A series based on the original 10 step pathway.
It’s been a while since my last post - hey, ya girl has been busy! But I plan to expedite the remaining 4 topics in this series.
I’m often asked, “Do I need to know how to code to work in Cybersecurity?” The short answer to this is yes and no. It all depends on the area of InfoSec (and I use this interchangeably with Cybersecurity) in which you are interested. Either way, it will only help. In many disciplines of the field, it will be a powerful skill. Your skill level can also vary and that is ok.
Let’s take a moment to think about some areas of the industry where coding will serve you in a meaningful way:
Incident Response
Malware Analysis
Reverse Engineering (duh!)
Penetration Testing
Web Application Security
Dev SecOps
As defenders, we have many doors to secure, so automation is key - we need all the help we can get. Automation may come into play when integrating toolsets, triaging events, such as sending suspicious files to a sandbox or checking domain/IP reputation. It may also assist in your response efforts, such as automating the ability to globally block hashes. Your coding skills can be very beneficial in this area.
If you are a responder, analyzing malware will be a necessity; so understanding it beyond dynamic analysis is a advantageous. As you may know, malware may not run as intended in certain environments. Analyzing the malware statically will afford you the ability to step through the code, identify where certain activities should occur, work around encryption routines, etc. It can be beneficial at very basic levels to simply understand the flow or on a more advanced level, such as reverse engineering. I can hear folk saying “But I can use <insert cool malware analysis tool>”. Yes, of course. However, in my opinion, tools should be used to help enable and for efficiency . To use them without understanding core concepts is like using a calculator without understanding math. A team of Responders is best with a diverse set of skills, so not everyone on the team will need a deep understanding of Assembly language.
As a PenTester, you will use code to craft exploits or write scripts to make your offensive activities more efficient. When you “pop” a box, you may want to take advantage of the shell resident on the machine or add code to a compromised web server. With creativity, the possibilities are endless.
In working with the Web Application teams, at the least, you will need to review code to ensure security best practices are being adhered to. You’ll need to understand how flaws in the code lead to vulnerabilities and how to fix it.
On the opposite end of the spectrum, coding is not as much of a necessity if you are interested or working in an area, such as Compliance/Governance. A role within this discipline will be less technical and focused on high level policies and reporting. So, yes, you can skip the coding course, if you'd like to focus your efforts along this line.
These are just a few areas in which those coding skills could be put to use. If you are wondering what language you should learn - I would hedge my bet on Python for interpreted languages or C for mid-level. I don’t have a huge amount of experience with it, but Go looks pretty interesting and I’d like to spend some time with it. Check out Learn Python and Python for Security.
Have fun Securing Your Path!