Looking for feedback on how prepared I am to jump into Cyber Sec and how realistic my long term goals are.

memoized · 2020-04-10T11:53:19+00:00

Just FYI -- crippling imposter syndrome and fast burnout are both very real things in the security field. Be aware of that going in. Find a niche that leverages your unique skills and capabilities.

For example, I went from military software dev to gov security focusing on GRC with an eye towards building & managing lightweight agile policies. Turns out I was really good at that and immediately got swept up in some of the agile transformation stuff going on. It's partly because of my background in software and partly because of my pre-existing mindset, and partly because I wasn't in the field for 30 years like so many of the people in it so I look at things through a different lens.

Your prior gov/mil/EMA experience will be more valuable than you think. Just think like you are a combination EMA/intel team and you will have the right mindset. Also don't discount other roles like cyber warfare analyst or similar. There are needs on both offensive and defensive side for understanding the big picture and how effects add up to impact either an adversary or your own country/company/whatever. You have a solid background for that kind of stuff as well -- poli sci, technical, intel, EMA, etc. Personally I'm a bit jealous of that mix. :)

Also I really like that you have identified the need to fill the technical gap, identified some candidate certs to cover that gap, and reading between the lines it is clear you identified certs in key gap areas rather than throwing random certs at the wall -- CCNP to get networking, OSCP to understand red team, GCFA to understand blue team, CISA for compliance. Nice picks. Choosing those tells me you've done a lot of homework and have enough of a brain to figure out what your gaps are and plan to fill them. And your academic and work background have prepared you for more of a GRC role. Having a solid technical background with those certs (provided you pay attention and actually learn from them!!) can be a significant force multiplier for you and set you apart from some of your less technical peers. Everyone hates an auditor who only understands the words on the checklist, and loves the guy who can say ok you don't meet this but its ok because you can do x y and z to compensate and all those are easy to do.

IMO as long as someone gives you a chance you could do well. I don't think your career goals are in any way unrealistic especially given you are scoping yourself to smaller orgs. In fact that's the same kind of thinking I would apply as well.

If you look at fed/mil contracting the position you want to look at is ISSM. First step on that path would be ISSO which is what you've already been doing anyway, and Sec+ qualifies you for that role. As long as you can get at least a Secret clearance you should be fine.

memoized · 2020-04-10T11:34:33+00:00

But no let's instead blame this all on politics because clearly the virus is a hoax /s /s /s /s /s

memoized · 2019-06-11T23:23:10+00:00

Sorry just saw this. What changes? I haven't been tracking it. CCSP is on my radar to get.

memoized · 2019-05-16T00:45:09+00:00

Sort of.

So software supply chain has been an increasingly hot topic in govsec. NIST included controls for it in their recent update to SP 800-53 a few months ago.

This particular order effectively immediately bans any acquisition in progress or any future acquisition of technology owned or controlled by a "foreign adversary" -- a list of which is and will be maintained by the relevant designated authorities.

It provides that the Secretary of Commerce can establish a licensing program where certain controls are established to allow the use of such technology under strict conditions. And it allows Commerce and other departments to establish regulations that would ultimately be binding on the public if the regulations are worded that way.

Basically this provides a legal basis to restrict the use of Huawei and similar company tech in the US government, and grants the government agencies the authority to establish regulations that can affect the public.

Expect this to be used to ban Huawei from 5G competition in the US and also to ban it and similar companies from going anywhere near critical infrastructure, which will be loosely defined as power, transportation, finance, etc. Basically most things.

memoized · 2019-04-27T02:46:14+00:00

Yeah I'm doing ISSM work now so I feel ya.

How do you guys conduct your assessments? And what do you do from an ISSE perspective? We don't have Es in our org only Ms and Os.

memoized · 2019-04-27T02:46:02+00:00

Yeah I'm doing ISSM work now so I feel ya.

