FAQ

V1 preview 13

The /sec/ Career FAQ

Background

The /cyb/ general on 4chan.org/g/ also relates to security and a recurring topic is how to get into this field and get a job. The idea is to have this FAQ to answer all the immediate questions. It is bootstrapped off the Cyberpunk FAQ.

So here it is, dusting off the info dump and readying it for a world that is like the 1980's all over again. This means much of the contents is radically reorganised.

This is Version 1 preview 13 of the /sec/ FAQ. History and version numbers are as given at the end. Presently the maintainer follows alt.cyberpunk (which is easily done) and 4chan.org/g/cyb/ when operative. This FAQ and later versions will be on FTP.

Introduction

I would also like to recognise and express my fellow anons. This FAQ, as with Cyberpunk literature, is a living document. If you have any comments, criticisms, additions, questions please post them in a /sec/ general. (I especially welcome reports of "broken links", either in the ASCII or HTML versions). The vast number of the "answers" here could be predicated by "in several peoples opinion." The general consensus is however that no one person is the ultimate /sec/ career authority.

Contents

Table of contents:


  1. FAQ
  2. The /sec/ Career FAQ
  3. Background
  4. Introduction
  5. Contents
  6. Security What is ?
    1. Security Professions
    2. Security Distributions
    3. Getting Into Security
    4. Security Certifications
    5. Opinions on Certifications
      1. General
      2. OSCP
    6. Security News
    7. Security Blogs
    8. Security Podcasts
    9. Security Fora
    10. Military Security
      1. NO
      2. SE
      3. UK
      4. US
  7. Resources
    1. Online Resources
      1. VPN
      2. SAT/SMT
      3. Blue Team
      4. TOR
      5. Miscellaneous
      6. Opinions on Online Resources
  8. FAQ History

Security What is ?

Software had its roots in an age where passwords and quotas did not exist. That is now a long time ago and security is now a huge industry that covers a huge range of fields from social engineering to network monitoring. Adversaries range from script kiddies who thought LOIC would give them elite status to nation state actors with budgets to match.

Security Professions

The problems are varied and so are the job opportunities. OK; here I need your inputs regarding types of jobs and the type of work and effort required.

A few sites list the various types of professions within the field:

Cyber Degrees has a list though much of the rest looks like a questionable referral site. Placing CMU at the bottom of a ranking list is highly suspicious. Similarly Cyber Security Education has a lot of similarities and has Google bombed search results. Apply a pinch of salt when reading. After all scepticism is important in this line of work.

Security Distributions

There is a lot of questions regarding security distributions, particularly Linux distributions such as Kali. Kali, as well as other like Parrot, black arch, pentoo, etc. are just distro prepacked and preconfigured with tons of tools you'll likely (not)use for pentesting. You could install ubuntu and download and configure the same software running on them, and get the same results. They're just an entry point for beginner security researchers and skids, that make it easier for everyone to make or follow tutorials, as they all run the exact same environment.

Getting Into Security

First off there is no easy way in. You will need to read, a lot. The corresponding upside is that your job is fairly safe against outsourcing and offshoring.

Read How to Build a Successful Information Security Career. It's from 2008, but still very relevant. As for the Basics mentioned check out Professor Messer, and do the CompTIA+, Network+ and Security+ for very good fundamentals.

How do I become a Vulnerability Research Ninja (note, some links on insecure programming are dead but on Archive and mirrored on Github)

Ordered resources (sort of a syllabus)

Other resources

In practice you will also need some assembly skills, mostly for x86, x64 and ARM. Some resources are LiveOverflow on YouTube and AsmTutor.

Security Certifications

Here is just a list of what has been discussed in the threads. Additions are welcome.

OSCP – Offensive Security Certified Professional

CWSP – Certified Wireless Security Professional [wiki]

GSEC – GIAC Security Essentials

CompTIA Security -

CCSP – Certified Cloud Security Professional

CISM – Certified Information Security Manager

HCISPP – HealthCare Information Security and Privacy Practitioner

CISSP – Certified Information Systems Security Professional

SSCP – Systems Security Certified Practitioner

CAP – Certified Authorization Professional (risk management framework (RMF) focussed)

GAWN – GIAC Assessing and Auditing Wireless Networks

Opinions on Certifications

More or less quotes extracted from former threads, edited for conciseness.

