13 ms·

Careers in security, ethical hacking and advice on where to get started

191 points by jscholes 10y ago

YCode 10y ago
> That’s bad for employers but good news for cybersecurity workers, who can command an average salary premium of nearly $6,500 per year, or 9% more than other IT workers. $6,500 / year? Am I misunderstanding the term "salary premium"? Also the bar graph confuses me. Shouldn't cybersecurity positions be included in "all IT positions"?
- ontoillogical 10y ago
  That's salary above the average for IT workers. The average IT worker makes $72000, while cybersecurity workers are making $78500, a 9% premium
- danielweber 10y ago
  Several years ago I was looking for some ranked ordering of IT careers via salary, allowing drilldown to things like different languages and specialities. It's something I slowly figured out via job hopping, but if the list would help people who enjoy X as much as Y realize that Y pays 20% more.
- jajern 10y ago
  I think the problem is that it's not a very useful graph. I think breaking out the overall IT into other areas would make more sense with smaller percentages being shown as "Other".
- uiri 10y ago
  The bar graph is reflecting growth as a percentage. I think it would have been better to plot IT positions vs Cybersecurity positions to show the hockey stick growth that he is trying to illustrate.
mi100hael 10y ago
I've enjoyed Troy's posts explaining past high-profile hacks, so I assume the content he created for Pluralsight is pretty good, too. I'm glad he didn't directly tailor them to the CEH, because from what I've seen it's not the most esteemed certification. Most managers I've talked to on the security side of things have said something like Security+ is a good starting point for newbie hires, and CISSP or OSCP are a decent indicator for mid-to-senior hires. In general though, the prevailing sentiment has been that demonstrated experience is the #1 factor. Infosec isn't a career path that begins as a totally oblivious hire after floating around in college. It begins in your bedroom in the evenings poking around bug bounties or playing on hackthissite.org and its forums and that sort of thing. A professional setting isn't required to gain some good real-world experience, so there's no reason you should be inexperienced by the time you're sitting for your first professional interview.
- phaus 10y ago
  A CISSP is only a good indicator that someone wants a free ride past HR. As a technical certification, or a measure of technical ability, it is worthless.
  - toss1941 10y ago
    I wouldn't say worthless, a lot of CISSP's are in management where actual technical ability gets delegated to non-CISSP's. I'm pretty confident that most CISSPs could pick up almost any security-related technical skill if they were motivated to do so.
    - phaus 10y ago
      The context of this thread is that we're talking about technical positions. If you see my other comment, I already mentioned that it's a management cert. Also, if a person with a CISSP is capable of picking up technical skills, that's simply coincidental. The CISSP didn't teach them to learn technical skills, it's completely unrelated. In my experience, motivation is the largest factor in learning anything, so of course a person motivated to spend time learning a specific subject is capable of picking it up.
alltakendamned 10y ago
As a counterpoint for this fluff piece for Pluralsight (mentioned 29 times), I'd like to offer the following links with very good information by well respected people in the industry: - https://www.corelan.be/index.php/2015/10/13/how-to-become-a-pentester/ https://www.corelan.be/index.php/2015/10/13/how-to-become-a-... - https://tisiphone.net/2015/10/12/starting-an-infosec-career-the-megamix-chapters-1-3/ https://tisiphone.net/2015/10/12/starting-an-infosec-career-... - https://danielmiessler.com/blog/build-successful-infosec-career/ https://danielmiessler.com/blog/build-successful-infosec-car...
- andersonmvd 10y ago
  Allow me to enhance your list. "Owasp Testing Guide V4" is a must read for web hackers, at least for starters: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table... OWASP has vulnerable application projects for you to play with, such as WebGoat "https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project" https://www.owasp.org/index.php/Category:OWASP_WebGoat_Proje..., but there are many applications like these such as "DVWA - Damn Vulnerable Web Application" and variants in Node JS (https://n0where.net/damn-vulnerable-node-application-dvna/ https://n0where.net/damn-vulnerable-node-application-dvna/) I also developed two free courses on "WordPress Security" and "Docker Security" https://dadario.com.br/courses/ https://dadario.com.br/courses/ The point is to learn development / infrastructure first, then study attacks and defense to develop a security mindset. Get involved in bug bounties, but learn how to fix, don't let your code skills rust. Then learn more security concepts, how to build a corporate security program and keep moving :) There's also a very famous book in the area: "The Web Application Hacker's Handbook" http://mdsec.net/wahh/ http://mdsec.net/wahh/
avenueb 10y ago
10+ year info sec veteran here. I think first order of business is do you want to be a specialist or a generalist? Application security is but one piece (albeit in many cases a very important piece). I chose generalist and I am happy to have done so. Today I am diving into Strict Transport Security, yes, but also working with HR and IT on our employee onboarding and off-boarding process, reviewing vendor and customer contracts and federal compliance requirements. Privacy, Regulations and Law, Compliance, IT and infrastructure security, corporate IT security, and yes application security - every day I deal with all of the above and I love that. And a great foundation into all the things a security person may do, I cannot recommend the CISSP enough go for the CISSP (or, alternatively, CISA) certification.
