7 ms·

Infosec Core Competencies

125 points by kiyanwang 5y ago

lucb1e 5y ago
This actually helps with impostor syndrome. Not what I came here for, but the effect I notice. Since I've been doing the job, I figured I can pull it off mostly but... it often still feels like I barely know what I'm doing. Reading this list, the topics are quite varied from network to filesystem to scripting, and yet I'm definitely confident in 47 of these 50 topics. Two of the remaining three I can do as specified, but not more deeply. For the final one, I already knew I'm lacking ($cloud vendor specific permission stuff) but I just don't find that area very motivating even if it looks like the established cloud vendors are here to stay. Feels rather dull to memorize vendor-specific words for established techniques and learn platform-specific attacks like the metadata service on AWS. Anyway, it also seems like a good list (nice to say when you just said you know basically all of this? heh), because the topics are so varied yet it seems to aptly cover what I indeed use in daily work. Some points are more rare of course, like PMS logging for Wireshark (most of the time you do MITM rather than make the client log decryption keys), but still good to know of. I will probably refer to this next time someone asks me how to get into security! My answers to that question were previously quite basic, like just read up on attacks for the systems you're interested in or familiar with, or start with the OWASP top 10 if you don't know where to start. Then again, this list might also seems daunting if you need to ask the question of how to get started, hmm. One thing to perhaps add would be subnetting / network isolation. It's not something you need in every assignment, but more often than you might think. Even if you do a simple web assignment and you find an SSRF through which you can obtain something important, being able to explain what isolation they are lacking and how it's supposed to be implemented without being able to bypass e.g. the VLAN tagging is helpful to your client (even if only the most high-security organisations care to properly implement it). The list mentions CIDRs, but knowing that there exists such a thing as IP ranges is of course not the whole story. Also, the number of times the customer came with an isolated offline environment for either exams or sensitive systems... with a recursive DNS resolver... But I suppose #22 could cover that even if it doesn't specifically mention DNS tunneling.
hirako2000 5y ago
While I agree with the bag of technical knowledge desirable for an infosec job, it's worth noting that many who hold such role have pivoted from another more or less technical field of work. A software developer who got familiar with networking, crypto, pentesting along the years makes a smooth transition within the same company, ramps up with the details in a few weeks and proudly wears the hat. Similarly, devops/cloud/site reliability enginners, and more commonly sysadmins, and security consultants have an easy time transitioning.
galacticaactual 5y ago
This is not a good list. A better use of time is to internalize the ATT&CK matrix and compose multi-axis controls and detections for each tactic and technique.
- tptacek 5y ago
  I don't really think there are any lists like this that are "good", but I also don't know many people in the field that don't roll their eyes at ATT&CK these days.
  - easterncalculus 5y ago
    When it comes to ATT&CK I have personally seen people go 50/50 on it, with most support coming from those in large enterprises. It's a pretty good resource for pentesting or red-team engagements, but probably could use less evangelizing.
    - tptacek 5y ago
      I spent from 2005 until ~last year running pentest engagements, for what it's worth.
      - easterncalculus 5y ago
        I definitely haven't. Is it something you reference? Some of the technical aspects seem as fine as anything you could google, but the whole kill-chain thing always seemed a little overblown. I agree with your comment about it not benefiting practitioners as much.
  - galacticaactual 5y ago
    Is your thesis that spending time analyzing and decomposing TTPs in the framework a waste of time? If it were, I would agree. My assertion is that it is not. As far as embedding the TTPs in every marketing white paper out there, yeah, agree that’s dumb.
tptacek 5y ago
I'm at bullet one of this list and immediately, entirely skeptical, since that bullet suggests that a common core competency of infosec people is evaluating a CVE by its CVSS score (which, we're told, has meaning relative to your own environment; that's where the art lies, presumably). But CVSS is an industry-wide joke. It means almost literally nothing (a 9+ is usually, but not always, more severe than a 2). It's a Ouija board, computed by a mysterious calculator and adjusted by imperceptible nudges until the score matches the intuitions of the scorer.
- lucb1e 5y ago
  > a 9+ is usually, but not always, more severe than a 2 which is exactly why learning to read these things (the full vector, I believe is what the author meant rather than just the resulting number) is useful when looking at a list of CVEs. Will it tell you the full story and everything you need to know? Of course not. Will it tell you what the impact for your business situation will be? Nope. Does it help you initially filter out the network-accessible no-privileges-required vulnerabilities that apply to your situation because you aren't local on the host and don't have credentials? Yes, that's where it's helpful. My employer chose to use CVSS vectors to avoid discussions about whether something should be e.g. low/medium/high impact, and frankly I disagree with them. We still have discussions while it limits our ability to represent the likelihood of exploitation, the impact, or the resulting risk. So I'm fully on board that CVSS is very often not representative, especially the final score but sometimes also it just doesn't ask the right 'questions' (the parameters) to reflect what the problem or impact is. But I can still see what the author meant about reading a CVSS vector specified for a CVE.
- silly-silly 5y ago
  > But CVSS is an industry-wide joke. Tell me more how a factual explanation of a software's exploitation techniques is a joke. I think you're drinking the repetitive koolaid that is frequently passed around on boards like this.