General

1:

Those are all useless in security. You get those certs to sit on a board and be the sell-it biz guy who 'manages' security. ** If you want to actually learn security, do CS:APP book. It even has lectures: https://www.cs.cmu.edu/~213/schedule.html and especially do the labs, like learning Return-Oriented Programming (ROP) so you can take snippets out of a binary and inject it back in, forcing a program to do whatever you want http://csapp.cs.cmu.edu/3e/labs.html.

When you are finished that book, or at least finished the attack lab, do this: https://microcorruption.com/login which is what NCC Group uses to hire people. Become a jr, security analyst there then work your way up to consultant status. That's how you do security in 2018.

Alternative is to get a shitty job somewhere as a bottom tier developer, BUT... write your own security tests. Do some SAT/SMT solving on the programs you are writing. Learn invariants, and start using them to find bugs. Shit like that. They will just make you a position, say 'security team lead'. After you go and get those certs, like CISSP so you can sit on the board as a real developer w/security experience and be the CSIO or just go into contracting, and be a nomad going from place to place making money auditing shit like @Homakov does.

2:

Most of those certs require 4-5 years working in cyber security though besides opsc

3:

The best three starter certs to choose from are (in no order)
SSCP (I went with this, needs 1 year experience to be non-associate)
GSEC (Most expensive I believe)
Security+ (My brother went this, it's solid)
You only need one of these. From there you can start specializing.
CISSP is the standard but requires 4 years (if you have a qualifying cert) of experience to actually be CISSP.

4:

Courses can be useful. The best schools are ones accredited by the NSA. For certs there are a few to consider:
>Sec +, SSCP, or GSEC
Each of these are a good starting cert for infosec. The first cert I was going to get was Network +, but I got my minor in Networking instead.
>CISSP
This is currently the "king" of infosec certs. This is more than likely get you through an HR filter. It technically requires 4-5 years of experience, but the associate is also fine.
>OSCP
This is currently the best pentesting cert.
DoD directive 8570.1 [archived] has a list of certs they feel are important for infosec. So anything in there is technically valuable in that sense.

5:

> What are some tips you guys could give a newbie trying to get into the field?
Realize that to be good at infosec, you have to understand the technology itself. If you want to be good with development and application security, study those. If you want to focus with network security, start with networks. I wouldn't recommend A+. Network+ is ok.
> Have any of you went to school for it? If so, did it help?
I went to school for computer forensics. I'm in a different area (crypto and wireless) but I'd say the experience and exposure definitely helped.
> My associates comes with 5 vouchers for any certs, which ones are key?
Start off with the associates and a good general infosec cert. If you are planning to work with the fedgov/dod, look into DoD regulation 8570, it outlines what certs are required for what level of positions. Take time to look into each aspect of infosec (application/development, crypto, networking, etc) and find which interests you the most. The field is broad and you can't be an expert in all things, especially at the start. Pick a niche after you get the basics.
>General certs that required little to no work experience (pick one)
Sec +, SSCP, GSEC
>PenTest
OSCP is still the best, although CEH is more recognized by the government, although it's a sham really.
>Information Assurance
CAP (RMF focused)
>Necessary once you are in the field
CISSP
>Wireless networking
CWSP, GAWN

6:

cisco stuff isn't comptia stuff
you absolutely do need to learn the curriculum, it's not an automatic pass
they have a limit on the amount of people they pass per year, so due to test dumps, you a low 90s percentage rate of correct answers

it's mostly going to be knowing your syntax, unfortunately the ccna level isn't labs focused so you can't suss out your answers by doing tab completion and ? to get the command out

subnetting is easy though yeah, just keep in mind how to handle wildcard masks and where they're used
also bgp definitely isn't knowledge you're going to have without studying, unless you've worked at an isp

oh also ccent1+ccent2 = ccna
it's recommended by almost everyone to go the 1+2 route because needing to retake ccna for failure is $300, but needing to retake 1 or 2 on failing is $150
though if you fail both 1 and 2 once each, obviously that was $300 total too

7:

If anyone is studying for CCNA, the new curriculum is being introduced in 8 months.

