Tag Info

Hot answers tagged

39

IT in general, IT security in particular, is an area where you should always learn. When you do not want to learn any further, then it is time to retire. Therefore, you should already be eager to learn TCP/IP, and your question should be: "do I learn TCP/IP first, or is there something more urgent ?" Knowing the internals of TCP/IP is an invaluable tool for ...


37

As niche as "security" seems, it actually encompasses a few main types of roles, and a couple of areas of coverage. These are actually quite different... Common roles: Enterprise IT security department These guys usually deal mostly with policy enforcement, auditing, user awareness, monitoring, maaaaybe some enterprise-wide initiatives (e.g. SIEM, IdM, ...


30

I don't work as a security consultant but I've worked with them (and with the police incidentally and your analogy is more cop show than reality) and none of them to my knowledge have spent time hacking illegally. Hacking is only illegal if you don't have permission but there is no difference on a technical level (that is to say in terms of security) ...


26

I can't comment on the actual job scene, but I do know a bit about the statistics of cybercrime. In terms of financial gain, the stats are quite interesting. In terms of profit, the top three are as follows: Pay-per-click advertising fraud - Wasn't so much of a profit-maker until recently, but blackhats seem to have focused on this method more intensely ...


26

My 2cents here: While not technically illegal these companies have managed to develop malware and exploits, without anyone bugging them, because they sell them to governments, law enforcement agencies, secret services, organizations and, in case of some of the companies, to anyone else interested. Such companies include: VUpen Paladion More information ...


14

There is no defined blueprint on what is the best language to learn. Therefor I would like to mention two good alternatives that I (and many otheres) think is a good languages to learn in computer security. LUA Explanation of Lua from wikipedia: Lua is a lightweight multi-paradigm programming language designed as a scripting language with "extensible ...


13

One option not mentioned here is espionage. Patriotism or corporate funding could be part of the reason you might end up in espionage. Corporate As a espionage contract worker you could charge a pretty high fee for doing any of a number of different black hat operations. Stealing, corporate information (design plans, blackmail, corrupting data, stealing ...


13

A Little Background Penetration testing probably feels like the sexiest part of security, but it is also a very small part. It's also exceptionally broad. The term "penetration test" is often used as an umbrella to mean any one of the following: Vulnerability Assessment Security Assessment Security Audit Penetration Test Social Engineering It could be ...


12

For future reference and completeness, I'd also like to add that the UK Cyber Security Challenge site has a nice list of 8 different categories of security roles with explanations about each and sample roles, as defined by the Institute of Information Security Professionals (IISP) (after a study I suppose). ...


11

In my experience these are my following observations: Should it revolve around the ability to verbally explain attacks at a non-technical\technical level? Yes. Absolutely it should involve a technical level. Non-technical explainations are a bonus, you will, as a pen-tester be involved in meetings with people who know nothing about what you're doing ...


9

The term cyber-security is large enough to represent many different sub-fields. As in many fields, there are theoretical approaches and more practical ones. For instance, I now work at the Center for Cybercrime and Computer Security, and within the same place, there are people working on cryptographic protocols (quite theoretical/maths), people working on ...


8

I have both my own personal answer, but also a career's worth of answers, since I work in the security industry within a division that is entirely focused on security. I should say, we are not all pen-testers, in fact that's just a part of the things we do for customers. Mileage may vary if your goal is a small but elite company focused specifically on pen ...


8

I also don't have a first person answer, but I'll share what I know. Your best bet with lack of experience is to show a depth of knowledge, a willingness to work in a team, and excelence in communicating your ideas. (1) Good professional networking This may be the the most important, and most difficult. A good referal can beat a good resume in a lot ...


8

Security is a complex topic. It involves being able to understand complex systems, work with people, and solve problems with technical, social, and business solutions. For books, I liked "CISSP All-in-One Exam Guide" by by Shon Harris. It covers the basic theory of security and many sub topics. A great history of IT Security theory can be gleaned by reading ...


8

Anything in the consultancy side of the field will leave you at home some percent of the time. That favors jobs such as security audits/assessments, penetration testing, or security design work. When consulting, you'll spend some percent of your time at the client site and some amount of time in you home office. The trade-off is that travel to the client ...


8

CTFs really are what you make them (like a lot of other things in life). Networking You never know who you are talking to at these events or what type of opportunities arise with the people you are working with. You never know who will notice your skills at those kinds of events either. You may start a company with people on your CTF team or meet someone ...


8

A penetration tester's job is to demonstrate and document a flaw in security. In a normal situation, a pen tester will perform reconnaissance to find some vulnerabilities, exploit those vulnerabilities to gain access, then possibly extract some small piece of data of value to prove that the system is not secure. The piece of data is often a part of the ...


8

Generally speaking, to be a good pentester you have to master some of the skills that are required to be a good programmer. Solid development experience about possible programming mistakes is very helpful, because a lot of pentesting is about finding corner cases that the programmer did not think of -- i.e., bugs. This goes both way: a good developer should ...


7

I also don't work in the security area, but there is nothing that prevents you from simulating the internet using a couple routers and switches on a home network with maybe the exception of some of the high price security hardware out there. Like Jon stated, you can easily setup IIS, Apache, or whatever web server you want on a home network. There are also ...


7

Security engineer in a broad spectrum defines several responsibilities and roles.To have a bird's eye view there are several categories that exists.It can be broadly classified as developers-one who develop security tools and analysts-who use these security tools to measure security. Cryptography:It is involved with writing cool algorithms that has to do ...


7

Welcome @AlanSimonin; good question. Another parallel question to this, on my way of thinking, is to ask: "What kind of jobs in IT Security are there?". Honestly I could not tell you all, but my approach to entering the industry (I am at an entry level too) was: I tried to find out what types of jobs there were at an entry level and compare/contrast them ...


6

In addition to Jetti and Jon Hopkins' answers, there are also organizations and tools designed to teach the basics of web security. The Open Web Application Security Project (OWASP) comes to mind as a prime example of this. OWASP has extensive documentation on their site about various security exploits and techniques, as well as how-tos for both creating ...


6

First start by learning some theory. Start off with OWASP (the "bible" for webappsec), then browse around this site. I'm sure you will find numerous questions that would interest you... Next find the issues in your own code... Then, there are several "broken app" kits that you can use, for educational purposes. For example, take a look at Starting with ...


6

There is not that sort of connection between programming languages and security, what might be a better way of looking at it is to learn common languages (so java would be a reasonable starting point) as all languages have security problems - you might as well look at security problems on a wide range of web applications and platforms rather than something ...


6

Some parts of network security involve fiddling with the small details of TCP/IP packets as they are sent and received; to do that, you need to be able to intercept packets at a low level, and emit handcrafted packets as well (under Linux, for instance, this is known as using a SOCK_RAW socket). Not all programming languages provide usable API for that; ...


6

I would imagine most of the money would be in organized crime rings, operating botnets to distribute malware. From there they can attack individual bank customers to steal money or setup mule accounts. They could also rent out their botnets to others do to distributing computing. Probably a lot of spyware is still out there, maybe you inject your affiliate ...


6

Very deep? Assuming that means reading and understanding the entire RFC then no. What you need to understand in IT security is what happens to data end to end from when it is accessed by an application, to being transmitted over a network or the internet, to when it is re-assembled and used by an application on another system wherever that is in the world. ...



Only top voted, non community-wiki answers of a minimum length are eligible