cyber-and-careers

[undone shore]

Part time. I'm still doing my undergrad primarily (officially).

[sand ether]

Best wifi adapter for hacking cheapest price

Plz suggest

[buoyant tangle]

The alpha is cheap and has monitor mode

[sand ether]

Alpha is costly

Wifi adapter for beginner

[buoyant tangle]

Alfa Network AWUS036NHA – USB WiFi Adapter, 150 Mbps, 802.11b/g/n, RP-SMA, AR9271L Atheros Chipset https://www.amazon.co.uk/dp/B004Y6MIXS/ref=cm_sw_r_apan_glt_fabc_GXFJTDA3HZ56HHVGMMA3

It's 30 quid here in UK

It's the one I use and has worked fantastic on parrot and kali

[sand ether]

Ok

6000 in indian coranci

[buoyant tangle]

Is that a good price ??

[quick forum]

You can get some MT7601 for very very cheap

[sand ether]

Where to learn hacking for free

Plz suggest

[quick forum]

tryhackme.com

[sand ether]

what did you learn from there

But he is not fullly free

Plz guide

[quick forum]

It is approximately 80% free content
I learned most of what I know there

[sand ether]

Ok

Thanks

After this course

[stuck rover]

!docs free-path

[dire rivet]

TryHackMe

What rooms should you do? A free guide for beginners

https://blog.tryhackme.com/free_path

From TryHackMe with ❤!

[stuck rover]

I just said that. You'd still need to be familiar with the basics to be able to move around on a linux web app server. Not sure if their organisation uses Windows servers but honestly I'm still gonna wonder how someone got to that level without touching linux/using kali linux once.

[quick forum]

Name one tool on Kali that you'd need for webapp testing that you can't run on Windows?

[undone shore]

Chances of getting RCE irl are slim to none. Even if you do, you don't do anything with it -- you speak to your point of contact immediately and that's it

[stuck rover]

I see. So would you say that someone that senior shouldn't be familiar with Linux?

[undone shore]

It's no particular benefit for them to be, although being familiar with different technologies is always a bonus if they're in a technical role. The more managerial the role, the less it matters as a requirement 🤷‍♂️

[stuck rover]

I'm not going to go in depth about said person's origins but at some point they were an app sec analyst. It may not be as useful to them now but that doesn't stop me from being surprised so I guess that's the end of that. You could use windows for pentesting but imo that's a bother and a time sink I'm not sure most pentesters would want

[undone shore]

I mean, for app sec you don't exactly need much, and installing a few tools on Windows is easier than learning an entirely new operating system

Most people are a hell of a lot more comfortable with Windows than Linux -- especially if they've got into security through development or another area of tech, rather than the "hacker" route

[stuck rover]

Yeah for app sec but they apparently do fully fledged pentesting as well. It's just learning bash if we're honest so not that hard but to each their own I guess. If they don't want to learn linux and it's exploitation or don't need it. More power to them.

[undone shore]

Again, fully fledged pentesting doesn't necessarily involve Linux, and either way it's a hell of a lot more than learning bash 😆
I would hope that a pentester was comfortable in both, but it's not necessary for every role. Hell, I know jack about exploiting MacOS/iOS rn (other than basic Unix stuff), but I'd hope that wouldn't stop me from getting a pentesting job.
Learning to debug Kali when it breaks is an art form.

[stuck rover]

Idk about you but that's pretty much the only difference I've seen in usage aside things like file structure.

[undone shore]

They are very different beasts in terms of workflows and intended usage. Hell, they are built completely differently: Windows is a lot more integrated whereas Linux is effectively a pile of interchangeable components that interact with each other. If you use Kali like you would use Windows then you're doing something wrong. That's not to say that one or the other is better, they are just different.

[stuck rover]

Linux is just an OS with a GUI and a CLI. People game on linux, write reports on linux, watch netflix. The intended usage is to interact with your hardware. The only thing I've gleaned from this conversation is apparently learning linux is a waste of time and not as foundational as others say according to what you've said and that's the end of it.

[static tide]

i've been pentesting for about ~8 months now and i've seen about 5% linux servers? the rest have been windows

[quick forum]

And that's taking it to an extreme.
Listen to what people are actually saying. It's not weird or a problem that a web application tester hasn't tocuhed Kali. They might even have stopped doing webapp testing long ago when Kali was backtrack.

[stuck rover]

Maybe you should take your own advice. I never said it was a problem. Just that I was surprised. Also you don't know their background like I do. Kali had been out for 4 years by the time they started.

[river dirge]

Why do you care so much @stuck rover ?

[stuck rover]

I honestly do not.

I'm honestly ready to move on and have said so.

[river dirge]

fair enough 🙂

[modest cradle]

the person being mentioned doesnt do the testing themselves at all, they said in a comment it was outsourced and they do the reviews. that just makes it weird that application security and penetration testing are even in their job title

"Head of application security"

"cybersecurity isn't entry level, you need years of being a linux sysadmin or similar" "you don't need to know how to use linux"

sounds like you guys like contradicting yourselves every few months

[flat sedge]

Not really. CompSci has a much broader knowledge base to draw from. It depends on the aims and goals of the org that has opened the req to determine how similar different degrees are considered.

[flat sedge]

It's true that linux sysadmin is 1 path into cybersecurity. So is network admin, developer or any other IT role.

It's not inconsistent to say that 1 path is possible, and that it isn't necessary.

[modest cradle]

I agree, I am just saying they were working too hard to downplay the importance of knowing it

I've never been a sysadmin but I can't imagine pentesting from windows even really with burp suite

[flat sedge]

It seems to me that you are stretching it to make it sound like someone is using a logical fallacy.

[modest cradle]

if all you need to know is how to use burp suite to be head of appsec then I should stop learning other things now shouldn't I

[pseudo creek]

I mean, I have been in security for a long time without really knowing Windows... really didn't need to do so til recently

[flat sedge]

I have done it. I had to, for a web assessment of a product that was on a segment that I couldn't access with my normal Kali VM.

[pseudo creek]

you can focus on various things and be in security, if you want a well rounded base understanding Linux, Windows and MacOS goes far for that, at least on some level

[modest cradle]

It's discouraging to look at the people in well paid places who don't know very much

[pseudo creek]

why do you think they don't know very much?

[modest cradle]

they said so, and theres no point posting what they said directly

[pseudo creek]

well we can't talk about some random people or what they are talking about

[modest cradle]

it's the head of application security at an insurance holdings company, but they outsource

so the person is effectively someone who reads reports

their linkedin also has "penetration testing" in their title

[pseudo creek]

well linkedin titles can be whatever you put, there are people who can sell themselves well and can skirt by or they provide value in some different way

all you really need to focus on is yourself, not other people

[modest cradle]

Right, but it's more a popularity contest than anything else

learning how things work is secondary to just getting in

[pseudo creek]

its not a popularity contest but networking can help you get a job/foot in the door

[modest cradle]

if it wasn't one then how could you have the job title without ever doing the work yourself

[pseudo creek]

easy, go to linkedin, put job title

[undone shore]

I see you've never had to recover from any Kali messups, or integrate any weird tools 😆
There's a reason Linux is a hobbyist thing rather than an actual front-runner

[undone shore]

You would be amazed at how many managerial security positions are held by people who aren't technical

[modest cradle]

but they actually do work at this company in that capacity, only the company doesnt actually have them do that work

[pseudo creek]

well thats something between them and their company, not your concern

[undone shore]

Nothing necessarily bad about it either, considering they could just as easily have spent 40 years doing compliance beforehand

[modest cradle]

I feel similarly about the managerial class as the section about them in hitchhikers guide where they're launched into space

[undone shore]

Well that sounds like a "you" problem

Unfortunately for you, you're gonna have to listen to them for a few years, so I'd suggest you suck it up 🤷‍♂️

[modest cradle]

Professional paperwork reader

[undone shore]

Who's gonna read the paperwork if they don't?

You?

That makes you the professional paperwork reader

[modest cradle]

I did my managers work at my last job so it doesnt really apply

[pseudo creek]

they probably don't care what you think of them, I would stop worrying about other people

[undone shore]

Someone has to make the overall decisions 🤷‍♂️

[modest cradle]

its especially heinous at companies with like 7 managers to one person

[quick forum]

Good managers shield you from the nonsense

[undone shore]

Well they'll be going bust soon, won't they

[modest cradle]

I look forward to meeting one of those

[undone shore]

You already have. He's sitting at the top of the server rn 🤷‍♂️

[stuck rover]

I have. I googled my way out of it and every time something broke it has been an absolute pain in the arse. Occasionally, windows has a problem and you do the same.