...
I believe they are getting rid of ICND1 and 2 making it one test.

OSCP

1:

OSCP is pretty good if you want to be a pentester.

2:

Because its a cert where you have to know your shit, it's practical exam not just checking boxes with pencil.

Read more about it here : https://www.offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/.

Security News

LWN has a lot of news on design and implementations with a focus on Linux. It has articles on security issues and lists of updates to patch recently discovered security holes. LWN has a distribution list with a specific category for secure distributions.

Security Blogs

The following blogs are generally recognised as worth following

Krebs on Security

Schneier on Security

Security Podcasts

There are a few.

Embedded

Homo Vulgaris

Pure Decking (home)

Risky Business (about)

Social Engineer (home)

Security Fora

One of the oldest fora is comp.risks which used to live on Usenet News and mailing lists, starting back around 1985. These days it is still a mailing list and the digests are pushed to comp.risks viewable on the corresponding Google Groups, and archived on http://www.risks.org.

These days 4chan.org/g/cyb is back with a vengeance, to quote some anons. Topic covers Cyberpunk and security, a mariage of convenience to keep the thread alive. Threads are archived, searchable by /cyb/, /sec/ and and /cyb/ /sec/.

Some information is stored on an open FTP server at CybSec.io where preview versions of this FAQ has been published.

Military Security

It should not come as a complete surprise that the military has an interest in security. They also provide training, often from scratch.

It is amazing how much you can find on the net without having visitors from nameless agencies. Many are relatively open in order to recruit the right people.

Military security also includes Electronic Warfare (EW) but that is not covered here. Traditionally they operate closer to the physical layers and it is harder to find open information about these.

DoD had a list of DoD Approved 8570 Baseline Certifications [archived]. Also shown is a list of IA Workforce Certification Providers. This has been replaced by DoDD 8570.

NO

Norwegian Cyber Defence Force [translate] Norwegian Intelligence Agency is recruiting.

SE

National Defence Radio Establishment (Swedish: Fφrsvarets radioanstalt, FRA)  [translate] and military recruitment to Cyber soldier.

UK

GCHQ recruits [2019, 2016, 2015, 2014, 2012]. MI5 and MI6 are recruiting too and MI5 has provided an online "Are you MI5 Ready?" test.

US

The NSA happens to be the largest employer of mathematicians in the US. The intelligence community has a large common portal: Intelligence Careers. Allegedly the US Intelligence Community is a group of 17 federal intelligence agencies. The US Space Force is not listed. That could be a coincidence.

Resources

This is a list of various libraries of information out there

Online Resources

VPN

VPN pasta and detailed, shill-free, honest comparisons of almost every VPN provider.

Your VPN is no better than what it tests out to be, so you will want to check out if your IP is leaking, if you have a DNS leak (what this means), and speed test.

SAT/SMT

https://www.usenix.org/system/files/conference/woot12/woot12-final26.pdf

Blue Team

Blue Team Handbook/ Field Manual:(from the blurb) The Blue Team Handbook is a zero fluff reference guide for cyber security incident responders – those who staff the Blue Team.

TOR

TOR nodes are regularly attacked. However you can defend your website with ZIP bombs, (update).

Miscellaneous

Ubuntu 12.04 Forensics

Malware Unicorn by securedorg

Handy posters on security and newsletters from SANS.

Opinions on Online Resources

These are harvested from 4chan

1: i dont recommend anything on cybrary. free online courses are written by and for the lowest common denominator. a real book is always superior to whatever "course" youre doing online.

2: One anon recommended OpenSecurityTraining.info.

FAQ History

This is the first version of what hopefully will be a security FAQ.

Version 1 Anon

The vast number of the answers here could be predicated by "in several peoples opinion" The general consensus is however that no one person is the ultimate security authority.

This FAQ, as with the security field in general, is a living document. If you have any comments, criticisms, additions or questions, please post a note on alt.cyberpunk or 4chan.org/g/cyb and check for feedback. It can take a little while to respond.