Getting your foot in the security door

ptilsen

Following up on a recent thread, I'm wondering if anyone has any experiences to share in beginning or transitioning to a career/specialization in security?

I'm particularly interested in any experiences switching from systems or networking into full-time security. Whether you moved jobs or moved around within your organization, let's hear your story. What did you do to prepare? What are your job responsibilities?

docrice

I didn't read through the referenced thread, but I'll add my two cents since I understand the desire to go the security route but the difficulty in making that transition.

My climb in the IT space has spanned over a decade and I started at the bottom doing basic PC work, to various added menial low-level fix-it tasks, to enterprise desktop support (company sizes of 300 - 500 employees), then doing general systems and server admin, eventually moving into a role doing a mixture of systems and networking, and now I do full-time security. This is over several organizations in roles including technical (server-side) support for corporate customers and development lab infrastructure support. Almost throughout my career, I have relayed my concerns for various things security in areas that I had an influence in. I approached many topics in this manner (keeping in mind the main business requirements) and people around me took more notice in time.

Eventually I was doing minor security work including firewall administration, AAA configurations, network traffic baselining, software function auditing, etc.. I initiated many of these on my own. It took time, but I also needed that time to naturally evolve from my basic understanding of things to something more refined and deliverable to an audience where it had justification. I probably showed sufficient ambition (volunteering very long hours) that even when I was doing desktop support work, the network admin at the company handed me a Cisco 2900XL to play with, although I had no idea what to do with it at the time. I was even handed Domain Admin membership at one point, although I had no idea what that meant. Clearly they had trust in me for some reason. Perhaps working in smaller companies helps things maintain a fluidity that's much more rare in much larger organizations.

In the same desktop support role, I was eventually allowed to actually conduct domain credential audits and that's where I first learned the basic nuances of password cracking. I was primarily a Windows guy back then, but I invested a lot of time reading TechNet and whatever docs that provided more insight into how things work under the hood. It's really important to dig if you want to be influential in the security side of things in order to not just understand the why, but be able to relay it to people who aren't familiar with any of the basic concepts.

For those who are eager to get into security but find the career wall frustrating due to lack of experience, lack of hands-on access or opportunities, my advice is to survey your work environment, your organization's business requirements, perform an assessment on what could be improved security-wise, and volunteer ideas and at the very least just express interest. Don't over-do it, but be honest about your approach. People may or may not notice (many times they might not care), and sometimes you'll need to switch positions and go somewhere else, but once someone picks up the fact that you're strongly motivated and can potentially provide real value, they may be inclined to take a chance on you.

Opportunities don't come overnight and the reason why security positions "require experience" is because security is fundamentally based on trust. That trust is not handed out easily, especially when all kinds of internal secrets and proprietary information is given to people in these positions. The process and policies are formed to protect the organization's assets and the individuals handling high-value data need to understand the subtleties as well as hold that trust. This is why experience tends to be an emphasized requirement - raw skills alone do not make someone competent. Some degree of professional career maturity normally has to take place before that skill set translates into a natural fluency that's utilized efficiently and effectively and results in polished form.

I'd fathom that it's probably easier to get into security today than it used to be years ago since there's a growing demand (that is, management is "finally getting it"; or put another way, compliance requirements have made certain things more mandatory). However, us folks in infosec are control freaks by nature and to hand over a portion of that control requires a great deal of trust that the new guy won't screw something up or leak out things inadvertently / intentionally as the risk rises when access to sensitive areas is given to another moving part in the larger people-process machinery of an organization. It's our job to question everything, including existing assumptions, motives, product vendor claims, etc.. We guard the gates in our own capacity because depending on our role, we have to be the eyes and ears with the right perceptions for the businesses we work for.

It's not just education, certs, and experience though. It really helps to have social connections. I've gotten places in my career because I made impressions among peers and people in the right places. These connections are not a requirement by any means, but it does provide a distinct advantage. Spend time getting to know people, and not just to land a job but genuinely help out because you're interested in the larger good. Prove yourself and pay your dues. Professionals who have been there can recognize these traits and once you're at a level where we can accept you, we'll be willing to reach out.

What we don't like, however, is someone trying to game the system. We'll reject these folks with prejudice because it comes back to that basic principle: trust. We have to believe in not only the skill set you possess, but also your aptitude, willingness, your level of hunger for growth, and amount of self-investment you've made and that you might continue to make because of the dynamic nature of the industry as it is today.

It seems like a lot of folks think that a few certs is going to land them a job doing security work. Maybe in some cases, but for many of us (myself included, ironically) we look somewhat down on certifications. They're nice achievements, but how someone performs in real life could be a different thing. I've interviewed CISSPs and candidates with strong resumes who flashed their paper credentials and were obviously hoping to make a positive impression (including one candidate who had the ISC2 logo splashed on their first page). I can respect passing the exams, but I'm more interested in tangible qualities such as mindset, what the person's lab at home is like, how well they present themselves in a business environment, how they stay up-to-date on current events (news feeds, etc.), their ability to articulate technical details in an organized fashion, etc..

Infosec can be very much like IT in that it might involve long hours, but also bear in mind that it's a high-maintenance career. I'm speaking of the typical technical roles so my opinion doesn't necessarily cover all areas in the industry, but from what I've seen you have to spend a lot of your own time staying in touch with the pulse of the industry, constantly evolve your skill set and understanding of the world (and not just of the matrix grid we play in today), as well as continuously deliver and ultimately add value based on your organization's need. It's a balancing act and changes are frequent. Burnout is waiting at every corner.

Security can be sexy. You look at the kinds of things we deal with and it sounds like fun and games with cyber-toys. We use "attack tools" to perform vuln assessments, leverage "intrusion detection" systems, use load balancers to perform content-switching and enable web-application firewalls, etc.. It sure beats doing a few database queries and then performing server maintenance during a scheduled window, right?

But unless you work for a security consulting company, security specialists are expensive line-items to the bean counters. Security teams tend to be a cost center, and in many places you'll have to justify your position, pay, as well as make the uphill climb selling security to senior management who would rather spend budget on something that shows more obvious returns for the company's bottom line (and investors). That aspect alone makes the work stressful and it's unfortunate, but that's how it is in the corporate world.

So to wrap-up yet another unnecessarily-long rambling of mine before it gets more out of hand, my advice is to pay your dues. Take the time to mature your fundamentals so they're second-nature. Reach out and establish your own network of peers to exchange ideas and questions. Contribute something to the public good and show that you have value to add. Be able to effectively communicate difficult-to-understand concepts to people who don't know where the "any" key is. Relative to general IT, infosec is a small community and we can be a very discriminating bunch because we don't tolerate inefficiency. There's a lot of cake to eat when you finally get your foot in the door, but only if you know how to chew well.