IT Certifications and Careers (Official Discussion Thread)

[.r.]

Anyone here apply for Federal positions, how long did you wait for a reply?

Am starting to get response (2 out of 29) for some of these agencies, which were I don't qualify for the position. But I'm persistence as fukk!

 

[David_TheMan]

Am starting to get response (2 out of 29) for some of these agencies, which were I don't qualify for the position. But I'm persistence as fukk!

Federal is about hitting check marks.
Again give yourself a leg up by getting used to DoD 8570
DoD Approved 8570 Baseline Certifications

You get your Sec+ or usually if they like you they'll bring you in and give you 6 months to get it, but try to get certs that fill out the most boxes. This makes your very attractive for Civilian and Contractor positions in the federal scape.

That said good luck to you moving forward man, if you have any questions let me know and I'll post on here or pm you if you want ot be in private.

 

[EnzoG]

Are the Mike Myers tests the best way to practice for the 901 test???

 

[.r.]

Federal is about hitting check marks.
Again give yourself a leg up by getting used to DoD 8570
DoD Approved 8570 Baseline Certifications

You get your Sec+ or usually if they like you they'll bring you in and give you 6 months to get it, but try to get certs that fill out the most boxes.....

Rep+

This is good to know, I have most of the basic CompTIA certs, and VMware.
I see I need to knock out the Cisco and high level CompTIA security.

 

[David_TheMan]

Are the Mike Myers tests the best way to practice for the 901 test???

There is no best way objectively.
There is the best way for you, so just listen to, read, or do whatever is the best method for you to gain the knowledge and mastery over the content in total. Don't look more to study for the test, but to learn and understand throughly the content of the test, because it benefits you in the long run when you start to build on it.

Thats just my opinion though, but do whats best for you

 

[MMA]

That depends... Are we talking about my resume or the truth?
According to my resume; I'm the man. 2+ years in various security roles ranging from Incident Response to Application Security. I can talk the talk with the best of 'em doe

Lmfao you better be ready, the only companies which will allow you to learn has you go know nothing about security

 

[Sonny Bonds]

Does anyone know how to get into technical writing?

 

[Julius Skrrvin]

Cyber attack modeling & simulation is the next wave. Get in before it's too late

Pentesting's been around since the late 80s. Nothing next about it. And to be honest, it's only really useful for a relatively mature information security program to test and validate controls or for PCI bullshyt and most companies are not that mature. Tons of people trying their hardest to be in pentest too.

Appsec has a bigger expertise shortage imo. And even blue team stuff centered around anomaly detection and higher level engineering (aka not run of the mill SOC).

 

[Tr0yTV]

Pentesting's been around since the late 80s. Nothing next about it. And to be honest, it's only really useful for a relatively mature information security program to test and validate controls or for PCI bullshyt and most companies are not that mature. Tons of people trying their hardest to be in pentest too.

Appsec has a bigger expertise shortage imo. And even blue team stuff centered around anomaly detection and higher level engineering (aka not run of the mill SOC).

Edit: Technically, Appsec is a subset of pen testing. Blue team will always have more jobs due to the nature of the work. Personally, I don't like Incident Response. Rather do cloud security.

Over the last few weeks, Gartner analysts Augusto Barros and Anton Chuvakin have issued a call to action on threat simulation, and dived into Breach and Attack Simulation technologies. The questions they’ve posed are timely and relevant, and have been brought up by many security leaders we’ve talked to as well. As a result, we thought it would be fitting to kick off a blog series to discuss these topics and our perspective on Breach and Attack Simulation.

Anton posed an interesting question in his first blog- “ What does it even mean “to test one’s security”? As he said, “We want to look into testing of security technologies and processes (such as detection and response processes), with the focus on outcomes, not controls. In essence, we want to look into testing the effectiveness, not the presence, of security controls.”

Let’s take a look at options that are available today:

• Penetration testing - A pen test is a point-in-time approach that attempts to evaluate the security of an environment by exploiting weaknesses such as vulnerabilities. These assessments are typically conducted once or twice a year, or every quarter in the case of organizations with stringent regulatory compliance requirements. Pen testing focuses typically on external attacks, and have a bounded set of objectives because of the impact and potential risk to users and systems.
• Red teams - Some larger organizations have developed internal red teams that “simulate hackers” and are proactive about finding security risks in their environment. Security red teams are typically available in large organizations with fairly mature security posture. The challenge for most organizations is it can be expensive to build a red team because of a general shortage of these red team engineers with offensive-security skillsets.
• Vulnerability scanning - Vulnerability management systems scan systems to identify vulnerabilities that are associated with them. Because vulnerability management systems don’t incorporate context, the output can be incredibly noisy and may not accurately reflect true security risks. Additionally, even if security teams complete the impossible task of patching every single vulnerability, doing so isn’t an indication of a secure environment. There are many other breach methods that a real attacker might use besides taking advantage of a vulnerability, for example, phishing, data exfiltration.
• Breach and attack simulation - A new technology defined by Gartner in their 2017 Hype Cycle for Threat Facing Technologies and in our Gartner Cool Vendor report, breach and attack simulation enables organizations to actually quantify security effectiveness by simulating hacker breach methods to ensure security controls are working as expected. The ability to assess security continuously and automatically--in real production environments, across the entire kill chain--eliminates guesswork, incorporates business risk context, and provides actionable results..

