The /cyb/ general on 4chan.org/g/ also relates to security and a recurring topic is how to get into this field and get a job. The idea is to have this FAQ to answer all the immediate questions. It is bootstrapped off the Cyberpunk FAQ.
So here it is, dusting off the info dump and readying it for a world that is like the 1980's all over again. This means much of the contents is radically reorganised.
This is Version 1 preview 13 of the /sec/ FAQ. History
and version numbers are as given at the end. Presently the
maintainer follows alt.cyberpunk
(which is easily
done) and 4chan.org/g/cyb/
when operative. This FAQ and later versions will be on FTP.
I would also like to recognise and express my fellow anons. This FAQ, as with Cyberpunk literature, is a living document. If you have any comments, criticisms, additions, questions please post them in a /sec/ general. (I especially welcome reports of "broken links", either in the ASCII or HTML versions). The vast number of the "answers" here could be predicated by "in several peoples opinion." The general consensus is however that no one person is the ultimate /sec/ career authority.
Table of contents:
Software had its roots in an age where passwords and quotas did not exist. That is now a long time ago and security is now a huge industry that covers a huge range of fields from social engineering to network monitoring. Adversaries range from script kiddies who thought LOIC would give them elite status to nation state actors with budgets to match.
The problems are varied and so are the job opportunities. OK; here I need your inputs regarding types of jobs and the type of work and effort required.
A few sites list the various types of professions within the field:
Cyber Degrees has a list though much of the rest looks like a questionable referral site. Placing CMU at the bottom of a ranking list is highly suspicious. Similarly Cyber Security Education has a lot of similarities and has Google bombed search results. Apply a pinch of salt when reading. After all scepticism is important in this line of work.
There is a lot of questions regarding security distributions, particularly Linux distributions such as Kali. Kali, as well as other like Parrot, black arch, pentoo, etc. are just distro prepacked and preconfigured with tons of tools you'll likely (not)use for pentesting. You could install ubuntu and download and configure the same software running on them, and get the same results. They're just an entry point for beginner security researchers and skids, that make it easier for everyone to make or follow tutorials, as they all run the exact same environment.
First off there is no easy way in. You will need to read, a lot. The corresponding upside is that your job is fairly safe against outsourcing and offshoring.
Read How to Build a Successful Information Security Career. It's from 2008, but still very relevant. As for the Basics mentioned check out Professor Messer, and do the CompTIA+, Network+ and Security+ for very good fundamentals.
How do I become a Vulnerability Research Ninja (note, some links on insecure programming are dead but on Archive and mirrored on Github)
Ordered resources (sort of a syllabus)
In practice you will also need some assembly skills, mostly for x86, x64 and ARM. Some resources are LiveOverflow on YouTube and AsmTutor.
Here is just a list of what has been discussed in the threads. Additions are welcome.
OSCP Offensive Security Certified Professional
CWSP Certified Wireless Security Professional [wiki]
GSEC GIAC Security Essentials
CCSP Certified Cloud Security Professional
CISM Certified Information Security Manager
HCISPP HealthCare Information Security and Privacy Practitioner
CISSP Certified Information Systems Security Professional
SSCP Systems Security Certified Practitioner
CAP Certified Authorization Professional (risk management framework (RMF) focussed)
GAWN GIAC Assessing and Auditing Wireless Networks
More or less quotes extracted from former threads, edited for conciseness.
1:
Those are all useless in security. You get those certs to sit on a board and be the sell-it biz guy who 'manages' security. ** If you want to actually learn security, do CS:APP book. It even has lectures: https://www.cs.cmu.edu/~213/schedule.html and especially do the labs, like learning Return-Oriented Programming (ROP) so you can take snippets out of a binary and inject it back in, forcing a program to do whatever you want http://csapp.cs.cmu.edu/3e/labs.html.
When you are finished that book, or at least finished the attack lab, do this: https://microcorruption.com/login which is what NCC Group uses to hire people. Become a jr, security analyst there then work your way up to consultant status. That's how you do security in 2018.
Alternative is to get a shitty job somewhere as a bottom tier developer, BUT... write your own security tests. Do some SAT/SMT solving on the programs you are writing. Learn invariants, and start using them to find bugs. Shit like that. They will just make you a position, say 'security team lead'. After you go and get those certs, like CISSP so you can sit on the board as a real developer w/security experience and be the CSIO or just go into contracting, and be a nomad going from place to place making money auditing shit like @Homakov does.
2:
Most of those certs require 4-5 years working in cyber security though besides opsc
3:
The best three starter certs to choose from are (in no order)
SSCP (I went with this, needs 1 year experience to be
non-associate)
GSEC (Most expensive I believe)
Security+ (My brother went this, it's solid)
You only need one of these. From there you can start
specializing.
CISSP is the standard but requires 4 years (if you have a
qualifying cert) of experience to actually be CISSP.
4:
Courses can be useful. The best schools are ones accredited by
the NSA. For certs there are a few to consider:
>Sec +, SSCP, or GSEC
Each of these are a good starting cert for infosec. The first
cert I was going to get was Network +, but I got my minor in
Networking instead.
>CISSP
This is currently the "king" of infosec certs. This is more than
likely get you through an HR filter. It technically requires 4-5
years of experience, but the associate is also fine.
>OSCP
This is currently the best pentesting cert.
DoD
directive 8570.1 [archived]
has a list of certs they feel are important for infosec. So
anything in there is technically valuable in that sense.
5:
> What are some tips you guys could give a newbie trying to
get into the field?