[modest cradle]

I mean where I have to interact with them as my manager

[undone shore]

Very occasionally.
Windows is designed to be user friendly -- that's why it's so commonly used.
Linux doesn't have quite so much abstraction

[undone shore]

Then find a better job

[stuck rover]

But that's not the point now, is it?

[modest cradle]

the point was you guys dogpiled sleepy when he was right

[pseudo creek]

??

[modest cradle]

you shouldnt be called head of application security without actually doing work on it lol

[undone shore]

The point is: why would you learn to use a whole new operating system, with a very different UX, when the one you're used to is just as good for what you're working on?

[undone shore]

Says you, who has precisely no input in that company 🤷‍♂️

Let 'em do what they like. It's their money

[modest cradle]

can we get a "Head of Application Security" badge on THM for completing the burp suite trainings

[undone shore]

Sure. I'll ask Skidy to add that today

[pseudo creek]

you know, you really need to focus on yourself and not others

maybe we need a 'focused on myself' badge

[modest cradle]

I am, it was just noticing some absurdity

everyone does that occasionally

[undone shore]

What in your eyes is absurd may be perfectly normal in the real world 🤷‍♂️

[modest cradle]

absurdity is perfectly common in the real world

[pseudo creek]

I can't comment at all at what other companies do based on LinkedIn profiles

[undone shore]

The difference is whether you argue it when you're given evidence from people who actually work in the industry that you're wrong

[modest cradle]

would you hire that person

[pseudo creek]

depends on the job

[modest cradle]

head of appsec, they've never touched the tools

[undone shore]

To do the job they're actually doing? Assuming the background checks out, sure

[stuck rover]

For daily use, I've found it to be similar. It only broke when I was trying to install weird tools which were for when I needed to hack a box.

In this case then really all your saying is I've wasted my time learning linux, innit?

[undone shore]

You don't need a technical background to manage projects/resources, and read executive summaries

[undone shore]

No, because it is a very useful skill to have. Being able to use Linux is very definitely a bonus, but that doesn't make it integral

[modest cradle]

sounds like a good reason as to why no one ever understands those reports

and why the same things go unfixed or misconfigured constantly

[undone shore]

Again, that's up to the companies in question -- it's not your concern

This is the world of tech. Get used to it

[modest cradle]

sure, but the infrastructure of my country sure does directly affect me

[undone shore]

Is this person in a role to do with CNI?

[modest cradle]

what

[undone shore]

Are they managing your country's critical national infrastructure?

[modest cradle]

No, but the noncritical infra doesn't really matter less

[undone shore]

It kinda does -- that's why it's designated non-critical...

[modest cradle]

insurance companies handle PII

[stuck rover]

If it wasn't integral then I'm sure it wouldn't be on the five pillars. In any case, this conversation isn't going anywhere. Perhaps we should move on?

[undone shore]

If this company goes down, will it have any effect whatsoever on you?

[modest cradle]

is the point you're trying to get across that we shouldn't care about things becoming more secure over time

[undone shore]

Ultimately, if your job requires it, you do it.
This is the same as saying that you should learn every programming language when your job needs you to know C.

If his job has never required him to learn Linux (which I can't see any reason for it to have), then why waste the time doing it?

It's a tool. Same as any other.

And either way, his suitability for the job is a choice made by his managers -- not either of you, or anyone else for that matter

[modest cradle]

people are entitled to independent thought about their surroundings

no one said it was their choice

[undone shore]

How do you think he'd feel if he saw random people on the internet telling him that he's unfit to do his job?

How would you feel?

[modest cradle]

there's a reason why we didnt name the company or person

[undone shore]

How would you feel

[modest cradle]

how I felt would not really matter if the criticism was based in reality

[undone shore]

And is it?

[modest cradle]

feelings are secondary

[undone shore]

It's based on some comments and a very much incomplete knowledge of his employment history and experience

[modest cradle]

their employment history is listed

[undone shore]

In other words: it's you bitching about someone you've never met having a job that you don't feel that they're entitled to have

[pseudo creek]

many years ago, I learned Unix/Linux did part time Unix (Solaris) sysadmin work... when I got into Cyber Security, didn't see Unix for 10ish years, then Cloud came around and Linux became relevant again... I would say (like Muiri said) Linux is a useful skill to have even if your job won't require it

[modest cradle]

no one is entitled to anything, you're like 5 years younger than me and lecturing me about the job market lol

[stuck rover]

No, it's not. If pentesting and app sec doesn't require you to know how to use kali or linux as a whole then why do you use it?

[pseudo creek]

I agree with Muiri and I'm older than you

[modest cradle]

you didn't see the posts in question

[stuck rover]

Why would you learn a completely unfamiliar OS with a different OS when you could do the same with Windows?

[pseudo creek]

I don't have to

[modest cradle]

but I don't blame you and yes, you're right we should not dwell on it either way

[undone shore]

Because it has its uses. I could get by just fine without it. As I said earlier: 0day literally did get by just fine without it for however many years, and he's quite literally one of the best around

I learnt it because I like it, and because it makes some things easier

[stuck rover]

I'm pretty sure 0day knew how to exploit a linux machine

[undone shore]

I learnt it because it gives me a more balanced knowledge

[modest cradle]

the mistake you're making is thinking they do the work in windows alternatively

[stuck rover]

Even when using windows

[modest cradle]

they dont do any of it

[undone shore]

Of course he did, because he had reason to learn it when he was younger

[undone shore]

And that's a problem?

[modest cradle]

so why do you stress the importance of learning linux to newcomers

since they don't need to learn it

[undone shore]

They do the job that they've been given, presumably well or they'd have been fired. That's all there is to it

[modest cradle]

sounds like faith

[undone shore]

Because it's the industry standard for beginner pentesting, and it's a useful skill to have

[stuck rover]

There you go then. Glad we agree.

[undone shore]

That doesn't make it exclusively the only route

[modest cradle]

but not for managerial pentesting

[undone shore]

No, that's the facts behind it

[flat sedge]

Because it's free to use, it's very common, and it's a great way to gain basic skills needed. There are other ways to gain those skills, but those other ways require much more outlay of time and resources.

[undone shore]

He does the job he's been asked to do

[modest cradle]

with the wrong job title associated

you're just anti-criticism wholesale when it comes to anything

[pseudo creek]

wrong job title? have you seen cyber security job titles? they are all over the place

and again, it is a company that needs to determine the right job titles for the given job

[modest cradle]

what is application security and penetration testing

[undone shore]

You find me a criticism that's based on something other than your own opinions and I'll accept it 🤷‍♂️

[pseudo creek]

depends on the company and how they define it

[stuck rover]

So a good pentester would know how to exploit it. That makes it key to being good at your job. Not sure why this is a debate. Which is again leading nowhere.

[modest cradle]

putting forward the evidence would require inappropriately doxxing someone, but it was quite silly to look at

thats it

its silly

[undone shore]

No, a good hacker (remembering that 0day started as blackhat) may need to attack it.
A good pentester who works with Linux would know how to exploit it, and that would make it the key to being good at their job

A good pentester who is employed purely to deal with AD or webapps would never need to touch it

[modest cradle]

fact: if you have a CISSP then you're safe from all APT units that don't have someone with a CISSP

[undone shore]

Sure, it would help, but it wouldn't make them any less good at their jobs

[quick forum]

What in the cinnamon toast fuck does cissp have to do with the discussion?

[modest cradle]

it's on a good number of entry and mid level job postings

[warm hinge]

what is the future of cyber security experts ? Will they be affected by the advancement in AI ?

[modest cradle]

I just happen to value knowledge itself

[pseudo creek]

I think a lot of the CISSP/entry level stuff is because Indeed.com is a weird website and recruiters accidentally leave the default (entry level) so people think jobs are entry level but aren't

[modest cradle]

probably so

[pseudo creek]

IT is always changing, cyber security people will always be required, our roles just may change over time

[modest cradle]

but HR doesn't really know the difference

[quick forum]

Either way it's not overly relevant to the discussion, is it?

[modest cradle]

the discussion is qualifications per job title

[warm hinge]

Ok

[pseudo creek]

job titles are all over the place in Cyber, don't go by the job title

[modest cradle]

apparently knowing how to do the thing in your title is expecting too much and ridiculous

[stuck rover]

What's the difference there, Muiri? And last I checked we were talking about pentesting not cybercrime.

