Inherited a new person with no computer skills

Revocks

Hi folks,

I work for a major security company, and my division is essentially the most technical when it comes to true security. Recently, I inherited a worker who wanted to segue from being an administrative assistant to a security professional. I've been given 2 years to get them up to speed which is a good amount of time, but I'm finding a bit of difficulty.

The individual is not technical whatsoever. They can utilize the basics of Office, but don't have anything much outside of that. The type of work we do in our division runs the gamut of DNS sinks to threat response, so they need to get up to a relatively substantial level.

My first gut reaction was to recommend certification, but I also know that I honestly didn't 'learn' much during the certification process per se. Transferring the person out of the team is not an option, so I need to work with them where I can. Sending them to college is also obviously not an option, so I have to work with training and certification.

Tentatively, this is what I was thinking:

A+ bootcamp/cert
Networking +
Security +
CISSP
CEH

Ideally, I would like to do bootcamps for all of these, but the cost alone within two years is equivalent to 8 people's budget, so that's also not an option. Self-study is ideal but I never 'formally' self studied so I also don't know how valid that truly is.

So in a nutshell, does anyone have any experience with either getting up to speed or getting another individual up to speed? Are certs the best way or is there an alternative method that I'm unaware of?

Any help would be wonderful.

Thanks so much!

lsud00d

Is this the owners son-in-law or something??

Anyways I had to do this a lot when managing student workers at the helpdesk, albeit at a much smaller scale and obviously they weren't in charge of anything important. It required constant training and adapting to their learning style. Some people are visual learners and others were able to listen to concepts and then apply them to varying degrees of success.

I would recommend feeling the employee out before acting on any training plan to better suit the process to their needs.

Life is like a box of chocolates, you never know what you're going to get. - F. Gump

Iristheangel

Bootcamps aren't too expensive - about $1-3K a pop per subject you listed - so stretching that out over 2 years for training, that's probably $15K at most. Though self-study and lab can be pretty beneficial as well... I think people are better able to retain the information if they're able to practice it for a couple months before taking the test. Bootcamps tend to be good refreshers but that's it.

I wouldn't recommend the CEH. That's more of a fluff exam that teaches someone how to operate basic and somewhat outdated tools. What do you eventually want this guy to be doing? That's the real million dollar question. If you want him to be doing some sort of non-technical security management, the CompTIAs and CISSP make sense but if you want him to be doing something technical, you might want to kind of guide him in more of a technical area. If you're thinking application level security or pen testing, I'd say get him the basics of Security+ and Network+, then some basic programming, and then move to the offensive-security track. If you're thinking network security, get him through Security+, Network+, CCNA, CCNA:Security and then the CCNP Security. Auditing would be another alphabet soup of certifications. It really all depends on where this guy wants to end up.

It's not the first or the last time someone gets moved into a position they aren't ready for because they were motivated or favorited by someone in charge. On the bright side, you have a great opportunity to potentially help create a strong security professional and get some recognition with your bosses for doing so.

JeanM

Oh man, good luck! This brings back memories of teaching someone how to do active directory and exchange, with skills barely enough for A+.

Get them through A+ and N+ and try not to go bald in 2 years time!

Plantwiz

Iris gives some sound advice.


I think this sounds like a great opportunity. It will showcase your true knowledge as well. Patience will be key, but a good opportunity for all nonetheless. How else can new people break into the industry? No one is born with the knowledge of IT, but it helps when there is interest and desire to learn about it.

I do not think bootcamps would help you much here. Sit down and create a goal sheet with your protégé. I would target finishing in 18 months (put the push on them) and this gives you a 6 month window on the backside for 'internship' with them.

Just re-read your post a bit, I'm not certain how certifications will necessarily benefit the person aside from possibly a moral boost and drive to continue learning new aspects of the environment. I might skip A+ unless your team handles a lot of hardware issues (on the PC side). Sounds more like you need to focus on networking, maybe routing, and some server items??

Set goals.
Vocabulary.
Break it down and let the employee re-teach it to you.

Sounds like one of those opportunities where the better you make this candidate look in the end, the better you are going to look. If this person washes out, it may look poorly upon you Don't know, but in two years time, I bet your own knowledge will really be at its prime too!

JaneDoe

When I first got into IT boss was my mentor, close friend, and one of the best teachers I ever had. He give me the tools I needed to do a task, and expected me to figure it out for myself and teach myself along the way. We always started in a virtual environment and tested everything three times before putting it in production, so I couldn't easily break anything while I was learning. That's a great and rewarding way to learn about technology.

