7 ms·

Infosec Skill Sets

43 points by zdw 5y ago

bawolff 5y ago
Something depressing about this. I'd hope most people in industry have skills beyond how to read an email, how to program 101, and how to vaugely think like an attacker.
- nix23 5y ago
  Depends on the motivation ;)
  - geek_at 5y ago
    And on the salary
    - _8j50 5y ago
      Never met anyone in infosec who complained about salary.
    - nix23 5y ago
      Salary can be a good motivator (for example industrial saturation diving)
- _8j50 5y ago
  Nope. Why do you need to read an email well if you are a coding ninja and why do you need to program for incident response or forensics (scripting powershell/python helps a lot though). A lot of people think in terms of finishing projects or meeting metrics which they would not be if they were thinking like attackers
  - webmaven 5y ago
    > Nope. Why do you need to read an email well if you are a coding ninja Q: What happens if the coding ninja misreads an email and codes up the wrong thing? > and why do you need to program for incident response or forensics (scripting powershell/python helps a lot though). Scripting is* programming. > A lot of people think in terms of finishing projects or meeting metrics which they would not be if they were thinking like attackers Arguably, if you at least recognize that your behavior is metric driven (ie. "How can I game the system?"), you are thinking like an attacker.
    - _8j50 5y ago
      > Q: What happens if the coding ninja misreads an email and codes up the wrong thing Who codes based on email requests? Either way, yeah being able to read and understand technical requirements is required. But you can't compare that to say people replying back and forth to get you access to a system, to get them to remediate a vuln,etc... much less technical material that can't be skimmed and isn't organized. > Scripting is* programming. Of course it is. I didn't say otherwise. Scripting helps but is not a requirement. Even if it was, you don't need to know how to code properly, just enough to wrangle data a bit. Excel is much more useful than python. > Arguably, if you at least recognize that your behavior is metric driven (ie. "How can I game the system?"), you are thinking like an attacker. I mean things like KPI and SLA. how is that thinking like an attacker? You are not thinking about anything attackers are interested in. A good example would me gaming the system by "remediating" incidents within X period of time. If your objective is that metric then inevitably you will sacrifice dedicating adequate time consuming analysis and remediation tasks to meet that metric. Just block the domain and reinstall windows. If anything was there it is wiped. Except if you looked deeper they rotate domains and the malware spreads to USB (infects again when they plug it in after your remediation).
      - webmaven 5y ago
        > Who codes based on email requests? Trust me, it's a thing in many orgs. In fact, centering developer discussion on an asynchronous email mailing list (or more functionally but rarely, an internal NNTP server) used to be a preferred practice. > how is that thinking like an attacker? You are not thinking about anything attackers are interested in. I think you're using a rather narrow definition of 'attacker'. It isn't too rare to encounter adversarial attitudes within and between groups in an org. Sabotage per-se is less common, but does exist. At a most basic level, your KPIs look better if someone else's are worse.
- jcims 5y ago
  I would agree but I doubt the intended audience is "most people in the [infosec] industry" because the skillset of those folks, particularly experienced ones, is quite lumpy but has an area under the curve that is substantially greater than what is included here. I think his target audience is new folks that are conceptually interested in moving into the domain. They don't know where where to start, largely because there is little regularity in how the incumbents got there. You've got folks with a degree and 15 years of systems engineering experience trying to figure out how to parlay an advanced skillset into the domain and teenagers speaking at security conferences. That said, it's definitely not necessary to have all of the skills mentioned in the article. There are a lot of efforts, including articles like this, to help pave a yellow brick road to the industry. Until then, for better but mostly worse, it selects for those that have faith they can get there and the tenacity to try until they succeed.
_8j50 5y ago
I'm tired of these posts. They feel so arbitrary. Either the authors don't work in infosec or have such bubbled exposure it is all "how things are at my job". I can confidently say at least 90% of the people I worked with in infosec over the years did not know what "algorithmic complexity" is. Infosec is a superset of fields not a field of its own. If you work in application security, the things you need to know are vastly different from managing vulnerabilities, red teaming or incident-response. The main common-denominator is being technically proficient enough to know the basic concepts of the tech you work with (so ideally lots of technical college or IT experience). I am struggling to expand it more than that, except maybe a few security 101 classes or certs? Like understand how risk is assesed and what threats are. Ooh... that's a big one for me, keep up with current threats! I have asked people who worked many years in infosec interview questions and they didn't know what a sql injection was or a dns record or a webshell. Which is ok, so long as they know something technical and can articulate it well. The worst in my opinion are people with very strong programming background or technical expertise that just have a strong opinion of everything and trying to show them the right way offends their ego. You can learn a lot on the job, but you do need to bring competency and you have to think practically (college grads struggle with this). What you have to understand is, unlike IT, software development/engineering,networking,etc... infosec's purpose is not to build anything or maintain anything but to prevent and detect bad people (threat actors) and their creations. If you are patching vulns, you need to know how attackers can abuse them so you can prioritize. Writing detection rules? reviewing an apps code? Scouring through forensic artifacts? reversing malware? implementing security appliance? Same thing for all, you need to know how threat actors work and how to prevent or detect these people. In summary: You really can't know enough for infosec but don't let your lack in one area stop you. Conversley, perhaps you can setup gentoo in your sleep, read ARM assembly when you get bored and you are a master of haskell. That just means you can probably do well in application security and vulnerability research and possibly malware reversing. If that's all you know then you can't even begin to respond to a security incident, perform forensic investigation or sit all day inspecting a spam/phishing inbox. If you are interested in infosec and you keep up with threats (in any capacity), and especially if you are on HN, I would bet good money there is a nice place for you in infosec.
- bawolff 5y ago
nickdothutton 5y ago
Infosecurity is ultimately about management of complexity.
- MattPalmer1086 5y ago
  I don't think I agree. Complexity is the enemy of security, but it's rarely the primary focus. Not least because you often can't do anything about it, and you frequently have to add complexity to solve infosec issues. If it's ultimately anything, it's the management of risk.
- 1970-01-01 5y ago
  Oversimplified perhaps, but InfoSec is knowing how to trust or distrust anything in your business. That could be a line of code, a DNS packet, a contract, a printer, an employee, or anything in between.
OrvalWintermute 5y ago
This reads more like something fairly specific to the product side of Silicon Valley, than it does to the general needs out in the world, or the operational security community. The last thing I would ever want is someone fresh out of college doing cryptographic work.
PeterWhittaker 5y ago
No mention of governance, short shrift on risk without mention of either appetite/tolerance or acceptance, and lip service for auth/with, without mention of either identity or credential assurance. Infosec without these isn’t, it’s technologists playing with their favourite toys, ignoring what it takes to make organizations and systems secure. * whatever that means if we lack risk management (including assessment, mitigation, tolerance, and acceptance).