- phaus 10y ago
  The CISSP is a certification designed to give managers a high-level understanding of the different areas of security. For some stupid reason, HR people think it's the gold standard of technical certifications. Unless a person has is an absolute beginner, they probably won't learn anything technical.
- sandworm101 10y ago
  10 years isnt enough for vet status. If you didnt live through the crypto wars of tye 90s, if you never saw Sony's rootkit in action, you arent a vet.
  - grub5000 10y ago
    6 months in Iraq isn't enough for vet status. If you didn't live through the Vietnam War of tye 70s, if you never saw the AK-47 in action, you arent a vet.
    - sandworm101 10y ago
      Really? You seriuosly think i meant to comment about military vets? Words in context.
tptacek 10y ago
I like Troy, but I need to put in a word here against pursuing certifications. There are no employers in security that I know that anyone wants to work for that take certification seriously. The best people working in security --- not just in application security but in network security, red-teaming, exploit development, and cryptography --- don't have certificates. If you want to work in startups, a hiring process that even asks if you have a certification is a big red flag. This is less true in the broader tech industry, but while it's probably not a good idea to discard a prospective Fortune 500 employer just because they ask if you have any certifications, it is certainly reasonable to pull the ejection lever hard if an employer cares about them. Every minute you'd spend pursuing certification is better spent building programming skills. For whatever it's worth, I still stand behind everything in here: https://krebsonsecurity.com/2012/06/how-to-break-into-security-ptacek-edition/ https://krebsonsecurity.com/2012/06/how-to-break-into-securi...
- linkregister 10y ago
  For what it's worth, Troy's perspective is colored by living in Australia. My experience is that the Australian tech scene (I don't live there anymore) is in many ways similar to the 1990s in the U.S. Customers and recruiters ask about certificates. Hell, you typically have to go through a professional recruiter in order to get a job; it is often not possible to apply directly to companies. I am generalizing and also talking about my experience in Australia about 8 years ago. Maybe everything has changed.
  - OJ 10y ago
    While the tech scene in Australia may be behind the times in a few ways (possibly security as well), Troy's view here is in no way affected by living here. This material was created because PluralSight wanted CEH-related material, as their viewers (world-wide) were asking for it. Full stop. Blog posts like that are designed to steer traffic towards course views and "time watching the content", without which PluralSight authors don't get paid.
- Bartweiss 10y ago
  An example: Matasano (I have no affiliation) is a well-respected security company. Their hiring process involves (or involved) taking applications from interested people with interesting resumes, sending them a textbook, and asking them to come back when they felt qualified. I've seen this sort of outlook (usually without the textbook) across the board. Either a company will train people from scratch, or they want to see applicants with actual records of working security, finding and reporting vulnerabilities, or patching holes in OSS. "Have a certificate" is nowhere on that list. It probably can't hurt for a candidate, but I certainly don't think it will bridge the gap from inexperienced to experienced the way an actual work record would.
debatem1 10y ago
As a hiring security manager: go break shit. I don't care if you have a CEH, I care if you can bring me good vulns. Show me you can break things I care about and that you're not a horrible person and you'll go straight to the top of the list. It's that simple. How do you get started breaking shit? Github has tons of shit. Go break it. More interested in hardware? Go buy some crappy iot gear and break it. Vulns are not rare and they do not require a damn piece of paper to find. Find them, and you will have no problem finding jobs. If you are reading this and still don't know where to start, I am happy to help you find things to break and suggest approaches that might help. But seriously,don't waste your time and money getting certified. I don't care at all.
- patcheudor 10y ago
  To this point, bug bounties, bug bounties, bug bounties. If someone is applying to be a security developer, consultant, or anything beyond a security help desk operator my expectation is that they can tell me about bounties they've collected. In lieu of that, I'll accept them telling me about their ethical disclosures. Also playing CTF's, even without winning is a good sign. It shows passion and that's what matters at this point as we need people in security not because of the money, but because they passionately want to make the world a safer place and enjoy the work as a bonus.
  - dsacco 10y ago