  - tptacek 5y ago
    That's not what CVSS is, in practice.
easterncalculus 5y ago
I like the objective of this article and most of what's in it but I think it leaves itself open to criticism. I have doubts about the benefit of even implying a sense of objectivity to these so-called requirements because infosec is such a wide field and people from all over can and do never deal with a lot of these things. A lot of folks in the industry would say that this lacks mention of LDAP, SAML, and other key protocols. Many folks would say that this is a very *NIX-centric list of utilities, or will work an entire career and never even see SPF or DNSSEC. Many pentesters would say that your understanding of security is only as good as your knowledge of how to break it, and insist on many more vulnerability types and tools as "core competencies" to this list. There's plenty of work being done in securing smart contracts and other cryptocurrency systems, so it's clearly opinion to insist on people avoiding it. Personally speaking, I think the insistence that there are tons of cryptocurrency people that don't know what cryptography is melodramatic and at some level not really possible. The idea of said people not knowing even what cryptography is while evangelizing about it is a contradiction. At this point most folks' beliefs on it are heavily correlated to personal politics, from people condemning or proclaiming it. That's a whole other topic, which is another reason why any binding opinions on it are not something I would include in an infosec core competencies list. All this being said, I think getting to a consensus on what to learn is a good idea, and there are plenty of things that I personally agree with in this list, many or most of them even. The author is clear and up-front about it being based on his experience, but it appears pretty heavily so. It's still good, but I think this list would be better as a Git repository than a blog post.
hn8788 5y ago
Missing the most important one; being able to communicate security issues to non-security people. It doesn't matter that youre a super hacker if you cant explain why people should listen, or report your findings without the devs feeling like it's a personal attack.
- ozim 5y ago
  I up voted but there is place for super technical people who are not good at explaining. There is also a lot of place for people who understand stuff technically but are not exploiting boxes days in days out, that can talk and explain in more general terms lots of those things.
______- 5y ago
You also have to have a rebellious and slightly sly streak in you. This helps if you're going to do social engineering. You may have to learn to be more charismatic or learn superficial charm[0] and be able to play people's emotions. Another thing: some people just fall into blackhat/whitehat/greyhat hacking naturally after learning that Everything is Broken[1]. [0] https://en.wikipedia.org/wiki/Superficial_charm https://en.wikipedia.org/wiki/Superficial_charm [1] https://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1 > Once upon a time, a friend of mine accidentally took over thousands of computers. He had found a vulnerability in a piece of software and started playing with it. In the process, he figured out how to get total administration access over a network. He put it in a script, and ran it to see what would happen, then went to bed for about four hours. Next morning on the way to work he checked on it, and discovered he was now lord and master of about 50,000 computers. After nearly vomiting in fear he killed the whole thing and deleted all the files associated with it. In the end he said he threw the hard drive into a bonfire. I can’t tell you who he is because he doesn’t want to go to Federal prison, which is what could have happened if he’d told anyone that could do anything about the bug he’d found. Did that bug get fixed? Probably eventually, but not by my friend. This story isn’t extraordinary at all. Spend much time in the hacker and security scene, you’ll hear stories like this and worse.
1MachineElf 5y ago
Title should be adjusted to the actual title of the blog post: (Technical) Infosec Core Competencies InfoSec is a management practice. These technical skills are nice to have, but with the exception of #1 (understanding CVEs, CWEs, and CVSSs), you do not need the skills on this list in order to acquire and be productive in an InfoSec job. Someone with these technical skills is cut out to be a security researcher, part of a Red Team, working on the detection side of a SOC, or similar. Those are great and valuable roles, but not quite InfoSec. For an InfoSec job, give me someone who knows security management frameworks, can read security guidance, who can lead on processes we use to manage IT security, who can generate (and optionally build) security status reports, who gets the organizational chain of command for how IT security work gets done.
unethical_ban 5y ago
If you get decent at 3/4 of this list, you're in the top 5% of infosec professionals. Not that knowing all of these is bad, but you do not need to have all of these skills to be a well paid, in-demand infosec worker. It also depends on what subfield you're going in. Are you going to be the only Infosec person at a small company? You need to know a lot more breadth than if you're going to be the email security gateway admin at a behemoth bank.
- R0b0t1 5y ago
  How do you prove you know these things to a potential employer? A lot of businesses in this area are looking for credentials. A lot of competent people do not have credentials, and the credentials that do exist aren't very good anyway.
  - unethical_ban 5y ago
    That goes beyond this one industry - the resume filter of HR departments is a tough gauntlet to get through. You'll have to start with intro level jobs, get certified by a decent org (AWS security, SANS, or maybe some "code academy" like cyber courses. And be able to talk about your home lab and interests.
ClumsyPilot 5y ago
"Enough Python, Perl, PHP, C, Go, Java, and JavaScript to be able to read all the random code you come across and at least make some sense of it." That's super broad and potentially more than most devs ever accomplish. Also some mention of windows or non-aws providers might be nice?
dejj 5y ago
> How to read a CVE announcement How do you get the list of newest CVEs? Is Twitter the preferred interface?