[pseudo creek]

there is no industry standard for cyber or even IT job titles

[modest cradle]

right, a penetration tester might be a janitor at some places

and they are doing the same job

[quick forum]

Didn't we establish that they had the skills for their job title?

[modest cradle]

you don't know who it is

you established conclusions you decided to make

[flat sedge]

I've been trying really hard to stay out of it - but that "pentester == janitor" argument is one of the least honest ways of approaching this entire subject I can think of.

[stuck rover]

None of us are going to budge. I think it's better to stop the discussion rather than waste each of our hours.

[undone shore]

The point was that if you don't need to attack Linux then why would you learn to do it?
It's fun to do, sure, but not essential

[pseudo creek]

ok, I gotta go but how long have you been arguing about job titles when you could've been improving your skills / learning something?

[modest cradle]

would you call someone who reads reports a pentester, or head of appsec at your company?

[flat sedge]

Possibly. It depends on what the rest of their duties as assigned actually means. Management doesn't have to be able to do the work, just understand what work was done, why it was done and report it appropriately to upper management.

[quick forum]

Pentesters shouldn't be reading reports, they should be writing reports.

[modest cradle]

so you agree with me then

[quick forum]

No.

[flat sedge]

I wouldn't expect the director of a SOC to do threat hunting, they have analysts for that. I do expect the head of a SOC to understand the threat hunting reports they are given.

[modest cradle]

they were asked what they do, they said the company outsourced the testing and they read the reports

[quick forum]

If I'd agreed with you, I'd say. You presented two options, I agreed with neither.

[modest cradle]

you said pentesters shouldn't be reading reports

[stuck rover]

How many web app servers use linux then? That's all I'll ask before I walk away.

[quick forum]

And how often is the underlying OS actually meaningful?

[modest cradle]

I wonder how many companies have something called a red team which equates to using nessus and excel

[stuck rover]

If the underlying OSs aren't meaningful then we've all wasted time learning privesc innit?

The convo is going to go on a loop again.

[quick forum]

As a webapp tester, you're not there for the underlying OS...

[undone shore]

About half and half iirc.
Counter question: when was the last time the underlying os was relevant?

If you're testing a webapp and you get RCE, you stop immediately

Regardless of OS

[modest cradle]

its just offputting to see someone generally not interested in the field

[stuck rover]

If you didn't get the memo, they aren't just a web app tester.

[quick forum]

Anecdotally, seeing as that seems to be the standard of evidence, I see wayyyyy more IIS than I should

[quick forum]

They're the head of application security, right?

[stuck rover]

And apparently a pentester.

[modest cradle]

penetration testing also in the title

but they do neither

[quick forum]

Eh. Let them get fired if they're not doing what their job entails.

[stuck rover]

That said. I'm gonna go back to doing something actually useful.

I suggest you all do the same.

[fierce light]

did you get a word? :))

[hazy tree]

No, I’m hoping today , but I have another interview today.

[distant pier]

Good luck with the interview. 🙏

[fierce light]

i'm excited 😄 good luck!!

[strange junco]

Just spent time reading thru the arguments and left a room on the off pentesting path running 😅

[hazy tree]

I think it went well. I’ll find out next week 🙏🏻

[velvet spindle]

Didn't expect so much top tier comedy from this channel

[orchid ivy]

Hello everyone

I'd like to ask you to take some 5-6 minutes of your time and take a look a this post of mine regarding my career switch to cybersecurity:
https://old.reddit.com/r/SecurityCareerAdvice/comments/mn0v8c/leaving_years_of_frontend_css_development_and/

I left all the relevant questions at the end of the post. What do you think about my plan and the roadmap itself? Does any of this make sense or my head is stuck up high in the clouds?

Thank you

[warm hinge]

I mean, since the post was made 8 months ago, how much have u achieved from that list u created?

[orchid ivy]

I had some health problems since then and I've been stable for the last couple of months. I paid for pro membership on THM last week and just started. Luckily, it appears that I will still have about the same amount of time for learning, as I mentioned in my post.

[warm hinge]

Got ya. Glad ur health is better now. And you are still doing front-end dev work correct?

[orchid ivy]

Yes, gotta pay the bills and eat food.

[warm hinge]

Ahaha yea, just wanted to confirm. So ur roadmap is not bad. Ur web dev experience will speed up the process being u probably have a solid understanding of how the web works. Definitely learn python but also incorporate the learning process with projects or ctfs that require u to script something up. Then u can throw that on ur github and ur resume. Definitely, do the pre-security if u want to brush up on the fundamentals and the jr pt path ofc. And im guessing u probably want to jump ship to a cyber job in the next year or so. So getting a cert would def help ur case. The known, safe bets would be sec+, and oscp. And from there u are honestly good to go, start applying, keep practicing and start networking. Best way is by giving back to the community through blogs, tools, etc. Then yea, after u land a job, whether its on the blue side or red side off the bat, then ofc supplement the knowledge with higher level certs and htb, etc

In the “I’m willing” section that you wouldnt mind going from helpdesk to a cyber role. Tbh, i think a better alternative is building a network or landing the simple soc 1 role and work ur way up or pivot to the red side

[orchid ivy]

Um, no, you misread that. I said that I am NOT WILLING to do that. 🙂

[warm hinge]

Oh

Oops

Alrighty lovely

At least we agree 😆

[orchid ivy]

🙂

[orchid ivy]

What do you think about CCNA on my roadmap? Would Network+ suffice for start or should I improve my networking knowledge and expertise with CCNA or something similar?

[warm hinge]

Imo, dont only listen to my input ofc, but i think network+ is more than enough networking knowledge you need for any cyber role

[orchid ivy]

I feel like, based on what I read so far all over the web, that Network+, Security+, eJPT and some basic BASH and Python skills should be enough for me to start looking for an entry level cybersecurity role. Does this make sense?

[warm hinge]

Agreed. Oh yea, the net+ and sec+, if u remain consistent, day to day, should be learned, and understood in 1.5 to 2 months tops

Python and bash, it depends. The more u apply it, the quicker you will pick it up

[orchid ivy]

What about eJPT? Would networking knowledge gained from Network+ be enough in order to follow the course for eJPT?

[warm hinge]

Oh, no doubt, the network+ provides a lot more knowledge then the ejpt. So youd be doing yourself a favor if u did net+ and then read over the ejpt networking section

[orchid ivy]

And finally, at the very end of my post, I mentioned my age, which worries me a bit.

Should I be concerned?

[warm hinge]

Not one bit

Age doesnt exist in this space

Lots of folks switch over at any age tbh. And they do it successfully. U just need to be persistent

[orchid ivy]

Well, I'm afraid I'll have to disagree with that when it comes to software development. I really noticed (at least in the country that I live in), how IT companies are getting more and more transparent in regard to not wanting "old" people for entry level roles. If you're in your 30s, you're out of luck.

Though I'm glad if that is not true for cybersecurity.

[warm hinge]

Other people can also provide comments too about this. But in cybersecurity, jobs need to be filled especially on the blue side and regardless of that, they dont look at you for ur age. Only ur skills, how you can be valuable and help with the growth of the company, etc.

Don’t worry about how old you are, trust me, if u follow this roadmap you created and remain focused, you will be rewarded with a foot in the door and land a job in cyber

I know someone who is 55 years old, was also a developer, then went to get his phd and decided now to apply for the nsa internship for 2022 and hopefully land a full time job at the agency

[orchid ivy]

Thank you very much for taking the time to read my post and answer my questions, @warm hinge!
Take care and keep up the good work! 🙂

[serene umbra]

Gave +1 Rep to @elfin tendon

[warm hinge]

@orchid ivy no problem. Good luck on ur journey. Stay positive and remain focused 👍🏼

[minor mauve]

hey, is anyone here following web3, crypto or DAOs? would love to be part of some infosec DAOs, existing ones or anyone interested in learning more & creating a new one. i'm learning smart contract security right now & curious to know how else i can contribute in web3. hope someone point to the right circles please. thanks!

[velvet spindle]

I'm actually on a very similar roadmap (age, also giving up another good career), so I can give some input I think.
1a) I think you can move homelab further down the road, so it serves a clear purpose
1c) Consider adding Powershell scripting. For Python - find projects you can contribute to. It's a good learning tool + you'll have github to show. Simple problems are often tagged as 'good first issue'.
2a) I'd pick either Net+ or CCNA, I think getting both is diminishing value.
4a) Move it to step 2 IMO, the sooner the better. Even if you'll struggle, it's a good learning experience.

