Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im a current student going for my Bachelors in Network Administration and would like to get in to the security side of things. I have my Network+, Security+ as well as the A+ and a MCTS.

I currently do IT support for two companies mostly supporting Exchange and iOS. What kind of skills are most sought after and required by employers? How do I get knowledge of real world scenarios and things like attack mitigation, pen testing, etc without any access to equipment, or would virtual labs be enough?

share|improve this question
Must say that "sought-after skills" is a subjective question without definite good answers (also off-topic for SE). As for equipment, you are already using a computer, should be as good as anything. – Deer Hunter Jul 28 '13 at 7:00
What, exactly, do you want to do? Do you want to develop security software (defensive? scanning tools?)? Do you want to do application security, and make sure developed software is secure? Protect a network? Malware analysis? – atk Jul 29 '13 at 3:18

Security is a very very large field. What specific area of security are you interested about getting into?

It seems like you have a lot of experience in the administration world. You can use that as a starting point to get into security. Study up on hardening servers, networks and what have you. I know that Cisco and RedHat have security certifications about hardening their specific products. You can look into that.

If you like development work, learn about how to develop secure applications. Read up on common attacks like XSS, SQL injections and buffer overflows and try to minimize them in the code you write.

If you want to get into the offensive side of things, learn how to exploit the common vulnerabilities. There are many resources available that allows you to practice including hackthissite that allows you to hone your skills in a safe environment. Get familiar with the tools in Kali Linux/BackTrack, there are many useful ones in there. Pick up a scripting language like python or ruby, this will be immensely helpful when you need to automate task or write proof of concept exploits.

Certification wise, CISSP is the industry standard. OSCP is an excellent hands-on certification as well. I heard good things about the various SANS certificates but they are costly. Very costly.

share|improve this answer

Learn all you can about Kali (orig Backtrack). Read up on your security related certs. CISSP is highly sought after but to me seems more like a "manager's" cert than a hands on Sys Eng cert. I've got my CEH and while the class was interesting, the cert was easy and IMO, isn't as strong as some of the others in the industry. STUDY. LEARN. FOCUS. on Kali. You learn that in and out, grab a cert, CISSP, CEH, whatever and you've got a good chance to get in the door. Be smart and don't do anything stupid while learning because as soon as you do something dumb and get in trouble, every opportunity you have in the security industry is out the door. Long gone are the days of showboating and some company picking you up for being "l33t". Unless you are extremely talented. And don't ever use words like "l33t"

share|improve this answer
Awesome, I have heard about Backtrack but havent attempted to use it. Right now it's proving to be hard working two jobs, trying to go to school and learn something on the side but I know if I push myself it'll pay off. I've been looking at the SSCP, is that a good entry-level cert or carry much weight? A couple friends or do intrusion analyst recommended the GCIA. My degree actually included some certs and I think the CEH is one of them but it wont be for another year or so. Thanks for the info. – JamieWPS Jul 28 '13 at 3:35
I'm not as familiar with GCIA but have also been told it's a solid consideration. I'm not knocking CEH and someone else may say that all entry level security certs run the same course of just introducing the tools available out there. CEH class focused on tools and also ran several labs but described tools primarily. – MEH Jul 28 '13 at 3:46
Agree with @Terry Chia, security is a broad industry and there are different levels to each area. Kali is a lot of fun. If you start playing with Kali you are bound to travel down a few paths while looking up info that will peak interest. You may start with exploits, dabble with programing and then end up doing forensics. Don't pass up CEH if you have the opportunity. It's slowly gaining some traction. – MEH Jul 28 '13 at 3:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.