Start by giving them what you and the rest of the team think of as repetitive grunt work, and let them master that, while getting it off everyone else's plate. If they don't have the will learn they'll stay there, and you'll have easy boring tasks off your plate. If they master that and are ready to do more, let them try slowly and sandboxed at first.

snunez889

When I really started focusing I feel like I knew nothing. In two years I had grown so much with the little tools I had available. Through self studying and feeding off any wisdom someone else would pass onto me. I personally think two years would be more then enough.

docrice

It sounds like your team is on the more demanding side of things, but is this individual sufficiently motivated to do what's necessary to get up to speed and keep up on the maintenance necessary in order to stay up to date? A lot of people have "interest," but they may not realize the magnitude of what that entails to be ultimately effective on the job.

Assuming this individual has the potential and appropriate level of desire, then I suggest not rushing through the foundations. Racing through the early stages results in a hindrance later on as they tackle more complex subjects without understanding how the underlying structures work.

Depending on the scope of this person's future duties, I'd recommend a pretty flexible lab to do lots of experimentation in. There should be lots of opportunities to tinker and purposely break things. Failing early and often in a lab is useful to learn the limits of various technologies since the admin guides are never revealing of such things.

I think certs are fine, but for some people they become the main goal/focus of achievement in themselves rather than relishing the learning process, because the unfortunate result could boil down to simple rote learning in the end which only helps in the short term unless sustained with reinforced practice. Bootcamps are fine for some degree of technical validation of existing knowledge, but the one time I took a bootcamp I left with an impression that they don't do much except to get one to superficially pass the associated exam. For this reason I tend to avoid courses with the word "bootcamp" in the title, with the exception of SANS SEC-401 which may be a good one to do via OnDemand later on in this person's training, perhaps after the Security+ stage.

BGraves

Plantwiz wrote: »

Iris gives some sound advice.


Set goals.
Vocabulary.
Break it down and let the employee re-teach it to you.

I really liked this suggestion.

Maybe I'm the only one that thinks that a CISSP probably wouldn't be a great idea for someone without the appropriate amount of work experience seems like a waste, perhaps a SSCP or Sec+/CASP? (I know you can get the associate if you pass but who wants to work and study that much to end up with that?)

Also, reiterating what others have said, sounds like a great opportunity to grow your mentor skills and help develop a beginner IT professional. PLEASE teach them what "documentation" is!

MSP-IT

How does something like this happen? As a manager of said user, I would be quite upset.

ajs1976

Get a CBT Nuggets subscription and go through the MTAs: OS, Server, Networking, and Security. I prefer vendor neutral entry level stuff, but in this case the mixture of vendor specific exercises and vendor neutral concepts may make better progress.

I worked with someone a few years ago on basic networking. I read a chapter in the book we were using and made a few notes highlighting important topics and things that may cause confusion. Then the person I was working with read it and followed by the two of us discussing it.

After the person gets a foundation, then look for the more specific boot camps for the advanced topics.

Plantwiz

MSP-IT wrote: »

How does something like this happen? As a manager of said user, I would be quite upset.

How does it happen?

1. First, doesn't really matter, you (as the employee) have been asked to do something.
2. Keeping a diversified team is smart from your managers perspective because if you or another who works there suddenly gets in a bad car wreck, becomes ill, or simply dies (and it does happen) then there is too long of a learning curve to get the team back up and running...which hurts the business for ALL the others who work there and depend upon the wages they bring home.
3. If the OP is 30 or 40 years old, how long exactly do they plan to work there? Maybe another 15 years, but without a younger person coming up, it leaves no room for an employee to retire.

It is really easy to jump to conclusions and think that this 'new' person will be taking ones job. And that may indeed be the case. However, the OP was given a 2 year window to bring this person up-to-speed. Which long-term is going to allow the more senior team members the ability to take time off, or split up the weekends and evenings among another player.

The bigger picture to this situation is mostly positive. If there is too much doubt, then I suppose go find greener pastures?

As far as the how? I have seen this happen more and more and it is not a bad deal.

Revocks

Appreciate the responses, some incredible ideas came out of this.

True, this isn't an ideal situation, but as a few mentioned, you must simply deal with what you've been given.

To even make the situation more complex, the individual doesn't work in my office but works at a satellite office on the other side of the country, so I can't 'show' things on an on-hands basis.

I'll definitely check out the IT Nuggets videos, and I quite appreciate all input. Wish me luck

PurpleIT

From what I have seen of the CBT Nuggets, you will get more bang for your buck from them than from bootcamps. Bootcamps are meant to cram enough into your head to pass the test, CBT Nuggets (in my very limited experience) are more about training. They aren't as good as a book, but they can really help lay the foundation so the books make more sense.

