlich has recommendations from another perspective (bonus: Richard's book reviews are usually spot-on). I would personally recommend looking at:

• Gray Hat Hacking (the textbook for this course)
  
• The Myths of Security (a quick read that covers larger issues)
  
• Hacking: The Next Generation (a quick read that covers the latest in web security and then some),
  
• and any book from O'Reilly on a scripting language of your choice.
  

If you're not sure what you're looking for, then you should browse the selection offered by O'Reilly. They are probably the most consistent and high-quality book publisher in this industry.

Don't forget that reading the book alone won't impart you any additional skills beyond the conversational. You need to practice or create something based on what you read to really gain value and understanding from it.

University

The easiest shortcut to finding a university with a dedicated security program is to look through the NSA Centers of Academic Excellence (NSA-COE) institution list. This certification has become watered down as more universities have obtained it and you should focus your search on those that have obtained the newer COE-R certification. There are a number of universities with special programs in security that are not on this list, so I listed some of the best courses I know about below:

• Secure Software Principles at RPI (listed first for a reason)
  
• Computer Security (Graduate), taught by Hovav Shacham at UCSD
  
• Advanced Vulnerability Assessment, taught by Chris Eagle at NPS
  
• Intro to Web Application Security, taught by Edward Z. Yang at MIT IAP 2009
  
• Intro to Software Exploitation, taught by Nathan Rittenhouse at MIT IAP 2009
  
• Web Programming and Security at Stanford
  
• Computer and Network Security at Stanford
  
• Malware Analysis and Antivirus Technologies at the University of Helsinki (alternate)
  
• Binary Auditing and Reverse Code Engineering at the University of Bielefeld
  
• Software Security Assessment, taught by Gregory Ose at DePaul
  

Once in university, take classes that force you to write code in large volumes to solve hard problems. IMHO the courses that focus on mainly theoretical or simulated problems provide limited value. Ask upper level students for recommendations if you can't identify the CS courses with programming from the CS courses done entirely on paper. The other way to frame this is to go to school for software development rather than computer science.

Capture the Flag and War Games

If you want to acquire and maintain technical skills and you want to do it fast, play in a CTF or jump in to a wargame. The one thing to note is that many of these challenges attach themselves to conferences (of all sizes), and by playing in them you will likely miss the entire rest of the conference. Try not to over do it, conferences are useful in their own way (see below).

• NYU:Poly CSAW CTF (here are the reversing challenges from 2009)
  
• UCSB iCTF
  
• Defcon CTF Pre-qualifications
  
• wargames at smashthestack.org
  
• wargames at intruded.net
  
• calendar of upcoming CTF competitions
  

There are some defense-only competitions that disguise themselves as normal CTF competitions, mainly the Collegiate Cyber Defense Challenge (CCDC) and its regional variations, and you should avoid them. They are exercises in system administration and frustration and will teach you little about security or anything else. They are incredibly fun to play as a Red Team though.

Communication

In any role, the majority of your time will be spent communicating with others, primarily through email and meetings and less by phone and IM. The role/employer you have will determine whether you speak more with internal infosec teams, non-security technologists, or business users. For example, expect to communicate more with external technologists if you do network security for a financial firm.

Tips for communicating well in a large organization:

• Learn to write clear, concise, and professional email.
  
• Learn to get things done and stay organized. Do not drop the ball.
  
• Learn the business that your company or client is in. If you can speak in terms of the business, your arguments a) to not do things to fix things and c) to do things that involve time and money will be much more persuasive.
  
• Learn how your company or client works, ie. key individuals, processes, or other motivators that factor into what gets things done.
  

If you are still attending a university, as with CS courses, take humanities courses that force you to write.

Meet People

• CitySec - informal meetups without presentations, once monthly, occurs in most cities (NYSEC, google for others)
  
• OWASP - formal meetups with presentations about web security, usually quarterly (OWASP NY/NJ)
  

ISSA and ISC2 focus on policy, compliance and other issues that will be of uncertain use for a new student in this field. Similarly, InfraGard mainly focuses on law enforcement-related issues.

Conferences

If you've never been to an infosec conference before, use the google calendar below to find a low-cost local one and go. There have been students of mine who think that attending a conference will be some kind of test and put off going to one for as long as possible. I promise I won't pop out of the bushes with a final exam and publish your scores afterward.

• Information Security Conferences Calendar
  

If you go to a conference, don't obsess over attending a talk during every time slot. The talks are just bait to lure all the smart hackers to one location for a weekend: you should meet the other attendees! If a particular talk was interesting and useful then you can and should talk to the speaker.

If you're working somewhere and are having trouble justifying conference attendance to your company, the Infosec Leaders blog has some helpful advice.

Certifications

This industry requires specialized knowledge and skills and studying for a certification exam will not help you gain them. In fact, in many cases, it can be harmful because the time you spend studying for a test will distract you from doing anything else in this guide.

That said, there are inexpensive and vendor-neutral certifications that you can reasonably obtain with your current level of experience to help set apart your resume, like the Network+ and Security+ or even a NOP, but I would worry about certifications the least in your job search or professional development.

In general, the two best reasons to get certifications are:

1. If you are being paid to get certified, through paid training and exams or sometimes through an automatic pay raise after you get the certification (common in the government).
   
2. If your company or your client is forcing you to get certified. This is usually to help with a sales pitch, ie. "You should hire us because all of our staff are XYZ certified!"
   

Random Links (some better than others)

• Information Security Leaders Blog
  
• Advice for Computer Science College Students
  
• Organizing and Participating in Computer Network Attack and Defense Exercises
  
• vf on how she got started in security
  

Friends of the Class

• Attack Research
  
• Gotham Digital Science
  
• Intrepidus Group
  
• iSEC Partners
  
• MANDIANT
  
• Matasano Security
  
• McAfee
  
• TippingPoint DVLabs
  
• Vulnerability Research Labs
  
• zero(day)solutions
  

There are a number of internal security and product security teams that I've worked with in the past who I'm not sure would appreciate being called out like this. Needless to say, there are dozens of financials, healthcare, and technology companies in NYC that require information security to run their businesses and they shouldn't be hard to find.

Penetration Testing and Vulnerability Analysis - Careers - Information Security CareersCheatsheet

[pyth0n3]

First , have no money for the books? No problem Google will help you

Second , thanks for share with us begood !

Third ,

There are people that can see everything but they have no eyes

There are people that have eyes but are still blind

However , bookmark-ed need'it all in one

P.S Gray Hat Hacking good book , also Oreilly's books

Edited June 7, 2010 by pyth0n3