43 points by zdw 5y ago

Something depressing about this. I'd hope most people in industry have skills beyond how to read an email, how to program 101, and how to vaugely think like an attacker.

nix23 5y ago
Depends on the motivation ;)
- geek_at 5y ago
  And on the salary
  - _8j50 5y ago
    Never met anyone in infosec who complained about salary.
  - nix23 5y ago
    Salary can be a good motivator (for example industrial saturation diving)
_8j50 5y ago
Nope. Why do you need to read an email well if you are a coding ninja and why do you need to program for incident response or forensics (scripting powershell/python helps a lot though). A lot of people think in terms of finishing projects or meeting metrics which they would not be if they were thinking like attackers
- webmaven 5y ago
  > Nope. Why do you need to read an email well if you are a coding ninja Q: What happens if the coding ninja misreads an email and codes up the wrong thing? > and why do you need to program for incident response or forensics (scripting powershell/python helps a lot though). Scripting is* programming. > A lot of people think in terms of finishing projects or meeting metrics which they would not be if they were thinking like attackers Arguably, if you at least recognize that your behavior is metric driven (ie. "How can I game the system?"), you are thinking like an attacker.
  - _8j50 5y ago
    > Q: What happens if the coding ninja misreads an email and codes up the wrong thing Who codes based on email requests? Either way, yeah being able to read and understand technical requirements is required. But you can't compare that to say people replying back and forth to get you access to a system, to get them to remediate a vuln,etc... much less technical material that can't be skimmed and isn't organized. > Scripting is* programming. Of course it is. I didn't say otherwise. Scripting helps but is not a requirement. Even if it was, you don't need to know how to code properly, just enough to wrangle data a bit. Excel is much more useful than python. > Arguably, if you at least recognize that your behavior is metric driven (ie. "How can I game the system?"), you are thinking like an attacker. I mean things like KPI and SLA. how is that thinking like an attacker? You are not thinking about anything attackers are interested in. A good example would me gaming the system by "remediating" incidents within X period of time. If your objective is that metric then inevitably you will sacrifice dedicating adequate time consuming analysis and remediation tasks to meet that metric. Just block the domain and reinstall windows. If anything was there it is wiped. Except if you looked deeper they rotate domains and the malware spreads to USB (infects again when they plug it in after your remediation).
    - webmaven 5y ago
      > Who codes based on email requests? Trust me, it's a thing in many orgs. In fact, centering developer discussion on an asynchronous email mailing list (or more functionally but rarely, an internal NNTP server) used to be a preferred practice. > how is that thinking like an attacker? You are not thinking about anything attackers are interested in. I think you're using a rather narrow definition of 'attacker'. It isn't too rare to encounter adversarial attitudes within and between groups in an org. Sabotage per-se is less common, but does exist. At a most basic level, your KPIs look better if someone else's are worse.
jcims 5y ago
I would agree but I doubt the intended audience is "most people in the [infosec] industry" because the skillset of those folks, particularly experienced ones, is quite lumpy but has an area under the curve that is substantially greater than what is included here. I think his target audience is new folks that are conceptually interested in moving into the domain. They don't know where where to start, largely because there is little regularity in how the incumbents got there. You've got folks with a degree and 15 years of systems engineering experience trying to figure out how to parlay an advanced skillset into the domain and teenagers speaking at security conferences. That said, it's definitely not necessary to have all of the skills mentioned in the article. There are a lot of efforts, including articles like this, to help pave a yellow brick road to the industry. Until then, for better but mostly worse, it selects for those that have faith they can get there and the tenacity to try until they succeed.