    I want to push back against this a bit because you used the word "expectation." Yes, I strongly agree that bug bounties are one way to achieve and demonstrate a certain level of expertise in information security, especially if you are trying to break in. However, don't make it more than a job for people who just want to do the job, and don't arbitrarily make it the whiteboard of the security industry. My best colleagues, the people I most deeply respect and the people who inspired me to work in this industry all neglect bug bounties. They mostly don't participate in them at all. Bug bounties are usually pursued by people who have the free time and bandwidth for them. For the most part, most security consultants and engineers do not actually engage in them because they are already highly paid. This is why you most frequently see bug bounty participants from countries other than the United States and Western Europe. Those that do have a full-time position and also engage in bug bounties certainly have a commendable passion for the work (or sometimes more accurately a workable formula for getting to low hanging fruit in new programs first), but please don't expect all or even most skilled security talent to adhere to this rule. Many people enjoy being skilled without sacrificing work-life balance. Just as not every software engineer needs to contribute to open source or have a GitHub profile, not every security engineer needs to have badgers for every company they've hacked.
icantdrive55 10y ago
" A cert like CEH may open doors and create opportunities you wouldn't have had otherwise, but that's only part of the story" 1. I would be embarrassed to admit passing this. This is so basic, and so general, it's not even worth the 49.00 price tag for the book. 2. This is a profession where there's going to be a lot of "trust me's". 3. If I was hiring for this position, I would ask the candidate in the interview to find my network password. I would look for a packet injection wifi. I would want to see how they used Kali. I would want a true Hacker. Ties would most likely walk. I want someone who looks like they have broke into systems before. 4. I guess so much in this profession is self promotion, and confidence. Maybe not even earned confidence; just bold confidence? I do not have that confidence.
dsacco 10y ago
I'll echo what debatem1 and tptacek said here with what I tell everyone: 0. Do not pursue certifications at all. 1. Learn to code. C + Python is a great choice, to start with (or C + Ruby). 2. Start with application security, because it's the easiest place to get your feet wet. 3. Work through The Web Application Hacker's Handbook (don't just read it). 4. Find bug bounties in as many programs on BugCrowd or HackerOne as you can. Extra resume points (and money!) for bug bounties in Google, Facebook etc. 5. Join a reputable security consultancy (NCC Group, Optiv, Bishop Fox, etc.) and mature your skills. 6. Decide how you'd like to specialize.
- patcheudor 10y ago
  > 2. Start with application security, because it's the easiest place to get your feet wet. This is true because of the availability of targets, however, the easiest place to get your feet wet is not the same thing as the easiest discipline and people must keep that in mind. Application security is the toughest of the discipline's in my book; far tougher than netsec, oppsec, and many others because it's a world of vast diversity of solutions. It's also a world of vast diversity in attacks from SQLi to XSS, to remote unauthenticated remote code execution, to the identification of logic errors which result in the exposure of sensitive information.
  - dsacco 10y ago
    Yes, I agree, and this is a good addendum to my point. I could quibble about it being the most difficult (I specialize in AppSec and I find crypto much more difficult), but you're right.
- vladimirr 10y ago
  > 2. Start with application security, because it's the easiest place to get your feet wet. What do you mean by that(application security) ? Can you explain me? (Sorry for bad english)
  - dsacco 10y ago
    Sure. There are different disciplines in information security. Application security broadly web, mobile and desktop applications. Application security is the easiest to start working with because, as another commenter said, it is ubiquitous. You can find bug bounties for most major tech companies and their application software these days, which means there is a quite a lot to practice with.
lobo_tuerto 10y ago
"That’s bad for employers but good news for cybersecurity workers, who can command an average salary premium of nearly $6,500 per year, or 9% more than other IT workers." I think $6,500 per year is very low...
- Bartweiss 10y ago
  'Premium', which is to say how much more money security IT work pays than other IT work, on average. Of course, it's still a bit of a silly comparison, because the distribution on "IT" is so wide that you don't learn much without bucketing further.
jwtadvice 10y ago
When we hire skim the list of certifications and look for indications of experience. A list of CVEs, a blog or several years in a serious role rank much higher on our hiring queue. And when we interview, we specifically check for depth on the areas the resume indicates depth on, and we look for breadth everywhere else.
ryanlol 10y ago
