guidance on required skills and industry certification to become successful information security professional

1. Wannabe Cyberpunk;
“I don’t know what I’m supposed to do.”
Moshiul Islam , CISSP, CISA, CFE
Founder, Leader & Chair- OWASP Bangladesh Chapter
1

2. Information Security VS Cyber Security
Source: https://www.novainfosec.com/2014/05/05/cyber-security-versus-information-security/
2

3. Terms
 Hacker
 Cracker
 Phreaker
 Script kiddies
 Security Pro
3

4. Script Kiddie
 In programming and hacking culture, a script
kiddie or skiddie (other names include skid or script bunny) is
an unskilled individual who uses scripts or programs developed
by others to attack computer systems and networks and deface
websites.
 Taken from Script kiddie – Wikipedia
4

5. Where we are?
5

6. Is it that Challenging?
6

7. Kristoffer von Hassel 7

8. Is it that easy???
8

9. How much of the Internet is accessible by
Google?
9

10. Pills to become security Pro
10

11. Career options 11
Professional
Academic
WebApp Security Pro
InfoSec
Network Security Pro
Cryptanalyst
Reverse Engineer/Malware
Analyst
Security Manager
Cloud Security Pro
Mobile & IOT Security Pro
Forensic Investigator
Code Reviewer
Security Tester/Pen Tester
PHD
Independent
Researcher

12. InfoSec Job Title & Hierarchy
CISO
Security
Architect/Director
Security Manager/
Engineer
Team Leader
Security Officer/Analyst
12

13. 13

14. Malware
14

15. Malware Analyst Jobs
15

16. Where do I start?
 Tuts4You.com Tutorials
 https://blog.malwarebytes.com/security-world/2012/09/so-you-want-to-be-a-malware-analyst/
 https://digital-forensics.sans.org/blog/2010/11/12/get-started-with-malware-analysis/
16

17. Cryptanalyst
 A Cryptographer develops algorithms, ciphers and security systems to encrypt
sensitive information.
 A Cryptanalyst analyzes and decrypts any type of hidden information (e.g.
encrypted data, cipher texts, telecommunications protocols) in cryptographic
security systems.
 You are the code maker and the code breaker, the professional who ensures that
private data regarding finance, national security and other important spheres are
hidden from marauding cyber-terrorists.
 http://www.ed.ac.uk/files/imports/fileManager/Careers_in_Cryptology.pdf
17

18. Over 100+ certification in Cyber Security
 Certifications only make up maybe 10% of what security
professionals should be focusing on in managing their
career
 No certification certifies you as BEST security Pro
 It certifies having minimum level of industry accepted
knowledge
 Always choose vendor neutral certification
18

19. Skills VS Certification
 Hackers have curiosity, perseverance, focus, and creativity.
 Certification is not one of them!!!
 Security Pro should have ………….
19

20. Toward a Stable Career
Your career rests on 4 legs
1. Education
2. Skills & Experience
3. Certifications
4. “Who you know”
20

21. Job Board Search Results
Certification
SimplyHired Indeed LinkedIn Jobs TechCareers Total
CISSP 10,526 11,617 7,632 15,212 44,987
OSCP 451 500 599 5932 7482
CISM 3,286 3,585 2,337 10,629 19,837
GSEC 1,317 1,477 954 128 3,876
Security+ 3,038 3,396 1,275 1,431
9,140
21

22. CompTIA Security+ Facts & Figures
Certification Name
CompTIA Security+
Prerequisites &
Required Courses
None. CompTIA recommends at least two years of experience in IT administration (with
a security focus) and the Network+ credential before taking the Security+ exam.
Number of Exams One: SYO-401
Cost of Exam USD 311 (discounts may apply)
URL
https://certification.comptia.org/certifications/security
Self-Study Materials
Exam objectives, sample exam questions, the CertMaster online training tool, training
kits, computer-based training and a comprehensive study guide are available
at CompTIA.org.
22

23. OSCP Facts & Figures
Certification Name
Offensive Security Certified Professional (OSCP)
Prerequisites &
Required Courses Penetration Testing with Kali Linux training course
Number of Exams
1 twenty-four (24) hour certification exam
Cost of Exam $ USD 800 (Online training +1 month Lab+ Exam)
URL
https://www.offensive-security.com/information-security-training/penetration-testing-
training-kali-linux/
Self-Study Materials
Provided upon registration
23

24. CISM Facts & Figure
Certification
Name
Certified Information Security Manager (CISM)
Prerequisites
& Required
Courses
1.To obtain the CISM credential, candidates must do the following:
Pass the CISM exam.
2.Meet the experience criteria
3.Agree to the CISM Continuing Education Policy.
Cost of Exam
Online early registration: member $450, nonmember $63
Mailed/faxed early registration fee: member $525, nonmember $710
Online final registration deadline fee: member $500, nonmember $685
Mailed/faxed final registration deadline fee: member $575, nonmember $760
URL
http://www.isaca.org/Certification/CISM-Certified-Information-Security-Manager/Pages/default.aspx
Self-Study
Materials
Training and study materials in various languages, information on Job Practice Areas, primary
references, publications, articles, the ISACA Journal, review courses, exam prep community,
terminology lists, a glossary and more are available at ISACA.org.
24

25. CISSP Facts & Figures
Certification Name
Certified Information Systems Security Professional (CISSP)
Optional CISSP concentrations:
• CISSP Architecture (CISSP-ISSAP)
• CISSP Engineering (CISSP-ISSEP)
• CISSP Management (CISSP-ISSMP)
Prerequisites &
Required Courses
At least five years of paid, full-time experience in at least two of the eight (ISC)2 domains or
four years of paid, full-time experience in at least two of the eight (ISC)2 domains and a
college degree.
Number of Exams One for CISSP (250 multiple-choice and advanced innovative questions, six hours)
One for each concentration area
Cost of Exam
CISSP is USD 599; each CISSP concentration is USD 399
URL https://www.isc2.org/CISSP/Default.aspx
Self-Study Materials
See the CISSP Exam Preparation web page. A variety of training materials are available,
including instructor-led, live online, on-demand and private training. An exam outline is
available for candidate review, as well as study guides, a study app, interactive flashcards and
practice tests.
25

26. Q&A
26

27. Thank You
27
Moshiul.islam@owasp.org