N2IT

Can you assign this individual administrative task or less technical task? I've been given resources as well I ended up turning one of them into a administrative assistant and he loved it. Thanked me several times after the fact. Without knowing the situation it's hard to give you solid advice, however if the individual is up to the challenge they can learn.

--chris--

Other side of the country? That steps up the difficulty level a bit!

My first dive into IT was in a similar position, but helpdesk with a much lower bar. The "mentor" was a great guy, but he didn't spend enough quality time with me on things. He was very busy with his work (I think this was the managements fault, not his) and when a simple 1-2 minute walkthrough would have got me going in the right direction it would take 3-4 hours to get that time with him.

Another thing that really helped me was giving me little projects that were open ended. For instance, he wanted to implement Zabbix on the network. He knew of it, but that's it. He told me to learn it, install it, break/fix it and then get him up to speed. He would bug me weekly for an update, but there was never a end date for completion. I learned time management, SNMP and Zabbix with that one.

Does this person want to get into IT? Do they really want it? If so this will be very easy for you. The trouble might be with someone who lacks drive and motivation.

pzero

Also you have PluralSight (formally TrainSignal) as a CBT Solution. A little cheaper and you have offline playback. JDMurray did a write up on it here.

With the distance issue, get those webcams going for regular check ups.

Good Luck!

-hype

LOL, I feel bad for you, you didn't have a say in the matter?

Sad that companies work like this ...

How about giving them the Security+ book and CBT nuggets. See if they engage in the material and make progress. Essentially you can't teach IT unless someone is passionate about it; to be successful and stay successful.

paul78

@OP - Good luck to you. It does seem like quite the challenge. And I'm sure there's an intriguing back-story behind such a management decision. I assume that this individual is highly motivated and probably quite passionate about this opportunity. Hopefully that will make this a more pleasurable experience for you.

Since the individual is remote - you may want to consider regular video conferencing and collaborating tools as a means to build some rapport - and if your travel budget allows, a quarterly visit could help as well.

JeanM

You can get all the bootcamps you want, but if the person is without basic computer skills...good luck with that.

Of course we all started from the basics, to go from 0 computer skills to a "security pro", is not exactly how we have moved up right?

You start with basics, then you gradually move up to more complex skills and so on and on.

Who knows, what does this new person even want to do long term? I really hope you aren't wasting your time. Just because your manager asks you to do something, if it makes no logical sense or isn't possible, you should ask about it

swild

There are some great ideas listed here. I have only one thing to add. Since the person is located in a satellite office, Skype/WebEx/NetMeeting is your friend. Making time for a face to face could really make quite a difference in motivation and help to push your new employee to keep to a training schedule. Bootcamps cost so much because they afford the opportunity to show and answer live questions. I would recommend twice weekly Skype sessions with IM in between.

tpatt100

Network+ and a lot of on the job training is my recommendation. No sense having them worry about a list of certs when I think it is best to read some fundamental book and then do the certs slowly. Once the person feels comfortable with the basics from the job the experience might make studying for a related cert more effective.

Hopefully this person has the aptitude necessary to adapt quickly though. You get people that will learn and try to fill in the gaps themselves which is the person you want. Then you get the people who will ONLY learn what you spoon feed them and those types become an anchor that just slows you down all the time.

JaneDoe

Get them to play hacking games with you where you try to hack each other. Have some kind reward involved where if you can't hack them they get a something, and if you do hack them you get it. Have them try to do the same thing to you. Start with something simple like an encrypted file containing the information for a $5 gift card with a one dictionary word password. Move up to having them create a website you'll try to hack. Don't tell them what vulnerabilities they should be looking for to force them to think about the big picture.

ratbuddy

How about seeing if they are interested in the IT-Security track at WGU? If they really are that motivated to move into IT and security, they should jump in with both feet.

ccnxjr

I'll agree with JaneDoe, formal training and reading alone will get them only so far. They've still got an experience/thinking curve to build.
Some kind of game or way to engage them in the "doing" and trying to figure stuff out for themselves is definitely a must , in addition to the formal training (which should give them the background knowledge) .

jabney

I think all of the examples can work. The biggest unknown that I don't believe you mentioned is this their particular passion and do they really want to learn it. If that's the case then a subscription to pluralsight and a capable virtual lab at work and on their laptop should work wonders.

I'm also a firm believer in mentorship get the person with your best employee willing to share and teach and watch them prosper. Also realize you may slow down the other person as they'll need more time for normal tasks because they'll be teaching as well as doing.