Content-wise, CEH is probably one of the worst infosec certifications in existence. And EC-Council is nothing more than a paper mill. This can't be emphasised enough. Check out a few sample questions: http://www.gocertify.com/quizzes/ceh/ceh1.html http://www.gocertify.com/quizzes/ceh/ceh1.html Also review their attrition.org page that exposes how they just copypaste their material from other authors. http://attrition.org/errata/charlatan/ec-council/ http://attrition.org/errata/charlatan/ec-council/ Especially this part: http://attrition.org/errata/charlatan/ec-council/history_and_criticism.html http://attrition.org/errata/charlatan/ec-council/history_and... Oh yeah, EC-council keeps your passport scans and other PII unencrypted in their gmail inbox. I would know, I hacked them once. https://cdn.arstechnica.net/wp-content/uploads/2014/02/EC-hack.png https://cdn.arstechnica.net/wp-content/uploads/2014/02/EC-ha... Stay away from CEH and EC-Council, don't support these scumbags. They're just a bunch of charlatans that managed to grow their paper mill by spamming and stealing material from others. EDIT: Oh! But there's more! Apparently they like to serve ransomware on their website http://arstechnica.co.uk/security/2016/03/ethical-hacker-website-ransomware/ http://arstechnica.co.uk/security/2016/03/ethical-hacker-web... tl;dr: stay the fuck away from CEH and EC-Council.
andersonmvd 10y ago
I'm surprised that he didn't mention CSSLP from (ISC)², the same organization that created CISSP. Certified Secure Software Lifecycle Professional (CSSLP) is a certification focused on all phases of software development lifecycle and is for those who want to add security to the whole development lifecycle instead of focusing on 'finding bugs'. It's great to find bugs, but application security is much more than that, so is information security. This is how I become certified https://dadario.com.br/what-it-takes-to-be-csslp/ https://dadario.com.br/what-it-takes-to-be-csslp/ and more info about the certification https://www.isc2.org/csslp/default.aspx https://www.isc2.org/csslp/default.aspx
eieio123 10y ago
On a related note, here's a quick guide to infosec in the defense industry: 1. Graduate from any school with a degree in CS/CE/Math/Physics. 2. Solve one crackme in your free time. 3. Apply for all entry level jobs at GENERIC DEFENSE CONTRACTOR that involve keyword "ida pro." Prepare to move to a deserted town in Florida or the DC megalopolis. 4. Die on the inside when you spend years working on unbelievably complicated problems that do nothing else except get a government employee promoted. Have everyone else in the news/online tell you you're evil. 5. Spend several months working for a government employee that is amazing at what he or she does. (part of the 20% of employees doing 80% of the work) 6. Watch as that employee is immediately promoted and replaced by someone else who doesn't care. 7. Try to transition to non-defense and discover that for all the talk about "cyber!!!!" and infosec in the news, all anyone actually wants is an IT professional that took a one week course at Blackhat on exploitation/has meaningless certificates/knows how to buy and install Nessus products and Palo Alto products. That has to be 90% of the job postings out there. In all seriousness, if you do think you want to go down the government route, stick to a dedicated research institution or try to get a federal job. There are a very, very small few defense contractors that truly do good work, but they burn too bright and are eventually snuffed out by corporate greed or insane management.
- linkregister 10y ago
  Ha ha ha. That was right on the money. Though it seems a bit too pessimistic. And CCOEs mostly have really boring projects. Raytheon SI, Mantech, and Booz Allen Hamilton have some decent contracts; yes they are in Melbourne and Annapolis Junction (where else would they be in the U.S?). It's hard to get involved in the smaller firms, because DoD wants to keep the best employees from going to these contractors to do their current job for 2x the pay. I'm biased, but I think the better way is to start federal, get into a cool 3-year rotational program for poverty wages, and then go contractor once you've paid your dues for a couple of years. This is, of course, pretty damn niche for infosec. Most infosec folks I've met in the industry have no exposure to this.
  - eieio123 10y ago
    I think that's decent advice. If I was young again, I'd just apply to one of the many security engineering internships out there and skip defense work. Those didn't exist when I was in undergrad. Federal jobs are pretty awesome everywhere except extraordinarily expensive cities. Unfortunately, a good percentage of them are based exactly there. :) (Also, a bit easier to admire the benefits and stability they offer when you're older. Early 20s me would laugh and then apply to whatever popular corporate grinder was hiring for prestige and 6000 hour weeks.) Grass is always greener.
christianbryant 10y ago
I believe an area that goes unnoticed by new security analysts looking to work in penetration testing and exploit authoring is that of OpenVMS and VMS-based systems hacking. I've worked on these systems for years and the word floating around out there is that they are "unhackable". While some have arguments against why this would matter in this day and age, why it really does matter can't be discounted. [1] Finding OpenVMS vulnerabilities and discovering ways to own boxes running the system is not only important but a great resume bullet. [1] https://www.defcon.org/images/defcon-16/dc16.../defcon-16-oberg-nyberg-tusini.pdf https://www.defcon.org/images/defcon-16/dc16.../defcon-16-ob...
FLUX-YOU 10y ago
>That's also reflected in how well rewarded security pros are >That’s bad for employers but good news for cybersecurity workers, who can command an average salary premium of nearly $6,500 per year, or 9% more than other IT workers. Why are the technical skills (in this article specifically) so demanding, but yet the salary is only 9% higher? Same for the other career-starting directions given here -- most of which seem like multi-year time investments. Many of them ask even more of your technical ability than the article before entering the field with a salaried position, and yet that's only worth 9% extra salary?