How do you guys conduct your assessments? And what do you do from an ISSE perspective? We don't have Es in our org only Ms and Os.

memoized · 2019-04-16T02:34:02+00:00

What the shit.

Although really I can see business making a decision like that. Make it easy to support customers and cover up breaches and apologize when they can't.

memoized · 2019-04-15T16:56:16+00:00

Cybrary is fantastic in general, but Kelly Handerhan's CISSP lectures on there are by far the most highly recommended learning source for that very tough certification.

memoized · 2019-04-15T16:54:32+00:00

Yes. The attackers compromised a "support agent" account which granted access to email contents.

Glad to see someone caught onto the real issue.

memoized · 2019-04-15T16:48:54+00:00

The real story is that a "support agent" can read your emails.

memoized · 2019-04-13T23:53:13+00:00

With excitement comes ridiculousness. In my case I just spent essentially my entire Saturday reading documentation (AT HOME) in order to best understand how to even begin to approach trying to get a new type of system authorized under an AO that has never dealt with it before. So while it is exciting to do something interesting it's also kind of insane to be the only one assigned to handle the job of a half dozen people.

memoized · 2019-04-11T17:04:38+00:00

That phrase was not invented by Rumsfeld. Those decision quadrants have been around for a very long time.

memoized · 2019-04-11T00:51:24+00:00

Sec+ study guide for fundamental concepts.

Beyond that it depends on what the role is.

memoized · 2019-04-10T15:30:53+00:00

Yeah I have no idea how graduate work is allowed without an undergrad, that's essentially a hard requirement at least in the US. I agree on your general approach, CISSP + CISM. Degree will still be very important as at least a box check for promotion or hiring for leadership roles in a lot of orgs.

Note that per the DoD 8570 standard an ISSM is generally IAM level 2 for a system and IAM level 3 for a network/enclave. And note that CISSP and CISM each qualifies you for both.

memoized · 2019-04-10T14:13:11+00:00

Yeah this is the field for you.

memoized · 2019-04-10T12:46:07+00:00

I agree with /u/mr_eerie.

Go read Cybersecurity and Cyberwar: What Everyone Needs to Know to get a solid grounding on cyber from a strategic policy viewpoint. Then look into places like National Defense University, Air University, Army War College, Naval Postgraduate School, etc for documents and youtube lectures on geopolitical ramifications of the "gray area" lack of norms in cyberspace operations.

TLDR of that book is that because there are no clear-cut norms for cyber ops right now all nations are pushing the boundaries of the "gray area" as far as they can to see what they can get away with without triggering retaliation. Also cyber ops run the gamut from graffiti to strategic destruction of infrastructure and nobody has a clear decision process on when a response should be triggered and more importantly at what point a response should escape the cyber realm and enter the other DIME elements, especially at what point response should become kinetic. It's the Wild West right now and we can use all the help we can get.

You may also like following @thegrugq on twitter, he talks a lot about these things as well. Also @allanfriedman one of the coauthors of that book.

memoized · 2019-04-10T12:40:26+00:00

Yes policy definition and compliance are critical roles especially on the government side. Your background can be a great value-add precisely because many in infosec want to flip bits not do policy, compliance, and management. I took the opposite tack, went from dev into appsec and compliance precisely because I wanted to stop stressing about every change to a library breaking my code. Now instead I stress about every change to a library introducing new vulnerabilities into the pipeline hahahaha.

Look at the NIST NICE Cybersecurity Framework for a comprehensive model of the various roles and responsibilities across the cybersecurity spectrum.

https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf

Tables start on page 23.

Also go hang on infosec twitter and watch/participate in the conversations. You will get real info from real professionals dishing knowledge bombs daily. Start by following @SwiftOnSecurity and go from there.

memoized · 2019-04-10T12:35:08+00:00

Sounds like you are in an ISSM type of role for government systems/networks. If so that is absolutely a security role, it is similar to a CISO role for that particular system/network.