Realize that to be good at infosec, you have to understand the
technology itself. If you want to be good with development and
application security, study those. If you want to focus with
network security, start with networks. I wouldn't recommend A+.
Network+ is ok.
> Have any of you went to school for it? If so, did it help?
I went to school for computer forensics. I'm in a different area
(crypto and wireless) but I'd say the experience and exposure
definitely helped.
> My associates comes with 5 vouchers for any certs, which
ones are key?
Start off with the associates and a good general infosec cert.
If you are planning to work with the fedgov/dod, look into DoD
regulation 8570, it outlines what certs are required for what
level of positions. Take time to look into each aspect of
infosec (application/development, crypto, networking, etc) and
find which interests you the most. The field is broad and you
can't be an expert in all things, especially at the start. Pick
a niche after you get the basics.
>General certs that required little to no work experience
(pick one)
Sec +, SSCP, GSEC
>PenTest
OSCP is still the best, although CEH is more recognized by the
government, although it's a sham really.
>Information Assurance
CAP (RMF focused)
>Necessary once you are in the field
CISSP
>Wireless networking
CWSP, GAWN
6:
cisco stuff isn't comptia stuff
you absolutely do need to learn the curriculum, it's not an
automatic pass
they have a limit on the amount of people they pass per year, so
due to test dumps, you a low 90s percentage rate of correct
answers
it's mostly going to be knowing your syntax, unfortunately the
ccna level isn't labs focused so you can't suss out your answers
by doing tab completion and ? to get the command out
subnetting is easy though yeah, just keep in mind how to handle
wildcard masks and where they're used
also bgp definitely isn't knowledge you're going to have without
studying, unless you've worked at an isp
oh also ccent1+ccent2 = ccna
it's recommended by almost everyone to go the 1+2 route because
needing to retake ccna for failure is $300, but needing to
retake 1 or 2 on failing is $150
though if you fail both 1 and 2 once each, obviously that was
$300 total too
7:
If anyone is studying for CCNA, the new curriculum is being introduced in 8 months.
...
I believe they are getting rid of ICND1
and 2 making it one test.
1:
OSCP is pretty good if you want to be a pentester.
2:
Because its a cert where you have to know your shit, it's
practical exam not just checking boxes with pencil.
Read more about it here : https://www.offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/.
LWN has a lot of news on design and implementations with a focus on Linux. It has articles on security issues and lists of updates to patch recently discovered security holes. LWN has a distribution list with a specific category for secure distributions.
The following blogs are generally recognised as worth following
There are a few.
One of the oldest fora is comp.risks which used to live on Usenet News and mailing lists, starting back around 1985. These days it is still a mailing list and the digests are pushed to comp.risks viewable on the corresponding Google Groups, and archived on http://www.risks.org.
These days 4chan.org/g/cyb is back with a vengeance, to quote some anons. Topic covers Cyberpunk and security, a mariage of convenience to keep the thread alive. Threads are archived, searchable by /cyb/, /sec/ and and /cyb/ /sec/.
Some information is stored on an open FTP server at CybSec.io where preview versions of this FAQ has been published.
It should not come as a complete surprise that the military has an interest in security. They also provide training, often from scratch.
It is amazing how much you can find on the net without having visitors from nameless agencies. Many are relatively open in order to recruit the right people.
Military security also includes Electronic Warfare (EW) but that is not covered here. Traditionally they operate closer to the physical layers and it is harder to find open information about these.
DoD had a list of DoD Approved 8570 Baseline Certifications [archived]. Also shown is a list of IA Workforce Certification Providers. This has been replaced by DoDD 8570.
Norwegian Cyber Defence Force [translate] Norwegian Intelligence Agency is recruiting.
National
Defence Radio Establishment (Swedish: Fφrsvarets radioanstalt,
FRA) [translate]
and military recruitment to Cyber
soldier.
GCHQ recruits [2019, 2016, 2015, 2014, 2012]. MI5 and MI6 are recruiting too and MI5 has provided an online "Are you MI5 Ready?" test.
The NSA happens to be the largest employer of mathematicians in the US. The intelligence community has a large common portal: Intelligence Careers. Allegedly the US Intelligence Community is a group of 17 federal intelligence agencies. The US Space Force is not listed. That could be a coincidence.
This is a list of various libraries of information out there
VPN pasta and detailed, shill-free, honest comparisons of almost every VPN provider.
Your VPN is no better than what it tests out to be, so you will want to check out if your IP is leaking, if you have a DNS leak (what this means), and speed test.
https://www.usenix.org/system/files/conference/woot12/woot12-final26.pdf
Blue Team Handbook/ Field Manual:(from the blurb) The Blue Team Handbook is a zero fluff reference guide for cyber security incident responders those who staff the Blue Team.
TOR nodes are regularly attacked. However you can defend your website with ZIP bombs, (update).
Handy posters on security and newsletters from SANS.
These are harvested from 4chan
1: i dont recommend anything on cybrary. free online courses are written by and for the lowest common denominator. a real book is always superior to whatever "course" youre doing online.
2: One anon recommended OpenSecurityTraining.info.
This is the first version of what hopefully will be a security FAQ.
Version 1 Anon
The vast number of the answers here could be predicated by "in several peoples opinion" The general consensus is however that no one person is the ultimate security authority.
This FAQ, as with the security field in general, is a living document. If you have any comments, criticisms, additions or questions, please post a note on alt.cyberpunk or 4chan.org/g/cyb and check for feedback. It can take a little while to respond.