9 ms·

Ask HN: What skills are required to pursue information security/ cyber security

• bush-bby 5y ago
  Take this with a grain of salt, as I also find myself in pursuit...but what I’ve found so far is a lot of the knowledge that’s taught accessibly is how to scan for and assess common vulnerabilities and exploits. Mostly trying to find out what kind of software the hardware is running, and finding an unpatched vulnerability for that version. As I’ve been told a million times, “95% of all malicious acts were done simply because people didn’t or couldn’t update their software in time.” However I can say without a doubt the most advantageous positions I find myself in, are when I’m able to apply some specific set of knowledge with a couple others, and figure out how to chain together various aspects of the software creation process in order to produce a bug in my favor. But in terms of actually breaking into the info sec field, a good place to start is ctf challenges, and while 99% of the time this will consist of just executing some else’s code to exploit a vulnerability patched long ago, it will show you the common types of attacks and defenses, and introduce you to functionalities that you might otherwise not come into contact with as a programmer.
  • mraza007 5y ago
    Thank you for the advice, Do you suggest any certifications and how do you find vulnerabilities or how do you get into a mindset of finding
    • bush-bby 5y ago
      Idk about certifications, in my experience looking for jobs as both red team and blue team, it seems there's no general standard, but there are some that come as a have to have bare minimum, like Comptia's Security+, and some that come as higher-ranking achievements, like the OSCP. A quick search of jobs that you would want to have will reveal what hirers are looking for generally speaking. As to Finding vulnerabilities or bugs, The only advice I feel as though I'm qualified to give is just have a perpetual pursuit for knowing how things work. Whenever I come across a technology or application, the first thing on my mind is normally how is it doing what it's doing. As you get experience diving into various types of applications, you begin to notice the common functionalities and parameters in which they work, you pick up valuable insights and knowledge about the various idiosyncrasies of whatever. I often find when I'm tracing through my process of realization of a specific vulnerability , a lot of the steps have no correlation, and had I not been curious about how something worked, just lacking that small piece of background knowledge would've meant never being able to get to all the other stages which required other background knowledge. Wether it be web development, database architecture, cryptography, network protocols, psychology etc. You need all the pieces to put together the puzzle, so knowing how technologies work and work together, is really the largest advantage I've had. A good place to start would literally be just taking whatever technology you use well currently, and typing it into google followed by vulnerabilities, and learn how each works. This will stem out into other realms and before you know it you'll possess an incredible diverse knowledge set.
      • mraza007 5y ago
        Got it anyways thank you for your advice I really appreciate
• high_byte 5y ago
  it is quality assurance just for bugs relating information security.