Get a Twitter account if you don't have one already. It's a good tool to stay up to date and you might get to know some people, which can be very valuable depending on your location. It might be annoying at first but once you filter out the usual drama/useless stuff, it's pretty cool.
Once you start doing boxes - do writeups. Even if nobody reads them, it's still a good way to learn taking good notes.
Cloud knowledge will be useful sooner or later, so that's something to consider. AWS cert is cheap and easy.
You'll inevitably run into the problem of 'why the fuck is there so much stuff to know'. That's fine, you don't need to know everything and don't let it get to you. IMO by far the most important thing is 'if I don't know that right now, can I google it and figure it out'. Burnout while learning is also very real.

With that all being said IMO by far the biggest problem you'll run into is "at what point am I ready to actually do it for a living?". And I don't think there's an answer to be honest, I've already skipped on some job posting that seemed written for me due to lack of confidence. For the sake of yourself don't ask other people about it or you'll get completely insane answers aka 'you need 10 years of sysadmin experience'.

Overall, looks good, GL : )

[orchid ivy]

Thank you for reading my post and getting back to me. 🙂

I feel like, based on what I read so far all over the web, that Network+, Security+, eJPT and some basic BASH and Python skills should be enough for me to start looking for an entry level cybersecurity role (of any kind for now). Does this make sense?

Which I should be able to achieve within a year? On work days, I am usually able to spare 2-3 hours after work to learn for certifications or whatever needed. On weekends, I usually have around 20 hours of time to learn.

[serene umbra]

Gave +1 Rep to @velvet spindle

[native elm]

Easily done in a year. Net, Sec and eJPT can be done in <6 months.

[hazy oasis]

Sorry if this has been already asked or answered. I am new to learning this and am going through the complete beginner on THM and then was planning on going to the cyber defense pathway. After that was planning to study for Network + and then do Security + as well. Are there any helpful tips for when studying for those or useful resources?

[native elm]

Tips.. take good notes, use varied study methods (labs, videos, pdf, flash cards, practice exams, etc.) For Net/Sec, get a good book for each and use it as your primary resource tho. Supplement things you learn in theory in those books with practical on THM. You can search for specific things in 'All Rooms'

[hazy oasis]

Thank you! Mike Meyers Network + Exam guide good?

[orchid ivy]

@velvet spindle @native elm
Would networking knowledge gained from Network+ be enough in order to follow the course for eJPT?

[native elm]

Yea

[stuck rover]

You don't need it though

All you need is in the course

[orchid ivy]

How about networking knowledge for PNPT, eCPPT and OSCP?

[stuck rover]

Again, PNPT gives you all you need to know. The networking knowledge built in eJPT and PNPT is all you need for OSCP and eCPPT

(Although tbh I'd just pick one out of those instead of wasting money. You can cut it down to just PNPT then OSCP if you're that keen on it.)

[hoary wind]

Today i finished the report of eCPTX exam and i can said you that is hard , hard , hard. You need so much advanced knowledge about networking, scripting like c++ , debugging, create own exploit, windows OS e powershell scripting lang. Is crazy and without googling i never passed this exam. But now i got the final flag and i'm so happy

I hope i will pass :S

[languid hearth]

you needed to know c++? I didn't find that even remotely necessary lol.

same with debugging. honestly I found it to be intermediate ad at best

[stark marlin]

let a guy enjoy his achievment

you dont have to say its easy when someone who just gave it said it was super hard for him, It seems like you are devaulting his achievment, it might be super easy for you, but not for others

[stark marlin]

good job my dude, I am sure you will pass

[hoary wind]

I hope

[stark marlin]

gonan give it at some point next year as well, course seems very noice

[hoary wind]

next exam is OSCP

[stark marlin]

ahh damn

you gave it before OSCP

sheeeesh

i got the OSCP some time ago

very good exam with a nice learning curve

[hoary wind]

They advised me to do eCPTX before doing OSCP. Because in the new year he will be AD

[stark marlin]

truee truee, i did it before that

[hoary wind]

eCPTX is only active directory so i done first this and new years i will go for oscp

[stark marlin]

good going mahn, i am sure you will ace OSCP ezpz

[hoary wind]

i hope 🙂

Yes i think is more easier then eCPTX , this exam make me crazy is so hard

i sleeped 4hours for night, and elearning send me continuously message to finish, only 4 days for complete exam + report

it's stressful. 4 days of pure stress

[stark marlin]

hahahahah

ikr

i heard that as well

OSCP is way less intense

[hoary wind]

yep , i waiting my salary ahaha because cost so much then ecptx

xD

400$ against 1300$

i will buy it for Jenuary

[stark marlin]

https://tenor.com/view/it-is-what-it-is-it-is-eet-eet-iz-iz-gif-17896182

it do be hella expensive

i won it in hackahton thats why gave it because optherwise hella expensive

[hoary wind]

omg

how u won it?

so luckyyyyyyyyyyyyyyyyy

[stark marlin]

i won a development hackathon

about devlepiung a cyber security product

after which i got hired in the company and got this voucher for 1000$ Cyber sec certs

https://tenor.com/view/cat-dance-cat-party-gif-18150510

[hoary wind]

Congratulations bro

[stark marlin]

thanks bro

[fleet cypress]

congrats!

[stark marlin]

https://tenor.com/view/the-office-bow-michael-scott-steve-carell-office-gif-14973267

[languid hearth]

here's what you've observed just happened - this person set out to hike a trail and climbed a mountain and by doing so, their goal of hiking the trail became useless. OSCP is an entry level pentesting certification; ecptx, as you should know, is well above that. They've effectively throwing <insert 1k USD equiv in whatever your currency is> away because of how they've done things.

This is something I see far too often. They're at 300-Level OffSec; not 200.

[stark marlin]

it is what it is

Most people do OSCP for clearance

if they do a easier cert for clearance and hr knowledge

i dont see it as a big issue though its very true he is at 300 level

[quick forum]

For... Clearance?

[pseudo creek]

I was guessing they meant HR gate

[stark marlin]

yes i meant to get through hr

[hoary wind]

yup

[oblique vine]

Curiosity on everyones opinion who's taken this exam or both:
If I plan on taking the CEH v11 sometime in the next couple months would it be worth going through the pluralsight training from 2018 (they don't have any course on v11 that I can find) that covers the v10 exam prep?

Only reason I ask is because my work covers a pluralsight subscription so it's a free resource.

[stoic cave]

Are you in India? Outside of India, CEH isn't exactly respected

[oblique vine]

US based

[stoic cave]

Yeah CEH isn't the cert you want

are you trying to fill DOD reqs?

[oblique vine]

Really? Could be the reason why it's not one of the certs I gain from degree lol

I've already gotten (through college) A+, Network+, a few others. Will soon be taking ccna, pentest+, and a few others before I graduate

[stoic cave]

Yeah, CEH would be a waste

[oblique vine]

Gotcha, can I ask why in your opinion?

I stupidly didn't take the Security+ exam through school which is kicking me in the butt now so I may go back and take that soon as well

[stoic cave]

The certs you're already taking cover a majority of the content and job wise CEH isn't respected/accepted as much as it was previously

[oblique vine]

Gotcha ok that makes sense

Any reason to/not to take the pentest+? It is optional and the cert exam itself comes out of pocket (not covered with tuition)

[stoic cave]

Personally? No

Others may disagree

[oblique vine]

So basically where I want to go after graduating?

