Skills For Career In Security

Skills For A Career In
Security
http://vprasanna.com

“There is a difference
between knowing the
path and walking the
path”

Agenda
Today’s Security trends
Why a Career in Information Security
Skills required
Profiles
Certifications. Are they required?
Q & A

Today’s Security trends
The information explosion
caused by Internet has also
shortened the geographical
boundaries, and has brought
about immense data for
exploration and exploitation.

'Man is a Social Animal' - Aristotle

Terms like Cyber crime economy,
corporate cyber espionage, Cyber
Warfare have now come into
vogue..Its a constant game of catch-
up
6
Today’s Security trends (cont..)
Governments & Corporations are
setting up Cyber Labs with specialized
training for its workforce to tackle
these….

7
Today’s Security trends (cont..)
www.packetverify.com
Unlike the old times when
hacking was for fun and to
show off one’s ability, today
the primary motivation is
driven by Money.

Today’s Security Trends (cont)
…Of-course some still do it for fun and more….

Today’s Security Trends (cont)
Breaches still continue to happen due to
user errors as well…

What does this bring to picture?
Need of good folks….

So, who could be these good folks?

Interesting?
Lets Explore…

• Requires specialized Skills
• Opportunity for continuous learning
• Challenging job prospectus
• Niche Area
• Currently there is a big shortage of skilled
Information Security Professionals in line with
Data exploration and exploitation.
Why a career in Security ?

Why a career in Security ?(cont)
Courtesy: www.ecommercetimes.com

Education Level of Professionals in
Security
Statistics: Global Workforce Study www.isc2.org
Source:www.isc2.org

Security Engineering
Field of work:

Product design and development

Hardware programming

Application Testing

Hardware Testing

Review codes for vulnerabilities

Fix vulnerabilities through patching (some more coding)

Research and Development

Malware Analysis, Reverse Engineering

Application Security review

Security Engineering
Typical skills required:

Programming

Unix, C,C++, Shell, PERL,Python, Java, .NET & etc

Scripting

Databases

Cryptography

TCP/IP Stack, OSI Model

Software Development Life Cycle (SDLC)

Common Sense

Certifications & Resources:
• Certified Secure Software Lifecycle Professional (CSSLP)
from ISC2
• SANS Secure Coding Certifications
– Java - Secure Coding - Developing Defensible Apps
– .NET - Secure Coding - Developing Defensible Apps
– C/C++ - Secure Coding - Developing Defensible Apps
– PCI - Secure Coding for PCI Compliance (DEV 536)
• Microsoft Security Development Lifecycle
• CMMI practises
• Many more…

Popular Job Titles include:
• Security Engineer
• Security Researcher
• Application Security Researcher
• Product Engineer
• Security Tester

Security Administration
Field of Work:

System Security, OS hardening, patching,

Network Security, Firewall, IDS/IPS, SIEM,PKI

Vulnerability Assessment & Penetration Testing

Incident Response

Troubleshooting and fixing security issues

Awareness and Training

Identity and Access Management

IT Audits

Security Administration
Typical Skills required:

Solid understanding of Operating Systems

OSI Model, TCP/IP Stack, DNS, Routing, Switching, HTTP,
SSL, LAN, WAN, DNS, DHCP, Routing, Wi-Fi, and VoIP.

Firewalls, Intrusion Detection Systems (IDS), IPS, Routers,
Switches

Antivirus, Content filters

Databases

Security Administration (cont..)

Scripting (highly desirable & makes like easier): Unix,
PERL,Python, Windows Shell Scripting

Data mining

Protocol dissection

Exposure and knowledge of various security best practices
and standards like ISO 27001, PCI-DSS, Common Criteria,
PCI-DSS and etc

Good Documentation and Communications skills

Appetite for Learning

• Certified Information Systems Security Professional
(CISSP) from ISC2
• SANS Global Information Assurance Certifications (GIAC)
• Security +
• Certified Ethical Hacker (CEH)
• ISO 27001Implementor /Internal Auditor / Lead Auditor
• Computer Hacking Forensic Investigator
• Vendor Certifications from Checkpoint, Symantec, Juniper,
Cisco and etc

• IT Security Manager
• Network Security Administrator
• Security Analyst
• Security Administrator
Involves hands on work generally and partly managerial as
well.

Security Management
Field of work:

More of Auditing, Compliance, Governance & Risk
Management

Compliance to standards like ISO27001, PCI-DSS, HIPAA,

Information Systems Audits

Security Awareness Trainings and evaluation

Business Continuity and Disaster Recovery.

Covers IT as well as Non-IT aspects of Security in an
Organization

Security Management
Typical Skills:

Good understanding of Auditing standards,

Networks, System level Security hardening mechanism

Risk Assessment and mitigation strategies

Standards & Compliances

ISO27001, Common Criteria, COBIT,GLBA

SOX

Payment Card Industry Data Security Standards (PCI –DSS)

IT Legal concepts

Indian IT Act 2000

Data Privacy Laws & Regulations

Good Documentation and Communications skills

• Certified Information Systems Security Professional
(CISSP) from ISC2
• Certified Information Systems Auditor (CISA) from ISACA
• Certified Information Systems Manager(CISM) from ISACA
• ISO 27001Implementor /Internal Auditor / Lead Auditor
• Cyber Law

• Information Security Manager
• IT Risk Manager
• Chief Information Security Officer
• Chief Privacy Officer
• Chief Risk Officer
These positions involves more of managerial
responsibilities and limited hands on as well

• Certification compliments the skills and experience
• Give yourself sufficient time and experience to see
catch up with the requirements
• Go for the certifications that are accredited by the
recognized organizations
• Don’t get certified for the heck of it, rather the
whole process from studying to certifying should be
an enriching experience
NOTE: Nothing substitutes right skills & experience
Should I get Certified ?

Does Certifying pay me more?
http://packetverify.com
Survey from ISC2 says, Yes.
Statistics: Global Workforce Study www.isc2.org

Write-ups and Blogs on Security..
• NIST
• SANS Security Resources
• EFF
• Openwall
• Naked Security
• Bruce Schneier on Security
• Krebs on Security
• Open Web Application Security Project
• Open Source Security Testing Methodology Manual
(OSSTMM)
• Google Summer Of Code
• Insecure.org Mailing lists
• CERTs http://vprasanna.com

Hackers & Entertainment
• Wargames
• The Matrix
• Italian Job
• Swordfish
• Pirates of Silicon Valley
• Takedown
• & many more.......

Background about this presentation
Please note that this is not a definitive guide about
starting or building a career in security. I used to get
questions on this subject and thought of skills that
helped me in my InfoSec Career. I have put these
here and believe it could help you in your InfoSec
career journey.
May The Force Be With You

What I do?
I am a Information Security professional :)

Thank You
@terminalfix
vprasanna.com
Prasanna Venkatesh

Skills For Career In Security

More Related Content

What's hot

Viewers also liked

Similar to Skills For Career In Security

Recently uploaded

Skills For Career In Security