4 ms·

Depends on what you want to do. If you are good with people, I suggest Information Assurance. It's basically consulting combined with cyber security. Most SMEs

Depends on what you want to do. If you are good with people, I suggest Information Assurance. It's basically consulting combined with cyber security. Most SMEs only require advice on basic network security, password management, how to avoid phishing attacks, social engineering attacks and ransomware, how to handle crises after being hacked etc. Checklists will get you a long way. Leave the reverse engineering of malware etc. to people with more interest and time. It is a more narrow field, takes a lot of additional effort and requires a fair bit of talent. If you are just going into cybersecurity for money, stick with IA. I know this is not a popular opinion on HN, but your average SME won't be able to do information security properly (remember, your average consumer believes in using an anti-virus to clean out a infected machine, when the correct thing to do is a complete wipe and reinstallation). Easier get them to offload most of their productivity tools to SaaSes and buy plenty of insurance than try to force FANG-level access control protocols on them.

sansnomme 7y ago
If you are looking for technical resources for internet security, books by Zalewski are pretty good for a conceptual understanding. (Silence on the Wire and The Tangled Web)
SE_Student 7y ago
> Leave the reverse engineering of malware etc. to people with more interest and time. ... > (remember, your average consumer believes in using an anti-virus to clean out a infected machine, when the correct thing to do is a complete wipe and reinstallation). Easier get them to offload most of their productivity tools to SaaSes and buy plenty of insurance than try to force FANG-level access control protocols on them. this is a very bad advice.
- sansnomme 7y ago
  Not really, do you honestly want people to be hosting their own email servers? Stuff like networked filesystems and NAS over VPN requires a tremendous amount of work to properly secure. Better give the money to a *aas company than to waste it on incompetent IT departments. Especially since a lot of companies consider IT to be a cost center instead of a source of value. Idealism is nice and all but most companies won't care enough and data protection laws don't magically make the problem go away. More pragmatic to simply outsource security to more qualified technical companies instead of trying to do it yourself. Also, low level OS/assembly level domain knowledge isn't as useful for non-technical, SMEs. There's not much a company can do when you tell them their 30 year old in-house CAD software written in Fortran 77 parses file in an insecure way after fuzzing it. Their original programmer is long gone. They are not going to rewrite it anytime soon. Sticking it in a VM may be their best option. You are not there to engineer a malware to break their systems. You are their to tell them what's wrong and how to fix it in the cheapest way possible. Threats from phishing, ransomware, and poorly implemented BYOD policies are a lot more dangerous to most companies.

sansnomme 7y ago

If you are looking for technical resources for internet security, books by Zalewski are pretty good for a conceptual understanding. (Silence on the Wire and The Tangled Web)

SE_Student 7y ago

> Leave the reverse engineering of malware etc. to people with more interest and time. ... > (remember, your average consumer believes in using an anti-virus to clean out a infected machine, when the correct thing to do is a complete wipe and reinstallation). Easier get them to offload most of their productivity tools to SaaSes and buy plenty of insurance than try to force FANG-level access control protocols on them. this is a very bad advice.

sansnomme 7y ago
Not really, do you honestly want people to be hosting their own email servers? Stuff like networked filesystems and NAS over VPN requires a tremendous amount of work to properly secure. Better give the money to a *aas company than to waste it on incompetent IT departments. Especially since a lot of companies consider IT to be a cost center instead of a source of value. Idealism is nice and all but most companies won't care enough and data protection laws don't magically make the problem go away. More pragmatic to simply outsource security to more qualified technical companies instead of trying to do it yourself. Also, low level OS/assembly level domain knowledge isn't as useful for non-technical, SMEs. There's not much a company can do when you tell them their 30 year old in-house CAD software written in Fortran 77 parses file in an insecure way after fuzzing it. Their original programmer is long gone. They are not going to rewrite it anytime soon. Sticking it in a VM may be their best option. You are not there to engineer a malware to break their systems. You are their to tell them what's wrong and how to fix it in the cheapest way possible. Threats from phishing, ransomware, and poorly implemented BYOD policies are a lot more dangerous to most companies.