Cyber/network Security career advice?

[Physics Beard]

Hello!
First of all, I am relatively new to these forums. I had a few nagging questions. I think this is the right place to post this thread...? But anyways, in college, I am currently pursuing a degree in Information Technology. I'm planning on focusing more on cyber security as I've always been interested in doing a job as a cyber security specialist. So I need some tips on what I might need to do to better my chances in getting a job. obviously, I'm doing IT with a concentration in cyber security soon... but I'm pretty that's not enough. What types of certificates would I need? And is having a bachelor's degree really a requirement for this path?
Thanks! Any help is appreciated!

 

[Routaran]

There's 3 types of security specialists out in the wild.

There's the ones that work purely on securing computer networks. They are the type that are usually hired on by businesses to work on their servers and build, configure and maintain the corporate firewalls. That sort of thing. You will need certifications for the specific Operating systems you will be working on and the switches and firewalls you will setup. This is probably the easiest and most straightforward. A bachelor's degree is not critical. A diploma in networking with a few relevant certifications in the OS and hardware you will be working on should be enough.

Then there are security experts that work with consultant firms with penetration testing. These ppl get hired on to do external audits on the status of a computer network. They effectively try and hack the network and computers, then provide a report to management. These ppl are also called white hat hackers or ethical hackers. You'll need a programming degree as you are often required to write some of your own code to test vulnerabilities. Then additional certifications in offensive security. These can be expensive.

Finally there's black hat hackers. These guys are generally require very intimate understanding of how computers work in order to break into systems. Their intentions are usually malicious. Organisations like the NSA and CIA are interested in these types of people. This requires extensive programming knowledge to write trojans and viruses, in addition to knowing exactly how operating systems work, how they interact with different software. Understanding assembly, decompilers. Where to get an education for this type of work? I don't know. You'll need to know everything an ethical hacker does but the level of detail will be significantly higher. I know some universities offer advanced degrees for this level of security education but not just to anyone. I'm from Canada and I have a friend of a friend who went to Israel to get some of his education.

 

[Physics Beard]

Wow, thanks for the information! Black Hat hackers definitely sounds very interesting. But would you say that a degree in IT with a concentration in cyber-security be good for the more "expert" or "professional" fields of security?

 

[Routaran]

As career options go, the first option is your best bet to land a job and start to make a living. Once you have some experience you can potentially look into moving to a security auditing firm. Black Hat careers that won't land you in Jail for a long time are extremely rare. It's "cool" to think about it but it's about as likely as winning the lottery. Too few jobs in organizations like the CIA and far too many people that are extremely talented.

If you're really interested in learning, start going to Defcon. It's a great place to meet the best, make some networks and learn.

P.S. If you do go, turn your mobile device off and leave it in the hotel. Don't take it with you to Defcon. They have a wall of shame where they post careless people's username/passwords.

 

[Physics Beard]

Ah, I see. But one last question. In the case of certificates, what type do I need? Can I obtain them online? Thanks!

 

[Routaran]

Take a look at https://www.isc2.org/
This is kind of the industry standard for security certifications, you'll need them to get places in the security world. But they require that you already have relevant experience as a requirement. Any IT won't do, it has to be in the security domain.

So first you need a job in the security domain. Again, they won't hire just anyone so here's some starting points.
http://www.sans.org/
http://www.infosecinstitute.com/
https://www.offensive-security.com/

They all offer online security training. But before you go sign up for them, reach out to security firms that are in your local area. Speak to them about career opportunities and get an idea of what they are looking for in prospects. See what kind of an education background they want in their employees.

 

[Routaran]

And if you're serious about learning this stuff, go to Defcon (https://www.defcon.org/)

 

[Physics Beard]

And if you're serious about learning this stuff, go to Defcon (https://www.defcon.org/)

Awesome! I'll definitely take a look. Thanks for the advice! Although I don't that sort of hacking would be my thing. But I think it's still worth while to check out.