[stoic cave]

But OSCP is the entry into pentesting

[oblique vine]

oscp is on my exam list that I should be taking in the next year

[stoic cave]

You have to keep in mind, Security isn't entry level

[oblique vine]

Yup, I work as software engineer and a mix of sys/network admin already. I'm transitioning next year into a possible security admin role in the current company

[stoic cave]

Cool

[oblique vine]

Which after a couple years I'd like to transition into a more security consultant type role

Basically taking the free education and seeing where it takes me in 3-4 years 🤣
But don't have a full grasp of the certs I want to take versus the ones that are optional

Security+, oscp, ccna, a few others I want to go out of my way to get. The rest are extras I'm debating are worth it at the moment

[stoic cave]

If you don't want to get into pentesting then I don't think you need oscp

[oblique vine]

It's covered and gets paid for through tuition anyways

[stoic cave]

Gotcha

[oblique vine]

So through the college some cert exams are paid for with the class while others classes are more "exam prep" with the option to pay out of pocket after for the exam

I actually think my school added Linux+ to my lineup recently as well which isn't required for the degree but I think it'd be cool to take that and then see after if I want to take the cert for it

but thank you @stoic cave for the insight 🙂
I'm off to do christmasy stuffs now

[serene umbra]

Gave +1 Rep to @stoic cave

[old crater]

Hey all hope you having a nice day so i was wondering if someone can help me with an advice i haven't decided to go into offensive or defensive yet and at the start I wanted to be a mix of both but then i remembered my nature and i am better at specialising in one thing i know you can't be one without a knowledge of the other but i am talking about specialization in the offensive field or the defensive field. I was wondering if anyone have an advice can tell me the pros and cons of each and what's the big differences between them

[inner elm]

Defense analyst: https://niccs.cisa.gov/workforce-development/cyber-security-workforce-framework/workroles?name=Cyber+Defense+Analyst&id=All

Operator: https://niccs.cisa.gov/workforce-development/cyber-security-workforce-framework/workroles?name=Cyber+Operator&id=All

Overlap of the two: https://niccs.cisa.gov/workforce-development/career-pathway-roadmap

[hard haven]

Where would be the best place to find high school IT internships?

[obsidian zinc]

@hard haven You can google "tech" or "cybersecurity interships" and you'll see posting similar to job postings. Likely the same on linkedin and i'm sure there's sites dedicated to this. You can reach out to a local community college or university and see if they have programs as well.

[hard haven]

Seems like all of them are for people currently enrolled in a university.

[obsidian zinc]

@hard haven I would just reach out to the university and ask about potential opportunities

[main hatch]

Principle information security: appsec:
Check out this job at BNY Mellon: https://www.linkedin.com/jobs/view/2846149564

[hoary wind]

in my country EU is required for job CEH, i've CEH Master at moment

read this, guys ADS of indeed.com

This the best certification for jobs from ADS indeed.com

[inner elm]

I talked with my high school art teacher to create my own class. It was an Independent Study where I managed the schools website and created an art gallery. This was in Web 1.0 days, so your mileage may vary

[stoic cave]

Required != good

I'm going to also bet that a lot of the jobs that require it on LinkedIn are DOD 8570

[hoary wind]

Yes sure! But i'm going to take certification for job necessary

[unkempt lark]

Hey folks!
Need some guidance here:
What are the certifications recommended if: I don't want to transition into cyber security as a career, but maintain high level of security awareness as a software developer?

[stuck rover]

Hrm...take a secure programming course and perhaps dip into a web application pentest course. Learn about binary exploitation but my "advice" should be taken with a grain of salt as I'm not sure myself.

I actually think your best bet is to learn about DevSecOps perhaps

[fleet cypress]

Just sanitize your inputs

[pseudo creek]

for our developers, we are trying to get them all security+ just so they have a base understanding of security

[pseudo creek]

securing software is way more than this

[fleet cypress]

yes

But not trusting your user,customer is the first step of it

[pseudo creek]

not really, assuming that anyone who is able to use your application has good intentions is really the first step

[unkempt lark]

Thanks folks, any certificates you recommend?

[pseudo creek]

its not your user/customer that you have to worry about mostly

[pseudo creek]

Security+ is what I said we are using for our devs

[unkempt lark]

thanks

[serene umbra]

Gave +1 Rep to @pseudo creek

[fleet cypress]

you mean not assuming ig

[pseudo creek]

yes pretty much

[fleet cypress]

anyone who is able to your application goes into user

[pseudo creek]

thats not how we define it

[fleet cypress]

I am sorry, I don't know the formal definitions.

So does that go into guest ?

[pseudo creek]

you have your intended users, then you have the unintended... although you can assume not all your users have the best intentions or even such that they don't need access to everything

hacker, malicious user, malicious person

[fleet cypress]

I see 👍

[pseudo creek]

depends on what we are talking about and to who

[fleet cypress]

For example someone named "><script>alert("thm")</script>

So I should have used malicious user

[stuck rover]

What do you guys think of Trail of Bits? 🤔

[pseudo creek]

don't know anything about it

[stuck rover]

@unkempt lark This might be a good starter but I haven't done it myself.
https://www.youtube.com/watch?v=F5KJVuii0Yw&t=483s

[stuck rover]

Too bad

[unkempt lark]

thanks mate

[serene umbra]

Gave +1 Rep to @stuck rover

[tranquil belfry]

Hello everyone. I'm new to THM and just completed the AoC 3 room. Has anyone managed to successfully submit THM certificates to ISC2 in order to gain CPE credits?

[inner elm]

https://www.reddit.com/r/cissp/comments/j39j58/tryhackme_for_cpe/

first result on google tells me that someone did this

[tranquil belfry]

Thanks. I saw that too, but not much else. Just trying to see if anyone here has done it to get a better consensus. Also curious about rooms (such as Ao3), that don't list an hour value. Wondering if people (successfully) submitted based on the hours they took.

[serene umbra]

Gave +1 Rep to @inner elm

[sour hatch]

As a pentester, how often would social engineering be used? If someone were to be very talented at social engineering (obviously knowing other skills too) would they be able to use primarily people-hacking / physical hacking? as long as it gets the JOB DONE in being able to infiltrate the company.

or would it be where 99% of the time they want you to do everything remotely w.o anything physical / speaking

[stoic cave]

Not really sure what the question is besides the first sentence but I think it would depend on the type of engagements being performed. As with all things it's a skill that needs to be honed

[sour hatch]

I've read somewhere (sorry if it sounds corny), but a former pen-tester was giving an example of how they would actually get through the companies security simply pretending to work there / portraying as a delivery man

i was attempting to ask if stuff like that would ever be an option for the job. Just an example, I dont mean literally doing the exact same 'delivery man' scheme over and over

[stoic cave]

That's textbook social engineering

And it would depend on engagement

[sour hatch]

i used to be VERY good at this kinda stuff in my past when i was a mess (reformed now) which is why i initially became so interested in pentesting

[sour hatch]

ah okay, that makes sense. thanks alot man 😄 i feel kinda silly asking these questions ngl so glad you can assist

[serene umbra]

Gave +1 Rep to @stoic cave

[stoic cave]

Not silly, it's a rather large scope

But that type of work would be associated with a Red Team in the truest form of the definition

Red Team encompasses both cyber security and physical

[sour hatch]

yea, ive heard lots about red team offense. In terms of social engineering i seriously think I could do ALOT

ive been looking into the hak5 tools for example, and honestly it makes it seem way too easy in my head, not sure if im overlooking things

[stoic cave]

It's a lot more difficult in reality

[sour hatch]

well glad to have had this chat with you, defo just made me alil more excited about going down this career path

thanks again brotha

[warm hinge]

Hey @flat sedge hope all is well.

Do you know what certs can help me gain the knowledge to design upgrades to existing security infrastructures ?

[stoic cave]

Cloud, Hybrid, or Standard environment?

[warm hinge]

I would say Hybrid

[stoic cave]

CISSP, GIAC, etc

[warm hinge]

NIIIIIIICEEE xD

[stoic cave]

I believe AWS has a security infrastructure certification

[warm hinge]

I thought CISSP was one of them

[stoic cave]

Or at least a security specialist off their infrastructure cert

But its going to be your higher level certs from anyone

Cybersecurity and Infrastructure Assurance agency probably has a list as well

This seems like a good article as well, sure others will chime in.

https://www.csoonline.com/article/3230154/top-it-security-certifications-for-critical-infrastructure-by-sector.html

That's critical infrastructure which isn't exactly what you were looking for I think but it's a start

[warm hinge]

Man you're awesome 👌 thank you

[serene umbra]

Gave +1 Rep to @stoic cave

[warm hinge]

Oh btw, the reason I asked was because I saw this day-to-day jobs in a job posting I saw 👀

[stoic cave]

Ah so you would be looking specifically for financial requirements

That's pretty tightly regulated

[warm hinge]

What do you mean by financial requirements ?

