Your Path into Cybersecurity: Mentor and be mentored (S1: Ep9)

A series based on the original 10 step pathway

To be a mentor and be mentored is an important part in securing your path. This doesn’t always need to occur in the traditional sense (aspiring professional seeks out experienced professional). While that is still a viable path, it isn’t THE path. In this digital age, if knowledge is what one is seeking, much of what we need and want to know is within reach. Whether it be books, online courses, workshops, forums, blog posts or other community channels -  this is the Information Age; and many successful people document parts of their journey which impart their experiences, wisdom, etc. 

These are not replacements for relationship building. However, mentorship can come in many forms. The older I get, the younger are my teachers. We can all learn from one another. A few years ago, I participated in a “reverse mentorship program”, where as a budding executive, I reverse-mentored a senior executive. He concluded one of our sessions with saying “I learned as much from you as you did me”.

So, next time you feel like you want a mentor, consider some core outcomes you are looking to satisfy by spending your most valuable asset with someone, and asking them to spend theirs with you. 

1. Contemplate what you can provide to your prospective mentor - Conduct some preliminary research on your prospect, identify their strengths and possible areas where you can assist. Perhaps they have stellar expertise in a particular discipline, but a poor digital presence. Perhaps, you are diligent about yours and can offer assistance in this area. Wow - we’ve just discovered opportunity. While providing a need to your mentor, you will also be a sponge and soak up all that you find necessary. Your conversations will be different when you are offering a service. Remember the reverse-mentorship I mentioned above? You can be as much of an asset to your mentor as he/she is to you; and if he/she finds you to be an asset, you can surely 10x your growth opportunity vs the traditional mentorship model. 

2. Go in with clear outcomes - Your mentor will be happy to know that you have a strategy and see this opportunity as a stepping stone. It’s simply not enough to say, “I would love to pick your brain” or “Can you mentor me?”. People like to help those who help themselves. You don’t need to have all the answer (none of us do), but at least a strategy. For example, if I admire someone’s leadership style and how they’ve built their business, I would be interested in understanding how they consider their people (this is huge for me), their business strategy, efficiencies they’ve built into their business, how they find growth opportunity, and measure success. With that in mind, I can easily develop questions and data points that could drive my focus with this individual. 

3. Leverage the relationship - if your new mentor is connected with someone else you’d like to know for a particular reason, request an introduction. But again, be methodical in your approach. Recognize that you are now representing your mentor as well as yourself. A person of integrity values their reputation, thus will think twice when vouching for someone. Help them to see the connection as a fruitful gesture and one that will help make them look good as well.

The aforementioned list is not all encompassing, but should steer you in the right direction along the journey of securing you path; and always remember to pay it forward. 

“You will get all you want in life, if you help enough other people get what they want.” - Zig Ziglar.

Your Path into Cybersecurity:“PoC your Skills”(Series 1: Ep 7)

A series based on the original 10 step pathway

In my original post, I mentioned PoC’ing your skills as a necessary component to securing your path. So, bear with me while I break this down. 

PoC your Skills…and by PoC, I mean, 'Proof 👏🏽of 👏🏽Concept 👏🏽' 

Glossary: 

Proof - evidence or argument establishing or helping to establish a fact or truth of a statement;

Of - expressing the relationship between a part and a whole;

Concept - an abstract idea; a general notion;

Skills - the ability to do something well; expertise

I listed the aforementioned terms, not in a comedic manner nor to discredit any reader’s ability to formulate words and their meaning, rather to dissect frequently used terms and the underlying value of conducting a PoC. 

On any journey, especially one embedded within Cybersecurity, educating oneself is a major part of that experience.

You can go to school (or back to school), read more books, listen to more lectures or podcasts, attend more conferences and meet-ups, and if you never actually turn any of that theory into practice, you DON’T HAVE SKILLS.

So make it a habit to merge the theoretical with the practical…and what better way of doing so than working on some sort of project that you can call your own (or partially your own). The InfoSec community is quite awesome and I’m really glad to be a part of one that welcomes all hungry, willing and smart participants. So, take advantage of it - soak up all that you can from the community and in return, give back. Perhaps, you sponge a great deal of knowledge for a year, work on some project(s) of your own and once your are comfortable, contribute to larger scale projects or offer your own to the community. 