125 points by kiyanwang 5y ago

This actually helps with impostor syndrome. Not what I came here for, but the effect I notice. Since I've been doing the job, I figured I can pull it off mostly but... it often still feels like I barely know what I'm doing. Reading this list, the topics are quite varied from network to filesystem to scripting, and yet I'm definitely confident in 47 of these 50 topics. Two of the remaining three I can do as specified, but not more deeply. For the final one, I already knew I'm lacking ($cloud vendor specific permission stuff) but I just don't find that area very motivating even if it looks like the established cloud vendors are here to stay. Feels rather dull to memorize vendor-specific words for established techniques and learn platform-specific attacks like the metadata service on AWS. Anyway, it also seems like a good list (nice to say when you just said you know basically all of this? heh), because the topics are so varied yet it seems to aptly cover what I indeed use in daily work. Some points are more rare of course, like PMS logging for Wireshark (most of the time you do MITM rather than make the client log decryption keys), but still good to know of. I will probably refer to this next time someone asks me how to get into security! My answers to that question were previously quite basic, like just read up on attacks for the systems you're interested in or familiar with, or start with the OWASP top 10 if you don't know where to start. Then again, this list might also seems daunting if you need to ask the question of how to get started, hmm. One thing to perhaps add would be subnetting / network isolation. It's not something you need in every assignment, but more often than you might think. Even if you do a simple web assignment and you find an SSRF through which you can obtain something important, being able to explain what isolation they are lacking and how it's supposed to be implemented without being able to bypass e.g. the VLAN tagging is helpful to your client (even if only the most high-security organisations care to properly implement it). The list mentions CIDRs, but knowing that there exists such a thing as IP ranges is of course not the whole story. Also, the number of times the customer came with an isolated offline environment for either exams or sensitive systems... with a recursive DNS resolver... But I suppose #22 could cover that even if it doesn't specifically mention DNS tunneling.