The hard reality with attackers is we know they are relentless and trying a variety of techniques to breach our security. Many of these techniques are being reused. The best way for us to ensure our security controls are going to stand up against these attacks is to actually execute these attacks.

Source:
Breach and Attack Simulation Versus Pen Testing and Red Teaming
Harness the Hacker With Breach and Attack Simulation - SANS Institute

 

[Julius Skrrvin]

Edit: Technically, Appsec is a subset of pen testing. Blue team will always have more jobs due to the nature of the work. Personally, I don't like Incident Response. Rather do cloud security.

No. No it isn't. Appsec is simply the process of improving the security of applications via software, hardware and procedural methods. You may utilize red team processes like web app testing to validate and audit your controls, source code review, or design review... But appsec is not a subset of pentesting by definition. For example, a WAF is an application security device. Do you use it for pentesting?


As for the second bold.... IR/SOC in the cloud is the same as IR anywhere, the only difference is that you have to be aware of platform specific security controls (setting up logging in a large environment has it's nuances too, but that's a whole different conversation).

As for the whole breach simulation shyt, that's just a pentest with a different scope, which has been around forever. There is no functional difference in the TTPs used. Maybe there is on the red team side operationally, but yeah... That's just a pentest.

 

[Tr0yTV]

No. No it isn't. Appsec is simply the process of improving the security of applications via software, hardware and procedural methods. You may utilize red team processes like web app testing to validate and audit your controls, source code review, or design review... But appsec is not a subset of pentesting by definition. For example, a WAF is an application security device. Do you use it for pentesting?


As for the second bold.... IR/SOC in the cloud is the same as IR anywhere, the only difference is that you have to be aware of platform specific security controls (setting up logging in a large environment has it's nuances too, but that's a whole different conversation).

As for the whole breach simulation shyt, that's just a pentest with a different scope, which has been around forever. There is no functional difference in the TTPs used. Maybe there is on the red team side operationally, but yeah... That's just a pentest

I was referring to your original post. You claimed AppSec has a bigger shortage; yet, in that context, AppSec (Manual App Testing) falls under pen testing. That is why they have the GWAPT certification. Which is why AppSec positions tend to request the GWAPT. Now, does the entire field of AppSec fall under Pen Testing? Of course not, but under the context, I was correct - AppSec analyst managing WAFs?! Where they do that at? AppSec analyst use Scanners, manually review source code, and test for vulnerabilities.

Why would I do cloud IR but be opposed to on-prem IR?? I was referring to POC's/Architect aspect of cloud security.
Seems like miscommunication. I was speaking from my exp. as an AppSec Analyst. You on that SOC/IR ish

Breach simulation gon be lit. idc if its the same shyt with a different name

 

[Julius Skrrvin]

I was referring to your original post. You claimed AppSec has a bigger shortage; yet, in that context, AppSec (Manual App Testing) falls under pen testing. That is why they have the GWAPT certification. Which is why AppSec positions tend to request the GWAPT. Now, does the entire field of AppSec fall under Pen Testing? Of course not, but under the context, I was correct - AppSec analyst managing WAFs?! Where they do that at? AppSec analyst use Scanners, manually review source code, and test for vulnerabilities.

Why would I do cloud IR but be opposed to on-prem IR?? I was referring to POC's/Architect aspect of cloud security.
Seems like miscommunication. I was speaking from my exp. as an AppSec Analyst. You on that SOC/IR ish

Breach simulation gon be lit. idc if its the same shyt with a different name

None of that invalidates that appsec isn't a subset of penetration testing though this is a wholly semantic argument. I will agree with you that appsec positions tend to draw pretty much on web dev, web app pentesting, and secure coding practices though. My larger point was that even web app pen testing and network pentesting are pretty different. They have some overlap, but the TTPs and core knowledge reqs aren't the same let's keep it real, when people talk about adversary emulation most of the time they mean net pentesting... And you know it

If you mean architecting cloud security systems, then say so.

I'm not only in SOC and IR but that's a whole different story. At this point I'm a purple teamer doing everything from creating threat hunting tools to app assessments to IDAM and I'm getting burnt out

 

[CASHAPP]

what is the route you take if you go to college for IT but wanna go into the security field like bdizzle did? I mean for argument sake if you got fortunate with being given money to go to college and don't have to do the cert route

 

[Silkk]

Ain't have no plans on leaving my current gig for at least a few years/after my CISSP/Associates but already starting to get some of these $60/$70+ contract offers

 

[Silkk]

what is the route you take if you go to college for IT but wanna go into the security field like bdizzle did? I mean for argument sake if you got fortunate with being given money to go to college and don't have to do the cert route

Computer Information Systems

Gonna unnecesarily waste a lot of time and money on tuition though.