Project based learning has been proven to be more effective than passive learning. Passive learning does not prepare one for the real world; project based learning does. So, work on a project of interest, based on a challenge you face; create the solution and share it. It also acts as an assistant to building a portfolio of knowledge assets. These assets compound, as you become more equipped. By working through or completing projects, you become more resourceful and you can demonstrate the theoretical knowledge you’ve amassed. This may be the tipping point in an interview process that leads an employer to choose you over your competition. Not only did this help me in landing my first internship, but it is also one that I use to this day in my interview process. I want to see what candidates have created, I want to know where you failed, how you used those lessons, how you regrouped and redirected the energy, did a new idea evolve out of the “mishap”? If one hasn’t made any mistakes or screwed up on the job or on a project, then you simply haven’t done enough. You’ve been playing it safe and I’m not impressed.

Napolean Hill said, “Tell the world what you intend to do, but first show it!”

Your Path into Cybersecurity: “Yes, coding is important” (Series 1: Ep 6)

A series based on the original 10 step pathway. 

It’s been a while since my last post - hey, ya girl has been busy! But I plan to expedite the remaining 4 topics in this series.

I’m often asked, “Do I need to know how to code to work in Cybersecurity?” The short answer to this is yes and no. It all depends on the area of InfoSec (and I use this interchangeably with Cybersecurity) in which you are interested. Either way, it will only help. In many disciplines of the field, it will be a powerful skill. Your skill level can also vary and that is ok. 

Let’s take a moment to think about some areas of the industry where coding will serve you in a meaningful way:

• Incident Response

• Malware Analysis

• Reverse Engineering (duh!)

• Penetration Testing

• Web Application Security

• Dev SecOps

As defenders, we have many doors to secure, so automation is key - we need all the help we can get. Automation may come into play when integrating toolsets, triaging events, such as sending suspicious files to a sandbox or checking domain/IP reputation. It may also assist in your response efforts, such as automating the ability to globally block hashes. Your coding skills can be very beneficial in this area. 

If you are a responder, analyzing malware will be a necessity; so understanding it beyond dynamic analysis is a advantageous. As you may know, malware may not run as intended in certain environments. Analyzing the malware statically will afford you the ability to step through the code, identify where certain activities should occur, work around encryption routines, etc. It can be beneficial at very basic levels to simply understand the flow or on a more advanced level, such as reverse engineering. I can hear folk saying “But I can use <insert cool malware analysis tool>”. Yes, of course. However, in my opinion, tools should be used to help enable and for efficiency . To use them without understanding core concepts is like using a calculator without understanding math. A team of Responders is best with a diverse set of skills, so not everyone on the team will need a deep understanding of Assembly language. 

As a PenTester, you will use code to craft exploits or write scripts to make your offensive activities more efficient. When you “pop” a box, you may want to take advantage of the shell resident on the machine or add code to a compromised web server. With creativity, the possibilities are endless. 

In working with the Web Application teams, at the least, you will need to review code to ensure security best practices are being adhered to. You’ll need to understand how flaws in the code lead to vulnerabilities and how to fix it. 

On the opposite end of the spectrum, coding is not as much of a necessity if you are interested or working in an area, such as Compliance/Governance. A role within this discipline will be less technical and focused on high level policies and reporting. So, yes, you can skip the coding course, if you'd like to focus your efforts along this line. 

These are just a few areas in which those coding skills could be put to use. If you are wondering what language you should learn - I would hedge my bet on Python for interpreted languages or C for mid-level. I don’t have a huge amount of experience with it, but Go looks pretty interesting and I’d like to spend some time with it. Check out Learn Python and Python for Security. 

Have fun Securing Your Path!

Your Path into Cybersecurity: “yes, but/and…” (Series 1: Ep 5)

A series based on the original 10 step pathway.

Cybersecurity tends to be considered an operational expense to a company, as it is not income generating. However, we do save the company money, reputational damage, etc., if done properly. But, at the end of the day, we are not the business! We support the business; and in supporting the business, we have to learn to work with and not against.

Take time to learn the business, how it operates, what is important and the best way to secure it. This approach allows us to "yes, but(or and)...", instead of no. If we understand what the business or business units are trying to achieve, we should be in a better position to build security into it.