191 points by jscholes 10y ago

YCode 10y ago

> That’s bad for employers but good news for cybersecurity workers, who can command an average salary premium of nearly $6,500 per year, or 9% more than other IT workers. $6,500 / year? Am I misunderstanding the term "salary premium"? Also the bar graph confuses me. Shouldn't cybersecurity positions be included in "all IT positions"?

ontoillogical 10y ago
That's salary above the average for IT workers. The average IT worker makes $72000, while cybersecurity workers are making $78500, a 9% premium
danielweber 10y ago
Several years ago I was looking for some ranked ordering of IT careers via salary, allowing drilldown to things like different languages and specialities. It's something I slowly figured out via job hopping, but if the list would help people who enjoy X as much as Y realize that Y pays 20% more.
jajern 10y ago
I think the problem is that it's not a very useful graph. I think breaking out the overall IT into other areas would make more sense with smaller percentages being shown as "Other".
uiri 10y ago
The bar graph is reflecting growth as a percentage. I think it would have been better to plot IT positions vs Cybersecurity positions to show the hockey stick growth that he is trying to illustrate.

mi100hael 10y ago

I've enjoyed Troy's posts explaining past high-profile hacks, so I assume the content he created for Pluralsight is pretty good, too. I'm glad he didn't directly tailor them to the CEH, because from what I've seen it's not the most esteemed certification. Most managers I've talked to on the security side of things have said something like Security+ is a good starting point for newbie hires, and CISSP or OSCP are a decent indicator for mid-to-senior hires. In general though, the prevailing sentiment has been that demonstrated experience is the #1 factor. Infosec isn't a career path that begins as a totally oblivious hire after floating around in college. It begins in your bedroom in the evenings poking around bug bounties or playing on hackthissite.org and its forums and that sort of thing. A professional setting isn't required to gain some good real-world experience, so there's no reason you should be inexperienced by the time you're sitting for your first professional interview.

phaus 10y ago
A CISSP is only a good indicator that someone wants a free ride past HR. As a technical certification, or a measure of technical ability, it is worthless.
- toss1941 10y ago
  I wouldn't say worthless, a lot of CISSP's are in management where actual technical ability gets delegated to non-CISSP's. I'm pretty confident that most CISSPs could pick up almost any security-related technical skill if they were motivated to do so.
  - phaus 10y ago
    The context of this thread is that we're talking about technical positions. If you see my other comment, I already mentioned that it's a management cert. Also, if a person with a CISSP is capable of picking up technical skills, that's simply coincidental. The CISSP didn't teach them to learn technical skills, it's completely unrelated. In my experience, motivation is the largest factor in learning anything, so of course a person motivated to spend time learning a specific subject is capable of picking it up.

alltakendamned 10y ago

As a counterpoint for this fluff piece for Pluralsight (mentioned 29 times), I'd like to offer the following links with very good information by well respected people in the industry: - https://www.corelan.be/index.php/2015/10/13/how-to-become-a-pentester/ https://www.corelan.be/index.php/2015/10/13/how-to-become-a-... - https://tisiphone.net/2015/10/12/starting-an-infosec-career-the-megamix-chapters-1-3/ https://tisiphone.net/2015/10/12/starting-an-infosec-career-... - https://danielmiessler.com/blog/build-successful-infosec-career/ https://danielmiessler.com/blog/build-successful-infosec-car...

andersonmvd 10y ago
Allow me to enhance your list. "Owasp Testing Guide V4" is a must read for web hackers, at least for starters: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table... OWASP has vulnerable application projects for you to play with, such as WebGoat "https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project" https://www.owasp.org/index.php/Category:OWASP_WebGoat_Proje..., but there are many applications like these such as "DVWA - Damn Vulnerable Web Application" and variants in Node JS (https://n0where.net/damn-vulnerable-node-application-dvna/ https://n0where.net/damn-vulnerable-node-application-dvna/) I also developed two free courses on "WordPress Security" and "Docker Security" https://dadario.com.br/courses/ https://dadario.com.br/courses/ The point is to learn development / infrastructure first, then study attacks and defense to develop a security mindset. Get involved in bug bounties, but learn how to fix, don't let your code skills rust. Then learn more security concepts, how to build a corporate security program and keep moving :) There's also a very famous book in the area: "The Web Application Hacker's Handbook" http://mdsec.net/wahh/ http://mdsec.net/wahh/

avenueb 10y ago

10+ year info sec veteran here. I think first order of business is do you want to be a specialist or a generalist? Application security is but one piece (albeit in many cases a very important piece). I chose generalist and I am happy to have done so. Today I am diving into Strict Transport Security, yes, but also working with HR and IT on our employee onboarding and off-boarding process, reviewing vendor and customer contracts and federal compliance requirements. Privacy, Regulations and Law, Compliance, IT and infrastructure security, corporate IT security, and yes application security - every day I deal with all of the above and I love that. And a great foundation into all the things a security person may do, I cannot recommend the CISSP enough go for the CISSP (or, alternatively, CISA) certification.