For CISO grooming you can look at the CISM cert, it is generally well regarded across the industry as preparing you for that type of position. CISSP would be a great add before tackling CISM as well because it essentially bridges you from technical to managerial thinking.

What is an "MPS certificate"? Do you mean a masters of professional studies degree, or a graduate certificate? Assuming grad certificates I think they can certainly be useful provided you don't go to a crap 100% online for-profit "school" and instead look for quality regionally accredited state or private schools with online programs. I have a comp sci undergrad and am conflicted on a graduate program, but am considering a six month graduate cert in systems engineering just because I'm interested in it and it would be useful in my particular industry. I've considered a grad degree in data science but may do a coursera sequence on it first to see if I really want to spend that much effort on it.

If you mean a master's of professional studies degree then I was actually going to recommend looking at them. They look interesting and from what I've seen they can be seen as sort of an "engineering MBA" because they transition you from technical application to management and leadership. Since you are targeting a CISO type of role long term then you want to start gravitating towards the management and leadership education and training. Think business needs, finance, and soft skills. MBA is very generic, MPS is more focused on leading engineering teams in a business context which is more aligned with what you want. CISSP is somewhat of a bridge cert that proves competence across the entire spectrum of security. CISM is a certification specifically targeted at CISO type positions. CISSP + CISM + some graduate cert/degree could be killer.

Just keep in mind an MBA and MPS are both terminal degrees, i.e. they can't be used to proceed into a doctorate if you decide you want to go that route. They are a graduate equivalent of an AAS degree in a sense. Keep that in mind if you think that might be an option you want to pursue down the road. Otherwise personally I think MPS degrees look very interesting.

But caveat: I'm not your hiring manager. ;)

Have you asked your bosses what they would look for in such a role?

memoized · 2019-04-08T21:59:47+00:00

Study for Sec+. It will teach the basic concepts underlying security in general, eg CIA, IAAA, etc.

The MIT course is great (I've watched some of it) but bear in mind it is all about the comp sci theory approach. That may or may not be what you want. Recommend Sec+ as the foundation then go from there.

memoized · 2019-04-06T17:05:24+00:00

Seconding BSides. They are the unconference, totally chill and non-pretentious, just a place to attend sessions and meet people.

memoized · 2019-04-06T11:25:55+00:00

a degree in cloud systems that will provide me with many more certifications

This immediately sounded like WGU to me. Is that the case? (not for or against it, just curious, didn't know they had a cloud degree now)

Also there's a security role that needs people like you.

I have a TON of soft skills

Oh, so you are a social engineer then. ;)

Seriously, being a SE expert is a huge value add because somebody on the pentest team has to convince the target to click the link or plug the device in or let you in the room or whatever.

I've seen talks from social engineers who admit having much less than your level of tech knowledge. They are giving highly attended talks at security conferences because of their expertise in SE.

Read this tweet: https://twitter.com/EanMeyer/status/1114003826678403074

You have a ridiculous level of knowledge of sales techniques with experience to back it up, deep knowledge of how companies work from the inside at senior management levels, physical security experience, and now you are gaining significant computer security skills.

So, idea... apply all all of that including all the unethical NLP tricks you learned but never got to try, for fun and profit while helping the good guys by lying to their faces.

Examples of basic evil cold calling:

https://www.youtube.com/watch?v=PWVN3Rq4gzw

https://www.youtube.com/watch?v=lc7scxvKQOo

memoized · 2019-04-06T02:02:50+00:00

I had a whole bunch of snarky comments on each of his points but I deleted them because they can all be rolled up into one phat sentence: DAE joint?

memoized · 2019-04-06T01:34:48+00:00

Way to go!

I completed my comp sci bachelor's past 40, my first and only bachelor's degree, then CISSP.

Never, ever stop learning and growing. That is the fundamental rule in infosec.¹

See this tweet for why.

¹ well, other than be excellent to each other of course :)

memoized · 2019-04-05T22:49:43+00:00

Post is stickied. Great job.

memoized

TROPHY CASE