hirako2000 5y ago

While I agree with the bag of technical knowledge desirable for an infosec job, it's worth noting that many who hold such role have pivoted from another more or less technical field of work. A software developer who got familiar with networking, crypto, pentesting along the years makes a smooth transition within the same company, ramps up with the details in a few weeks and proudly wears the hat. Similarly, devops/cloud/site reliability enginners, and more commonly sysadmins, and security consultants have an easy time transitioning.

galacticaactual 5y ago

This is not a good list. A better use of time is to internalize the ATT&CK matrix and compose multi-axis controls and detections for each tactic and technique.

tptacek 5y ago
I don't really think there are any lists like this that are "good", but I also don't know many people in the field that don't roll their eyes at ATT&CK these days.
- easterncalculus 5y ago
  When it comes to ATT&CK I have personally seen people go 50/50 on it, with most support coming from those in large enterprises. It's a pretty good resource for pentesting or red-team engagements, but probably could use less evangelizing.
  - tptacek 5y ago
    I spent from 2005 until ~last year running pentest engagements, for what it's worth.
    - easterncalculus 5y ago
      I definitely haven't. Is it something you reference? Some of the technical aspects seem as fine as anything you could google, but the whole kill-chain thing always seemed a little overblown. I agree with your comment about it not benefiting practitioners as much.
- galacticaactual 5y ago
  Is your thesis that spending time analyzing and decomposing TTPs in the framework a waste of time? If it were, I would agree. My assertion is that it is not. As far as embedding the TTPs in every marketing white paper out there, yeah, agree that’s dumb.

tptacek 5y ago

I'm at bullet one of this list and immediately, entirely skeptical, since that bullet suggests that a common core competency of infosec people is evaluating a CVE by its CVSS score (which, we're told, has meaning relative to your own environment; that's where the art lies, presumably). But CVSS is an industry-wide joke. It means almost literally nothing (a 9+ is usually, but not always, more severe than a 2). It's a Ouija board, computed by a mysterious calculator and adjusted by imperceptible nudges until the score matches the intuitions of the scorer.

lucb1e 5y ago
> a 9+ is usually, but not always, more severe than a 2 which is exactly why learning to read these things (the full vector, I believe is what the author meant rather than just the resulting number) is useful when looking at a list of CVEs. Will it tell you the full story and everything you need to know? Of course not. Will it tell you what the impact for your business situation will be? Nope. Does it help you initially filter out the network-accessible no-privileges-required vulnerabilities that apply to your situation because you aren't local on the host and don't have credentials? Yes, that's where it's helpful. My employer chose to use CVSS vectors to avoid discussions about whether something should be e.g. low/medium/high impact, and frankly I disagree with them. We still have discussions while it limits our ability to represent the likelihood of exploitation, the impact, or the resulting risk. So I'm fully on board that CVSS is very often not representative, especially the final score but sometimes also it just doesn't ask the right 'questions' (the parameters) to reflect what the problem or impact is. But I can still see what the author meant about reading a CVSS vector specified for a CVE.
silly-silly 5y ago
> But CVSS is an industry-wide joke. Tell me more how a factual explanation of a software's exploitation techniques is a joke. I think you're drinking the repetitive koolaid that is frequently passed around on boards like this.
- tptacek 5y ago
  That's not what CVSS is, in practice.

easterncalculus 5y ago

I like the objective of this article and most of what's in it but I think it leaves itself open to criticism. I have doubts about the benefit of even implying a sense of objectivity to these so-called requirements because infosec is such a wide field and people from all over can and do never deal with a lot of these things. A lot of folks in the industry would say that this lacks mention of LDAP, SAML, and other key protocols. Many folks would say that this is a very *NIX-centric list of utilities, or will work an entire career and never even see SPF or DNSSEC. Many pentesters would say that your understanding of security is only as good as your knowledge of how to break it, and insist on many more vulnerability types and tools as "core competencies" to this list. There's plenty of work being done in securing smart contracts and other cryptocurrency systems, so it's clearly opinion to insist on people avoiding it. Personally speaking, I think the insistence that there are tons of cryptocurrency people that don't know what cryptography is melodramatic and at some level not really possible. The idea of said people not knowing even what cryptography is while evangelizing about it is a contradiction. At this point most folks' beliefs on it are heavily correlated to personal politics, from people condemning or proclaiming it. That's a whole other topic, which is another reason why any binding opinions on it are not something I would include in an infosec core competencies list. All this being said, I think getting to a consensus on what to learn is a good idea, and there are plenty of things that I personally agree with in this list, many or most of them even. The author is clear and up-front about it being based on his experience, but it appears pretty heavily so. It's still good, but I think this list would be better as a Git repository than a blog post.