phaus 10y ago
The CISSP is a certification designed to give managers a high-level understanding of the different areas of security. For some stupid reason, HR people think it's the gold standard of technical certifications. Unless a person has is an absolute beginner, they probably won't learn anything technical.
sandworm101 10y ago
10 years isnt enough for vet status. If you didnt live through the crypto wars of tye 90s, if you never saw Sony's rootkit in action, you arent a vet.
- grub5000 10y ago
  6 months in Iraq isn't enough for vet status. If you didn't live through the Vietnam War of tye 70s, if you never saw the AK-47 in action, you arent a vet.
  - sandworm101 10y ago
    Really? You seriuosly think i meant to comment about military vets? Words in context.

tptacek 10y ago

I like Troy, but I need to put in a word here against pursuing certifications. There are no employers in security that I know that anyone wants to work for that take certification seriously. The best people working in security --- not just in application security but in network security, red-teaming, exploit development, and cryptography --- don't have certificates. If you want to work in startups, a hiring process that even asks if you have a certification is a big red flag. This is less true in the broader tech industry, but while it's probably not a good idea to discard a prospective Fortune 500 employer just because they ask if you have any certifications, it is certainly reasonable to pull the ejection lever hard if an employer cares about them. Every minute you'd spend pursuing certification is better spent building programming skills. For whatever it's worth, I still stand behind everything in here: https://krebsonsecurity.com/2012/06/how-to-break-into-security-ptacek-edition/ https://krebsonsecurity.com/2012/06/how-to-break-into-securi...

linkregister 10y ago
For what it's worth, Troy's perspective is colored by living in Australia. My experience is that the Australian tech scene (I don't live there anymore) is in many ways similar to the 1990s in the U.S. Customers and recruiters ask about certificates. Hell, you typically have to go through a professional recruiter in order to get a job; it is often not possible to apply directly to companies. I am generalizing and also talking about my experience in Australia about 8 years ago. Maybe everything has changed.
- OJ 10y ago
  While the tech scene in Australia may be behind the times in a few ways (possibly security as well), Troy's view here is in no way affected by living here. This material was created because PluralSight wanted CEH-related material, as their viewers (world-wide) were asking for it. Full stop. Blog posts like that are designed to steer traffic towards course views and "time watching the content", without which PluralSight authors don't get paid.
Bartweiss 10y ago
An example: Matasano (I have no affiliation) is a well-respected security company. Their hiring process involves (or involved) taking applications from interested people with interesting resumes, sending them a textbook, and asking them to come back when they felt qualified. I've seen this sort of outlook (usually without the textbook) across the board. Either a company will train people from scratch, or they want to see applicants with actual records of working security, finding and reporting vulnerabilities, or patching holes in OSS. "Have a certificate" is nowhere on that list. It probably can't hurt for a candidate, but I certainly don't think it will bridge the gap from inexperienced to experienced the way an actual work record would.

debatem1 10y ago

As a hiring security manager: go break shit. I don't care if you have a CEH, I care if you can bring me good vulns. Show me you can break things I care about and that you're not a horrible person and you'll go straight to the top of the list. It's that simple. How do you get started breaking shit? Github has tons of shit. Go break it. More interested in hardware? Go buy some crappy iot gear and break it. Vulns are not rare and they do not require a damn piece of paper to find. Find them, and you will have no problem finding jobs. If you are reading this and still don't know where to start, I am happy to help you find things to break and suggest approaches that might help. But seriously,don't waste your time and money getting certified. I don't care at all.

patcheudor 10y ago
To this point, bug bounties, bug bounties, bug bounties. If someone is applying to be a security developer, consultant, or anything beyond a security help desk operator my expectation is that they can tell me about bounties they've collected. In lieu of that, I'll accept them telling me about their ethical disclosures. Also playing CTF's, even without winning is a good sign. It shows passion and that's what matters at this point as we need people in security not because of the money, but because they passionately want to make the world a safer place and enjoy the work as a bonus.
- dsacco 10y ago
  I want to push back against this a bit because you used the word "expectation." Yes, I strongly agree that bug bounties are one way to achieve and demonstrate a certain level of expertise in information security, especially if you are trying to break in. However, don't make it more than a job for people who just want to do the job, and don't arbitrarily make it the whiteboard of the security industry. My best colleagues, the people I most deeply respect and the people who inspired me to work in this industry all neglect bug bounties. They mostly don't participate in them at all. Bug bounties are usually pursued by people who have the free time and bandwidth for them. For the most part, most security consultants and engineers do not actually engage in them because they are already highly paid. This is why you most frequently see bug bounty participants from countries other than the United States and Western Europe. Those that do have a full-time position and also engage in bug bounties certainly have a commendable passion for the work (or sometimes more accurately a workable formula for getting to low hanging fruit in new programs first), but please don't expect all or even most skilled security talent to adhere to this rule. Many people enjoy being skilled without sacrificing work-life balance. Just as not every software engineer needs to contribute to open source or have a GitHub profile, not every security engineer needs to have badgers for every company they've hacked.