[stoic cave]

The financial sector is pretty tightly regulated

There is already a lot in place that is required and things you'll need to follow

I can't really speculate more on the specifics for that job without being in the conversation

But if you Google cyber security requirement for financial services you'll see

[warm hinge]

Ah, thank you I'll Google that right now

Sounds a bit intimidating

[stoic cave]

Take all of this with a grain of salt

I know pretty much nothing

[flat sedge]

I would say be familiar with SOC2 compliance requirements as well. Of you are looking to get into financial sector work, knowing ways to implement technical controls for those requirements is a good way to show immediate value

[warm hinge]

Wow I love this. I was just reading up on all the 16 sectors our economy runs off

This is fascinating, I think I want to gear towards communication and information sector

[stoic cave]

Yeah, I kind of want to get into ICS with Petroleum or Energy

There's some good postings right now it looks like

Never heard of this organization before, Southern Company, but they do nuclear energy

[warm hinge]

That's pretty badass. Energy sector is another one that caught my eye

[stoic cave]

Yeah, it's interesting. Also let's you get expertise and experience in areas that are specialized

Oh wtf, they haven't even commissioned the plant yet

Alright, I'm actually going to apply now haha

Don't necessarily have the qualifications but you never know

[inland thunder]

So I have about 10 yrs in IT doing sysadmin/networking stuff. I never worked anywhere big enough to have a dedicated security team, but security was baked into everything I did as an administrator. I got my CS degree and started doing more coding & software engineering for a while but I didn't enjoy it. I'm looking to "get back to my roots" in IT, but specialize in security.

The two roles I've seen that seem to be the most applicable to my background and are interesting to me: network security engineering and vulnerability management/analyst. Does that track?

I guess I see myself doing more analytical work than designing/architecting things. I was always a better editor than writer and I feel that applies here too. I like the process of poking and prodding to find ways of improving, almost like quality control.

I've done a lot of things like deploying firewalls, applying secure configs to network devices, implementing monitoring solutions, adjusting our WAF and responding to incidents (my first ever IR was busting a student trying to download JTR to brute force his buddy's windows' password to prank him 😂), etc. I've also used nessus and nmap over the years to scan our networks for issues. Appsec doesn't interest me as it's too similar to SWE for me and I'm trying to get away from that

[warm hinge]

Do it!! I bet you won't regret 😊

[warm hinge]

which skills are most demanded in cyber career, Management or Practical??

[pseudo creek]

network security engineering is a good solid path. Also security engineers/sustainment engineers seems like what you would be looking at. Security engineer is a broad title though and can almost mean anything but yes, there are absolutely jobs which you describe, I'd start with network security engineer. I would also start looking at getting into cloud, as there is a lot of what you describe in cloud work.

[warm hinge]

That’s actually the path I wanna take

I recently started a job as a network technician, studying now for the CCNA then I want to move onto Network Engineer, then Network Security Engineer

Is there any recommended programming languages for Network Engineering?

[stuck rover]

Python and Bash for automating tasks.

Python for Network Engineers is a great course.

[warm hinge]

Gotcha, thank you! I’ll check it out

[serene umbra]

Gave +1 Rep to @stuck rover

[cyan otter]

Anyone here wanna be an incident responder?

[stoic cave]

Im sure there are people who do. Do you have a question about the position?

[cyan otter]

Yes, I completed the cyber careers quiz at tryhackme and I got Incident Responder, got recommended Jr pentester, pre security and cyber defence paths, I wanted to know if there are some other paths or rooms that can make me achieve that goal.

[pseudo creek]

various skill building will help IR but I recommend looking at DFIR Diva's website https://dfirdiva.com/

[cyan otter]

Thank you so much, Ill bookmark this. 🙏

[serene umbra]

Gave +1 Rep to @pseudo creek

[karmic cypress]

OSCP or OSWE? (For immediate careers prospects)

[pseudo creek]

OSCP

[inner elm]

#cyber-and-careers message

[inland thunder]

Is this going to be feasible in the near term without having a CCNA? I have a network+ that expired in 2014 and am working on the sec+ right now. I got my degree from a cisco networking academy so I'm familiar with R&S, WAN/LAN, etc and have a lot of experience with general network & system admin but no field experience with BGP or what have you

[sly gyro]

You have the practical experience to pass HR filters. Adding a cert just adds to that

[silent imp]

Ccna is only valuable if working with Cisco devices. Core fundamental knowledge for networking is learned from any provider

It's the harder exam so it's seen better by hr.

[hollow citrus]

All these certs are so nice, if only they aren't too damn expensive lol

[silent imp]

That's why comptia rise in value

Accessable and good fundamental

Ccna can be studied without any special shit tho

The documentation is everywhere + Cisco website

Only killer is the exam price

[hollow citrus]

Can't I just show the employer my Advent of Cyber 3 certificate

"you're hired!!!"

wet dream

[silent imp]

look I can cyber thing

[hollow citrus]

I can do the hacking, I do the hacking everyday

[silent imp]

Hack the company with the knowledge you gain and hire yourself

[hollow citrus]

Big brain time

[warm hinge]

Why do you think you're a good fit.

I hacked you, and set up this interview myself.

[ruby parcel]

Hello guys, do you know any good source to study for threat hunting? Also which are the actual responsibilities of a threat hunter? I think it isnt that much clear 😋

[quick forum]

CCNA is often liked for pentesting positions due to the sheer quantities of Cisco stuff out there. CCNA teaches the fundamentals too.

[silent imp]

ofc but its also expensive

and if your just starting out its hard to go that route

[solar saffron]

just anyone could suggest me some of the top universities to study cybersecurity / ethical hacking . if any ? will be helpful

[quick forum]

Country?

[solar saffron]

canada

or even germany

u can consider

cuz i couldnt get any results

[silent imp]

cos traditional education sucks

[solar saffron]

yup

[silent imp]

you arent suddenly hireable because you did a bachelor in cyber security

youll still require certs to prove you can do things

[solar saffron]

yup

but the thing is i want suggestions

[silent imp]

better is to do a cs focus

so you get compfundamentals

and learn to code abit

[solar saffron]

so could u suggest me some universities

[austere drum]

What about masters in cybersec?

[silent imp]

idk, its literally any university yo uwanna go to lol

[solar saffron]

can but

[austere drum]

If you have a bachelor in cs

[solar saffron]

like cs is ok

but much focused on cybertsecurity

[silent imp]

you are better off doing cs and then cyber stuff outside of uni

[austere drum]

@solar saffron if you are looking for a bachelor in cs/informatics etc better check the curriculum

[silent imp]

dont just join uni cos they added the cyber buzz word

[solar saffron]

oki

[silent imp]

99% of them arent preparing you for the real world

and you wont get a job from having it

[solar saffron]

oki

[austere drum]

I agree with that

Too much theory

[solar saffron]

thanks for helping guys

[pseudo creek]

It depends on the employer, certifications can mean a lot but if you can show your knowledge, then sure

[silent imp]

proven history in networking/sys admin already sets you up really well to prove you got good understanding of networking

[pseudo creek]

I wouldn’t say sys admins automatically have a good understanding of networking, certifications can sometimes mean the difference between getting an interview and not. But during an interview is when I’d expect experience to be able to show knowledge and understanding

[silent imp]

well they said never worked in a big place

so im guessing SME

which usually you required to do more than just the basic stuff

[pseudo creek]

I was talking in generalities

[fast timber]

just to name a few with very good tutors and profs: Ruhr Universität Bochum, Friedrich Alexander Universität Erlangen, Hochschule Offenburg
and (at least in Germany) you can get a job if you finished with a B.Sc or M.Sc

[mystic geyser]

any remote jobs in pentesting?

[ebon mica]

Yes, there are. I don't have open positions to list.

[pseudo creek]

it depends on where you are located, generally remote jobs in pentesting/cyber require you to be located within a certain country/region and sometimes timezone.

[mystic geyser]

I guess mauritius does not fall into the list

😦

i am really looking forward to start as a pentester

[stuck rover]

Look out for fully remote companies

[feral grove]

What's the best entry job for someone that have just transitioned into CySec. My previous career had me in Government work, but I have a degree in cybersecurity technology and Sec+ certification.

[warm hinge]

cool, envy you that! i have tones of writing, researching and marketing experience, running projects and did economics cyberneticts + IoT at uni, always working during that!

[feral grove]

That's incredible, are you currently in a security role? If so, do you have any advice for someone trying to break in?

[warm hinge]

nah, not a really real cyber sec job, i am just starting as an independent writer with online publisher in my country, but it more of the writing experience, i am much more on the educating and research side + have some education projects it mind! but i help my friend who work on ZTA with daily tasks so I am learning back the skills i miss kinda at uni, but been using computer ever since, having fun with my geek brother who's good at it!