_8j50 5y ago

I'm tired of these posts. They feel so arbitrary. Either the authors don't work in infosec or have such bubbled exposure it is all "how things are at my job". I can confidently say at least 90% of the people I worked with in infosec over the years did not know what "algorithmic complexity" is. Infosec is a superset of fields not a field of its own. If you work in application security, the things you need to know are vastly different from managing vulnerabilities, red teaming or incident-response. The main common-denominator is being technically proficient enough to know the basic concepts of the tech you work with (so ideally lots of technical college or IT experience). I am struggling to expand it more than that, except maybe a few security 101 classes or certs? Like understand how risk is assesed and what threats are. Ooh... that's a big one for me, keep up with current threats! I have asked people who worked many years in infosec interview questions and they didn't know what a sql injection was or a dns record or a webshell. Which is ok, so long as they know something technical and can articulate it well. The worst in my opinion are people with very strong programming background or technical expertise that just have a strong opinion of everything and trying to show them the right way offends their ego. You can learn a lot on the job, but you do need to bring competency and you have to think practically (college grads struggle with this). What you have to understand is, unlike IT, software development/engineering,networking,etc... infosec's purpose is not to build anything or maintain anything but to prevent and detect bad people (threat actors) and their creations. If you are patching vulns, you need to know how attackers can abuse them so you can prioritize. Writing detection rules? reviewing an apps code? Scouring through forensic artifacts? reversing malware? implementing security appliance? Same thing for all, you need to know how threat actors work and how to prevent or detect these people. In summary: You really can't know enough for infosec but don't let your lack in one area stop you. Conversley, perhaps you can setup gentoo in your sleep, read ARM assembly when you get bored and you are a master of haskell. That just means you can probably do well in application security and vulnerability research and possibly malware reversing. If that's all you know then you can't even begin to respond to a security incident, perform forensic investigation or sit all day inspecting a spam/phishing inbox. If you are interested in infosec and you keep up with threats (in any capacity), and especially if you are on HN, I would bet good money there is a nice place for you in infosec.

bawolff 5y ago

nickdothutton 5y ago

Infosecurity is ultimately about management of complexity.

MattPalmer1086 5y ago
I don't think I agree. Complexity is the enemy of security, but it's rarely the primary focus. Not least because you often can't do anything about it, and you frequently have to add complexity to solve infosec issues. If it's ultimately anything, it's the management of risk.
1970-01-01 5y ago
Oversimplified perhaps, but InfoSec is knowing how to trust or distrust anything in your business. That could be a line of code, a DNS packet, a contract, a printer, an employee, or anything in between.

OrvalWintermute 5y ago

This reads more like something fairly specific to the product side of Silicon Valley, than it does to the general needs out in the world, or the operational security community. The last thing I would ever want is someone fresh out of college doing cryptographic work.

PeterWhittaker 5y ago

No mention of governance, short shrift on risk without mention of either appetite/tolerance or acceptance, and lip service for auth/with, without mention of either identity or credential assurance. Infosec without these isn’t, it’s technologists playing with their favourite toys, ignoring what it takes to make organizations and systems secure. * whatever that means if we lack risk management (including assessment, mitigation, tolerance, and acceptance).