icantdrive55 10y ago

" A cert like CEH may open doors and create opportunities you wouldn't have had otherwise, but that's only part of the story" 1. I would be embarrassed to admit passing this. This is so basic, and so general, it's not even worth the 49.00 price tag for the book. 2. This is a profession where there's going to be a lot of "trust me's". 3. If I was hiring for this position, I would ask the candidate in the interview to find my network password. I would look for a packet injection wifi. I would want to see how they used Kali. I would want a true Hacker. Ties would most likely walk. I want someone who looks like they have broke into systems before. 4. I guess so much in this profession is self promotion, and confidence. Maybe not even earned confidence; just bold confidence? I do not have that confidence.

dsacco 10y ago

I'll echo what debatem1 and tptacek said here with what I tell everyone: 0. Do not pursue certifications at all. 1. Learn to code. C + Python is a great choice, to start with (or C + Ruby). 2. Start with application security, because it's the easiest place to get your feet wet. 3. Work through The Web Application Hacker's Handbook (don't just read it). 4. Find bug bounties in as many programs on BugCrowd or HackerOne as you can. Extra resume points (and money!) for bug bounties in Google, Facebook etc. 5. Join a reputable security consultancy (NCC Group, Optiv, Bishop Fox, etc.) and mature your skills. 6. Decide how you'd like to specialize.

patcheudor 10y ago
> 2. Start with application security, because it's the easiest place to get your feet wet. This is true because of the availability of targets, however, the easiest place to get your feet wet is not the same thing as the easiest discipline and people must keep that in mind. Application security is the toughest of the discipline's in my book; far tougher than netsec, oppsec, and many others because it's a world of vast diversity of solutions. It's also a world of vast diversity in attacks from SQLi to XSS, to remote unauthenticated remote code execution, to the identification of logic errors which result in the exposure of sensitive information.
- dsacco 10y ago
  Yes, I agree, and this is a good addendum to my point. I could quibble about it being the most difficult (I specialize in AppSec and I find crypto much more difficult), but you're right.
vladimirr 10y ago
> 2. Start with application security, because it's the easiest place to get your feet wet. What do you mean by that(application security) ? Can you explain me? (Sorry for bad english)
- dsacco 10y ago
  Sure. There are different disciplines in information security. Application security broadly web, mobile and desktop applications. Application security is the easiest to start working with because, as another commenter said, it is ubiquitous. You can find bug bounties for most major tech companies and their application software these days, which means there is a quite a lot to practice with.

lobo_tuerto 10y ago

"That’s bad for employers but good news for cybersecurity workers, who can command an average salary premium of nearly $6,500 per year, or 9% more than other IT workers." I think $6,500 per year is very low...

Bartweiss 10y ago
'Premium', which is to say how much more money security IT work pays than other IT work, on average. Of course, it's still a bit of a silly comparison, because the distribution on "IT" is so wide that you don't learn much without bucketing further.

jwtadvice 10y ago

When we hire skim the list of certifications and look for indications of experience. A list of CVEs, a blog or several years in a serious role rank much higher on our hiring queue. And when we interview, we specifically check for depth on the areas the resume indicates depth on, and we look for breadth everywhere else.

ryanlol 10y ago

Content-wise, CEH is probably one of the worst infosec certifications in existence. And EC-Council is nothing more than a paper mill. This can't be emphasised enough. Check out a few sample questions: http://www.gocertify.com/quizzes/ceh/ceh1.html http://www.gocertify.com/quizzes/ceh/ceh1.html Also review their attrition.org page that exposes how they just copypaste their material from other authors. http://attrition.org/errata/charlatan/ec-council/ http://attrition.org/errata/charlatan/ec-council/ Especially this part: http://attrition.org/errata/charlatan/ec-council/history_and_criticism.html http://attrition.org/errata/charlatan/ec-council/history_and... Oh yeah, EC-council keeps your passport scans and other PII unencrypted in their gmail inbox. I would know, I hacked them once. https://cdn.arstechnica.net/wp-content/uploads/2014/02/EC-hack.png https://cdn.arstechnica.net/wp-content/uploads/2014/02/EC-ha... Stay away from CEH and EC-Council, don't support these scumbags. They're just a bunch of charlatans that managed to grow their paper mill by spamming and stealing material from others. EDIT: Oh! But there's more! Apparently they like to serve ransomware on their website http://arstechnica.co.uk/security/2016/03/ethical-hacker-website-ransomware/ http://arstechnica.co.uk/security/2016/03/ethical-hacker-web... tl;dr: stay the fuck away from CEH and EC-Council.