[warm hinge]

i mean you have propper background, just dig a bit and find your way into it, cant do it if wont really wanna do that one start, it makes no sense 🙂

[pseudo creek]

there are a ton of Gov work for cyber people, Cybersecurity Analyst/SOC analyst are generally entry level jobs, GRC jobs (which may have a cybersecurity analyst title) are also great for those that understand gov stuff

[warm hinge]

out of curiousity, where are you at rn? are you actually out of college rn and working full time?

[feral grove]

That's great advice and I will definitely concentrate my searches with those in mind. Thanks a bunch

[serene umbra]

Gave +1 Rep to @pseudo creek

[feral grove]

That's definitely a real security job because research and technical writing is all apart of it and I appreciate the chat. That's how it all starts though with a passion.

[warm hinge]

Well, yeah, I find this ffeld veeeery important, espcecially with tech & science whirl happening now! it crazy what we can get when all the new shit starts working at more mature level, either we will more of design that or thats gonna be a wild ride for a while I guess! open discussion and knowing about this cyber world should be something normal people can know and trust, i guess, but with the crazy politics now, and covid, energy crisis and so much of coming changes ...

[feral grove]

That is very true. With IoT, Cloud, and connected systems basically running the world, we must begin shifting our learning and focus to the things that matter. Cyber is definitely the future.

[warm hinge]

yeah, just add to that qunatumn, AI, lack of visibal credentials and certifications that we should be able to see even now, IIoT, local makers and digital voting, curriences and tones of data flying by even more and tonesmore and more, maybe we should just shadow all of that, i really dont wanna have my all deviecs data and choices being in the constant up-flow circuling in the economy and world that is coming, coming! 😄 not to mention that hugh gap that is between users at different level of knowledge, skills and basic human integrity or sense of resonsiblity seeing that as some magic "Internet" or a tool they just use to click and write staff...

[cyan otter]

Hi guys, Im just getting started in cyber security and I want to take the OSCP exam this year or the next, do you guys have some advice for me?

[ivory nest]

Try Harder

[cyan otter]

What do you mean? Do you mean that I have alot to study or am I to early?

[static tide]

that's just offensive security's motto

[cyan otter]

I see, but I really needed an advice. I understand if you see me as a beginner and not worth of your time tho

[static tide]

no no not at all

we aim to help everyone here :)

[paper lily]

err learn how to research well

the rest will come with time

if you can learn how to effectively google things for yourself it'll take you a long way, and not just specifically in infosec

[static tide]

i have yet to pass oscp too, but my advice is to use all resources available, tryhackme, hackthebox, virtualhackinglabs, don't let anyone tell you "one platform is better than the rest"

[warm hinge]

@cyan otter if u are just getting started, i would not recommend even thinking about oscp until like 6 months in. Start building knowledge, methodologies and so on and then explore that space of offensive certs

[paper lily]

there's many guides people have written out there

but I wouldn't jump straight in certification hunting

just take your time developing foundations and getting experience before you go for it, unless you want to get a job asap 🤷

[cyan otter]

I completely understand all of you and thank you all for your advices. I asked because before you take the OSCP exam you take the PEN200 course, am I right? And it says that it makes you fit for the OSCP exam or isnt just the PEN200 enough for that?

[cyan otter]

I honestly wish you the best of luck! And I dont let people tell me that because each platform has something unique to offer

[ivory nest]

you asked a very generic open ended question, with no real 1 answer

[cyan otter]

I wanted to thank you guys again for your time and advices!!!!

[ivory nest]

unless someone really feels in the mood to talk about their personal journey, you're not going to get much from something like that, try to refine your questions, ask specific things

[warm hinge]

@cyan otter if anything learn windows, linux, networking and web fundamentals

Then explore and practice

[paper lily]

https://github.com/DFIRmadness/5pillars/blob/master/5-Pillars.md

[cyan otter]

Will do that! Thank you! 🙏

[serene umbra]

Gave +1 Rep to @elfin tendon

[cyan otter]

I didnt ask no one for their personal journey but just for their advice to start mine. Sorry if I misunderstood you.

[cyan otter]

Ill bookmark this, thank you! 🙏

[ivory nest]

that's the point, no one can tell you how to start your own journey, so the answer you're most likely going to get is how people started themselves, I can tell you that I started cyber security with security+ cert and then cybrary, but that would be how I started, not an answer to how you should start yours

[cyan otter]

You just gave me your advice right now lol :p

[ivory nest]

the very first place I went to when I got interested in cyber security was offsec's old irc chat, and there I learned that they don't really give the time of day for questions that don't seem like any work was put into finding the answer

"Try Harder" was a common answer

[cyan otter]

I understand you and thank you for yout time! I just wanted to know if I was too early or not and if just the PEN200 is enough preparation for the OSCP exam

[static tide]

it technically is, but it's always best to supplement your learning from elsewhere

[cyan otter]

Thank you, Ill keep that in mind 🙏

[serene umbra]

Gave +1 Rep to @static tide

[mighty tundra]

@cyan otter I'd download the PEN200 syllabus for an overview of what you'll be expected to learn. Then, start filling in those gaps in learning. I wouldn't sign up for the PEN-200 course until I knew for sure that I had the time to make full use of the lab access. I'd actually use my membership here to follow the rooms and modules that align with the PEN-200 syllabus and then, when I know I'll be able to make use of the Offsec labs, sign up.

[ivory nest]

do you have generic IT experience?

[mighty tundra]

What I'm loving about THM is something I just realized during the AOC, is that the platform motivates me to put in some training a little bit each day.

[cyan otter]

Thank you, very detailed answer and this is what I thought also 🙏

[ivory nest]

motivation is a fun thing

seeing my level climb, and the streak go up are indeed good motivators

[cyan otter]

Im in my senior year of computer science in university

[mighty tundra]

Yeah, this site really gamifies that in a way that engages me. I'm a defender, so I don't have as much experience on the "red" side that I'd like. THM makes this very approachable, IMHO

[cyan otter]

I have my eyes on the 365 days hacking streak

[ivory nest]

I'm not even at 30 days and I had to already ask someone to give my streak back to me, 365 is going to be a challenge

[mighty tundra]

Make sure you take some "spa" time, though, @cyan otter . Self-care is important. This is a fun year earning my keep between working Thanksgiving and then the log4j fun, lolol.

[cyan otter]

I dont really take any days off

[ivory nest]

it's less about taking days off, and more about being so busy I forgot about thm completely on christmas day lol

[teal lion]

Anyone here have done an interview for any cyber security degree apprenticeships? (UK)
Ping me pls

[cyan otter]

Yes I always find time for self-care as its most important to do so but I also dont take any days off because I see myself pretty much behind of all of you

[cyan otter]

I was doing AoC3 even on my birthday, Christmas is nothing for me lol :p

[ivory nest]

I have a cruise this weekend, I'm debating between begging to keep my streak again, or paying a rediculous amount for ship-wifi just to do the minimum for streak

[frank crane]

A repost from General, Would you spend 6 years getting a bachelors or spend 6 years self study/certs for a Network Admin/ Cyber Security job?

[cyan otter]

Connect to your laptop via RDP and keep the streak from the cruise lol :p

[ivory nest]

I'd spend 6 years getting a bachelors and studying for certs in between classes

[ivory nest]

the problem is wifi isn't free on the cruise, it's actually very expensive

[cyan otter]

You really have it tough in this situation fr

How long is the cruise?

[mighty tundra]

What do you want to be when you grow up? What degree are/were you considering? Are you already enrolled?

[warm hinge]

@frank crane depends if u want to go the gov route or not and if u have a stable enough income to carry urself those 6 years while woking

[ivory nest]

3 day cruise, and you pay by the MB used

[frank crane]

I do front end dev now. Have a few certs, Trying to get into cyber security but employers want more experience as network admin or degree

[cyan otter]

Well if you go on that cruise you cant keep the streak, unless a friend sends you MB

[cyan otter]

Have them pay for it

[pseudo creek]

don't worry about breaking a streak... you can restart it

[ivory nest]

if you have the knowledge to back it up, lie about your experience

[pseudo creek]

although a cruise right now seems like a really really bad idea

[ivory nest]

but I want 365555555

[cyan otter]

A man of culture

[cyan otter]

Purple flame goes brrrrrrrrrr

[frank crane]

Yeah well a computer science degree isnt gonna teach much about cyber security tbh

[ivory nest]

I meant more learning it yourself

[cyan otter]

We on the same boat

[pseudo creek]

computer science degree teaches you the foundation for cyber

[mighty tundra]

The curriculum should include computer architecture which is vital to infosec, though.