hn8788 5y ago

Missing the most important one; being able to communicate security issues to non-security people. It doesn't matter that youre a super hacker if you cant explain why people should listen, or report your findings without the devs feeling like it's a personal attack.

ozim 5y ago
I up voted but there is place for super technical people who are not good at explaining. There is also a lot of place for people who understand stuff technically but are not exploiting boxes days in days out, that can talk and explain in more general terms lots of those things.

______- 5y ago

You also have to have a rebellious and slightly sly streak in you. This helps if you're going to do social engineering. You may have to learn to be more charismatic or learn superficial charm[0] and be able to play people's emotions. Another thing: some people just fall into blackhat/whitehat/greyhat hacking naturally after learning that Everything is Broken[1]. [0] https://en.wikipedia.org/wiki/Superficial_charm https://en.wikipedia.org/wiki/Superficial_charm [1] https://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1 > Once upon a time, a friend of mine accidentally took over thousands of computers. He had found a vulnerability in a piece of software and started playing with it. In the process, he figured out how to get total administration access over a network. He put it in a script, and ran it to see what would happen, then went to bed for about four hours. Next morning on the way to work he checked on it, and discovered he was now lord and master of about 50,000 computers. After nearly vomiting in fear he killed the whole thing and deleted all the files associated with it. In the end he said he threw the hard drive into a bonfire. I can’t tell you who he is because he doesn’t want to go to Federal prison, which is what could have happened if he’d told anyone that could do anything about the bug he’d found. Did that bug get fixed? Probably eventually, but not by my friend. This story isn’t extraordinary at all. Spend much time in the hacker and security scene, you’ll hear stories like this and worse.

1MachineElf 5y ago

Title should be adjusted to the actual title of the blog post: (Technical) Infosec Core Competencies InfoSec is a management practice. These technical skills are nice to have, but with the exception of #1 (understanding CVEs, CWEs, and CVSSs), you do not need the skills on this list in order to acquire and be productive in an InfoSec job. Someone with these technical skills is cut out to be a security researcher, part of a Red Team, working on the detection side of a SOC, or similar. Those are great and valuable roles, but not quite InfoSec. For an InfoSec job, give me someone who knows security management frameworks, can read security guidance, who can lead on processes we use to manage IT security, who can generate (and optionally build) security status reports, who gets the organizational chain of command for how IT security work gets done.

unethical_ban 5y ago

If you get decent at 3/4 of this list, you're in the top 5% of infosec professionals. Not that knowing all of these is bad, but you do not need to have all of these skills to be a well paid, in-demand infosec worker. It also depends on what subfield you're going in. Are you going to be the only Infosec person at a small company? You need to know a lot more breadth than if you're going to be the email security gateway admin at a behemoth bank.

R0b0t1 5y ago
How do you prove you know these things to a potential employer? A lot of businesses in this area are looking for credentials. A lot of competent people do not have credentials, and the credentials that do exist aren't very good anyway.
- unethical_ban 5y ago
  That goes beyond this one industry - the resume filter of HR departments is a tough gauntlet to get through. You'll have to start with intro level jobs, get certified by a decent org (AWS security, SANS, or maybe some "code academy" like cyber courses. And be able to talk about your home lab and interests.

ClumsyPilot 5y ago

"Enough Python, Perl, PHP, C, Go, Java, and JavaScript to be able to read all the random code you come across and at least make some sense of it." That's super broad and potentially more than most devs ever accomplish. Also some mention of windows or non-aws providers might be nice?

dejj 5y ago

> How to read a CVE announcement How do you get the list of newest CVEs? Is Twitter the preferred interface?