andersonmvd 10y ago

I'm surprised that he didn't mention CSSLP from (ISC)², the same organization that created CISSP. Certified Secure Software Lifecycle Professional (CSSLP) is a certification focused on all phases of software development lifecycle and is for those who want to add security to the whole development lifecycle instead of focusing on 'finding bugs'. It's great to find bugs, but application security is much more than that, so is information security. This is how I become certified https://dadario.com.br/what-it-takes-to-be-csslp/ https://dadario.com.br/what-it-takes-to-be-csslp/ and more info about the certification https://www.isc2.org/csslp/default.aspx https://www.isc2.org/csslp/default.aspx

eieio123 10y ago

On a related note, here's a quick guide to infosec in the defense industry: 1. Graduate from any school with a degree in CS/CE/Math/Physics. 2. Solve one crackme in your free time. 3. Apply for all entry level jobs at GENERIC DEFENSE CONTRACTOR that involve keyword "ida pro." Prepare to move to a deserted town in Florida or the DC megalopolis. 4. Die on the inside when you spend years working on unbelievably complicated problems that do nothing else except get a government employee promoted. Have everyone else in the news/online tell you you're evil. 5. Spend several months working for a government employee that is amazing at what he or she does. (part of the 20% of employees doing 80% of the work) 6. Watch as that employee is immediately promoted and replaced by someone else who doesn't care. 7. Try to transition to non-defense and discover that for all the talk about "cyber!!!!" and infosec in the news, all anyone actually wants is an IT professional that took a one week course at Blackhat on exploitation/has meaningless certificates/knows how to buy and install Nessus products and Palo Alto products. That has to be 90% of the job postings out there. In all seriousness, if you do think you want to go down the government route, stick to a dedicated research institution or try to get a federal job. There are a very, very small few defense contractors that truly do good work, but they burn too bright and are eventually snuffed out by corporate greed or insane management.

linkregister 10y ago
Ha ha ha. That was right on the money. Though it seems a bit too pessimistic. And CCOEs mostly have really boring projects. Raytheon SI, Mantech, and Booz Allen Hamilton have some decent contracts; yes they are in Melbourne and Annapolis Junction (where else would they be in the U.S?). It's hard to get involved in the smaller firms, because DoD wants to keep the best employees from going to these contractors to do their current job for 2x the pay. I'm biased, but I think the better way is to start federal, get into a cool 3-year rotational program for poverty wages, and then go contractor once you've paid your dues for a couple of years. This is, of course, pretty damn niche for infosec. Most infosec folks I've met in the industry have no exposure to this.
- eieio123 10y ago
  I think that's decent advice. If I was young again, I'd just apply to one of the many security engineering internships out there and skip defense work. Those didn't exist when I was in undergrad. Federal jobs are pretty awesome everywhere except extraordinarily expensive cities. Unfortunately, a good percentage of them are based exactly there. :) (Also, a bit easier to admire the benefits and stability they offer when you're older. Early 20s me would laugh and then apply to whatever popular corporate grinder was hiring for prestige and 6000 hour weeks.) Grass is always greener.

christianbryant 10y ago

I believe an area that goes unnoticed by new security analysts looking to work in penetration testing and exploit authoring is that of OpenVMS and VMS-based systems hacking. I've worked on these systems for years and the word floating around out there is that they are "unhackable". While some have arguments against why this would matter in this day and age, why it really does matter can't be discounted. [1] Finding OpenVMS vulnerabilities and discovering ways to own boxes running the system is not only important but a great resume bullet. [1] https://www.defcon.org/images/defcon-16/dc16.../defcon-16-oberg-nyberg-tusini.pdf https://www.defcon.org/images/defcon-16/dc16.../defcon-16-ob...

FLUX-YOU 10y ago

>That's also reflected in how well rewarded security pros are >That’s bad for employers but good news for cybersecurity workers, who can command an average salary premium of nearly $6,500 per year, or 9% more than other IT workers. Why are the technical skills (in this article specifically) so demanding, but yet the salary is only 9% higher? Same for the other career-starting directions given here -- most of which seem like multi-year time investments. Many of them ask even more of your technical ability than the article before entering the field with a salaried position, and yet that's only worth 9% extra salary?