Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am conflicted. I want to become a software developer but I am also interested in the networking side of things… Is software development and network security 2 whole different beasts? If they are, could learning both become a whole “jack of all trades master of none” situation?
Should I specialize or could I be a software Dev with a "hacking" hobby.
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
As a developer of 15 years who has moved into a pen-test role, I can say that yes there are many transferable skills, some of which will put you at and advantage to testers who came from a pure security background.
Firstly and foremostly you understand the developer mindset, this means that you probably understand why a developer chose a particular solution, and understand some of their thought processes. As a developer you have a knowledge of their 'language' how they think and talk, and as such you should be able to communicate any security findings and recommendations in a manner that a developer can understand.
Secondly you probably have a much better programming base than many pen-testers, this will come in very useful for developing tools and apps to help out (really I've seen some of the hacked together tools, it's a wonder that they work at all ;)
Code Review... This is an obvious big winner, you just need to start looking for insecure patterns and insecure language idioms.
Your understanding of software development practices (agile, waterfall etc), can be quickly augmented with learning about BSIMM, SAMM, and SDL
Depending on your developer background you may have a good understanding of OS/networking innards. I spent some time in the networking/OS world, which I found useful to inform other developers what the computer was really doing with their code. Likewise if you have spent your time in the Web world, that's where your focus will likely be.
It's worth noting that you may feel that there are vast areas of knowledge that you are lacking, but there are no pen-testers who know it all. You will bring your own knowledge and skills, and as long as you are prepared to learn and teach, it will be a very rewarding career move. It also has the advantage of making your really hire-able in two fields.
I'm a developer and I do network security as side business. I have a long time since I started developing so after learning the basics about security I wanted to learn more. After several years now, I keep learning about network security.
Ideally, developers need to know as much as possible about security, but they don't really need to enter in too much detail (just knowing how to apply security models is generally enough). Network security professionals also need a little bit (or more) of developing, to create, improve or customize tools, generate reports, etc.
All will depend on what you want. Do you want to do more developing or you prefer to do more network security? Both ways requires a lot of time and effort to learn.
I wouldn't suggest to specialize in both at the same time. Start with the one you feel fits better for your current profile and your future opportunities, and as the time goes and you start to feel comfortable with it, start learning about the other area.
