© Copyright Nostre Net
- Especially if you are going to dedicate yourself to logical security, know and learn to use the free security tools that exist on the network : Snort, Yara, Metasploit, Logstash, OSSEC, Nessus, PFSense, etc. Experiment, experiment and experience. Even if you are more focused on consultancy or more organizational aspects, it is good to know the purpose of the main applications, how they work grosso modo , as well as basic notions of the operation of operating systems.
Stay informed . The volume of resources today related to information security is huge: blogs, security conferences, streaming events , security reports, books, papers, new vulnerabilities, etc. The best part is that a lot of that information is free. But do not forget the national laws (LSSI, LPIC, LOPD, etc.), new trends and attacks, tendencies and typical attacks, etc. The issue in this case is reading, reading and reading.
- Collaborate with or create a security blog . As the founder of this blog seven years ago, I think that this is an essential point to enter the sector. Cybersecurity interests you, so it should not be difficult for you to talk about your opinions, experiments, tools, analysis, security forums you attend, criticism, international geopolitics and APTs, reports you have read, etc. The question is to have something that serves as a cover letter. One thing that I never tire of remembering: even if you are not the first to write about something, nothing happens.
- Form yourself (this you have already heard by active and passive, you want to dedicate to security or frog breeding). Here we return to the amount of available resources available today: look for training in the branch in which you want to develop, with or without a certificate, in person or online . CISAs, CCNAs, SANS. Do some master. If you do not have resources, many CERTs have free courses and initiatives like Coursera have very high level courses (although unfortunately many in English). Be self-taught and you know, if your economy does not allow you to have a certificate, a blog is a good place to show what you know.
English . You know, the typical thing. At least you will need it to be able to read a report of a Russian APT published by Symantec. It is true that knowing Iranian, Chinese or Russian can help you with APTs, but start with the easy. We already know that today, APTs do the whole world.
Collaborate with the community . Participate in a project; develops or collaborates in the development of some tool. It is not necessary to code code if you do not feel able to "put a hand" to something: translate, develop a manual, beta beam tester. Github, you know. See blog. In short: put things in motion.
- Learn to write . Seriously, this is a personal crusade. Grammar, spelling, syntax. No need to win the Nobel, but you have to get customers to understand you. Yes, office applications will help you with spelling and detect some matching problems, but you will need something else. Obviously, if you're going to get involved in consulting, what will I tell you? In short: if you do not intend to work in a basement by stinging code for some malignant international power , it is likely that sooner or later you will have to write a report. Oh The blog is another good resource to practice this.
Learn to use the office tools . This is my second personal crusade. Really. You will not be able to deliver reports with the vi or in its borderline version the notepad , even if they are written in hexadecimal. Customers also do not usually accept that you send them the LaTeX sources so that they generate the PDF. I am the first to recognize that in certain cases formatting a document of a certain magnitude can become a hell, but it is what there is. My recommendation is that you learn to use basic things like line spacing, interpolation, fonts, tables, embed a graph, margins. The powerpoint Things like that, you know.
- Develop your communication skills . You do not have to be Eduardo Punset, but it's good that you know how to communicate what you have in your head and that over time you try to improve your skills if you need to address a group of people. I recognize that this can be complicated or practically impossible for some people with panic to speak in public. In those cases ... luck, patience and resignation.
Also Read:
Hire a Freelance Cyber Security Engineer
The Wall