In Sales, they are taught to say, "yes, but(or and)..." instead of no. This leaves opportunity to suggest alternatives rather than turning down an idea. We can learn a great deal from that approach. For example, if the business wants to move towards the 'cloud' but Security folk, being ultra apprehensive advises against it - what does this do? Does it get us closer to a more secure organization? Many times, it leaves a business to accept a certain amount of risk and move forward with their plan - most likely without the guidance of the Security team. What if the Security team mentioned that if moving to the cloud has a significant advantage for the business, the teams (including Network and Application teams) should consider a 'zero trust model'. This may spark additional conversation and lead to projects which will increase the security posture of the organization.

My point is saying this is that the Security team should welcome new ideas and approaches to doing business, work to understand the end goal, why it is important and determined the best security measure(s) to be implemented. This approach makes the Security team a partner in the game, instead of the team that gets engaged when something goes observably wrong. We all know it is typically a tad bit late at that point.

We aren't the gatekeepers (or maybe we are). But let's focus on building security in from the onset!

Your Path Into Cybersecurity: Familiarization (Series 1:Ep3)

A series based on the original 10 step pathway

Hey guys, I'm back with point three. As stated therein...

"Familiarize yourself with the many disciplines in the field - It is hard for me to answer questions about getting into the field, when one does not have an idea of the area in which they’d like to focus. Do you want to be offensive or defensive, project focused, or on the front-lines, reactive or proactive? Guess what? There are also areas that are not technically focused. For a list of disciplines within the field, check out the Cybersecurity Workforce Framework."

Familiarizing yourself with many disciplines in Cybersecurity does not mean you need to try to be a master of them all - who can do that?! With an industry as dynamic as a growing child, it is best to gain a base level of knowledge across disciplines and hone in on an area of particular interest to you.

What appeals to you, is something of which you need to discover. NICCS provides a helpful framework through common language that breakdown different areas of discipline.

Buzzwords aside - think about what part of the security spectrum you want to focus; from Security Architecture to Research and Development (and everything in between).

Also, check out, the list of "20 Coolest Careers" posted by SANS (and listed below), which also provides job descriptions, courses available to increase your knowledge in the area, why it is cool, and why it makes a difference...I don't know about you, but I want to make a difference, dammit!

Disclaimer: "Coolest" is subjective and relative, so don't shoot the messenger.

The field is wide and vast, and the industries of which that are making it a priority, is every growing.

So, happy searching, hunting, analyzing, researching, exploiting, testing, developing, managing, and all the other adjectives that apply to what we do on a daily basis.

I hope this helps. See ya in my next post.

Your Path into Cybersecurity: Ask Yourself (S1: Ep1)

A series based on the original 10 step pathway

As stated in my last article, if there was enough interest, I would make this a series. So guess what - series, it is! I’ll break down each of the high level topics I mentioned in the first article. If you don’t remember or did not read it, you can catch up here.

To summarize, the 1st point was “Ask Yourself - can I work well under pressure and can I deal with the ebbs and flows of a highly dynamic industry?”

What does this mean?

Incident Response, for example, is often compared to a fire drill. It’s like ummm, what happened here, I need this, have to analyze that, I need to provide a status update to stakeholders, my colleague needs assistance, and so on, and so on…

Whoa…that’s some stir crazy, squirrel chasing type behavior.

I’m sure you can understand the need for a calming force - one who is knowledgeable, can set expectations, delegate appropriately and keep the incident flowing. This skill is beyond pure technical abilities. This individual encompasses technical prowess, strong communication skills, leadership abilities, conflict management and influence. Go you, you unicorn.

Additionally, due to the dynamic nature of the industry, I believe individuals that function well with identifying and working on new problems on a consistent basis thrive and can survive a lucrative career.

How do you become one of these unicorns?

I know, you thought they were mythical creatures. However, proper training with regards to the aforementioned qualities can be delivered. It’s just up to you to seek it out, if it does not come naturally. Think about that one colleague on your team that commands an incident, that seems so calm amidst the madness, that keeps you all on track. Talk to him/her - ask their advice. More often than not, it is fear, confidence, and non-existence of accountability that stand in the way of your ability to level up in this arena. So, toss those feelings aside and live outside your comfort zone for a while. You will soon find that you are now comfortable.

I’m interested in helping more women secure their path into Cybersecurity. If you are a woman interested or looking to transition into in the field, feel free to reach out to me.

As always, all views are those of my own and do not necessarily reflect those of the company for which I work.