[frank crane]

yeah I know what you ment.

[cyan otter]

@pseudo creek is right tho

[ivory nest]

I grossly embellished my experience for the last two jobs I got, and I'm doing fine, as long as you know you can back it up

[frank crane]

foundation is great don't me wrong

[pseudo creek]

I mean in reality a bachelors degree isn't meant to prepare you for a job after college...

[frank crane]

...

[pseudo creek]

so you have to supplement yourself, add in a couple certs, get some IT experience through internship / part time job

[frank crane]

prepares you for a 30+k plus student loans

[ivory nest]

hey, that's not fair. it's pretty good at preparing you for a job if you go into research

[pseudo creek]

that is academia, which you would need further school for

but I'd say a bachelor's degree doesn't teach you for a job in research either

[mighty tundra]

if it helps, my company doesn't require degrees, just that the candidate knows their stuff

[cyan otter]

Sheeeeeeeeesh, dm me the company bro

[frank crane]

I heard of guys starting at help desk and moving all the way up through network admin to specialized security roles/cloud security

[ivory nest]

I feel like my research job was pretty much like a class, just you don't have a textbook

[mighty tundra]

Well, that's just for my group...If you're applying to be an accountant, well that's another story

[ivory nest]

and instead of exams you have progress reports

[pseudo creek]

you could do that although sometimes you will encounter prejudice / bias without a degree

[frank crane]

Agreed

[mighty tundra]

@frank crane that does happen quite often, especially with companies that promote from within

[cyan otter]

Im aspire to be an Incident Responder so maybe they dont care about my degree?

[mighty tundra]

no, just that you have the skills to back it up. 😄

IR is semi customer facing though, so you need good soft skills

[cyan otter]

Can you share with me the company name or am I asking too much?

[mighty tundra]

too much, sorry

there's lots of them, though, so don't be discouraged

[cyan otter]

😭

Sorry if I made you feel uncomfortable

We good?

[mighty tundra]

totally

[cyan otter]

Ok thats good cause you look like a nice guy, didnt want any bad blood between us

[mighty tundra]

no worries, i'm insanely introverted, but like helping when and where i can

[cyan otter]

I have you beat about being introverted

I dont speak on the phone even with food delivery

let alone other people 💀

[rose peak]

I wonder if people in cybersecurity care about the legal aspect of it all or just about security itself.

[cyan otter]

And when I go to order food in person I practice the order 500 times in my head before I speak and it turns out in hexadecimal

[ivory nest]

legality will always be a factor, just depends how big the security team is and what your role is, but there will always be some sort of aspect.

[rose peak]

I'm a law student writing a thesis about cybersecurity in public administration and I usually feel like a lot of things are done just for a sake of being "in compliance with the law" and not really secure by the set standards.

[mighty tundra]

Ahhh, yes, we call those "check-boxes".

[ivory nest]

it depends on the country, US is big on that

[mighty tundra]

Got my IDS/IPS deployed. Oh, we're supposed to tune those?!?!?! Whooops...

[rose peak]

I'm in EU and defense and healthcare is "big on that", otherwise is just a noise in the background. I probably use "checkboxes" somewhere in the thesis, thanks for the inspiration 😄

[serene umbra]

Gave +1 Rep to @ivory nest

[ivory nest]

some countries maintain a minimum level of compliance where you really get to avoid fault for many security incidences if you meet it, while other countries don't really force a minimum compliance, but your responsible for what happens to your systems no matter what

[frank crane]

My countries has low legal requirements for data compliance

[ivory nest]

Interesting, I thought EU was really big on leaving it up to the companies

[rose peak]

It was, until recently

[frank crane]

GDPR for EU

[rose peak]

Now we are getting new EU regulation, and countries are more focused to setting very specific requirements for any company that works with any government data

[ivory nest]

well privacy is an aspect of security, but not really the same thing in this topic

I guess the controls that secure privacy is part of this

[quick forum]

I'll say something that made a lot of stuff click for me. "Security is not a revenue generating area".
Security is about reducing losses, mostly. Compliance is part of that.

[rose peak]

I think that forcing companies to use specific technology might not be the most secure idea, compatible, but not secure.

[quick forum]

A valid response to a risk is "Ok, we'll accept it, and put money aside"

[ivory nest]

regulation is good on stopping a very predictable set of incidents, makes it less likely that someone forgets a stupid setting and an old, basic attack is used to steal data, but terrible at stopping anything new/complicated

[quick forum]

Everyone uses AES-256. What's insecure about that?

What's the issue with uniformity?

[flat sedge]

I cannot emphasize how right this is.

[quick forum]

I'm actually curious why you think this

[ivory nest]

I dunno about immediately less secure, but I think it's a bit stifling. Better implementations, solutions, and ideas can come out of companies having to do their own thing, to what degree I have no idea

[rose peak]

For some reason, I can't find the new requirements of the Czech national cybersecurity center. It wasn't only about encryption, it was an extremely detailed set of rules that had to be applied before starting to work with government data. In my opinion, the regulation should focus on best practices in case any of the required technology has any security deficiency. Extremely specific regulation does create way to narrow focus on specific things and limit ability of entities to defend itself

[ivory nest]

then again, US is huge on compliance, but we have companies like Google who constantly create their own tools for things instead of just using whatever is the standard, so maybe cheap/lazy teams will always be cheap/lazy and those who want to push the boundaries will do so as well

[quick forum]

But it's government data. Isn't it on them to regulate how they want it used?

Also, are they setting out exact tooling required, or are they just recommending things that are compliant?

If you're not willing to operate under those terms, they'll find someone who is. They get to set their own rules for doing business with them.

[ivory nest]

I think you're talking reality, while matotu is talking ideals here

sure, the government gets to dictate how their data is used, doesn't mean whatever they decide is the best option

data is used/secured

[rose peak]

Government data surely should be under the regulation of government, but it should also be on companies to have freedom about the technologies they want to use.

Otherwise it might cause discrimination in certain ways

[quick forum]

I disagree fundamentally. It's a business decision, a clause in a contract.

[rose peak]

GDPR is for example built on "best practice" and not specifics

[quick forum]

They can mandate AES-256 disk encryption etc

[rose peak]

256bit encryption I get, but what might be the reasoning to specifically mandate the use of Camellia for example?

[flat sedge]

Camelia is considered to be not feasible to brute force. Everything is eventually breakable, the question is 'what is the estimated time using X hardware'

[quick forum]

The question is, where are you seeing that?
What's the bet that's a guideline that gives examples of how to be compliant with policy?

Also I have never heard of camellia and can't find enough about it to speak for it's security

[flat sedge]

It could be a regulatory or compliance standard - that's totally normal to sometimes demand specifics.

Camelia is included in OpenSSL, and from what I can find, it is accepted for ISO and IEC certifications.

[quick forum]

https://en.wikipedia.org/wiki/Camellia_(cipher) This?
It's considered secure. What's the issue?

It's said to be comparable in strength etc to AES.

[flat sedge]

That's the one that I found for it

[silent imp]

I was working as sys admin at SME msp, studied network security. Now currently at coding school and getting official certs for work in appsecurity /exploit dev.

[red coral]

What would be a good "first cert" to go for pertaining to penetration testing and ethical hacking? It seems like there's a mountain of "certifiers" and certs to go along with them. Initially I'd think to target to OSCP as a "baby's first cert" into pentesting, but would it be worth it to get stuff like the eJPT or CEH certs first?

Especially looking at a chart like this for what's available out there, makes me scratch my head: https://pauljerimy.com/security-certification-roadmap/

[gilded grotto]

That's a lot of certs 🤯 I only have OSCP, did it last year as a start into security. But still not sure if I should keep developing iOS apps or move into the security field professionally 🤷‍♂️ We'll see 😊

[red coral]

At the very least if you keep with development, you've got a good idea about what people look for to screw with what it is you're making, so that's useful I figure.

[edgy tiger]

Dont use that chart it is not accurate at all.

[red coral]

More using it as a reference to see what's out there. Some certs I've never even heard of are on that list. Not particularly sure what's a good cert for one's dollar to begin with.

[edgy tiger]

For pentesting? Ejpt > OSCP > CRTO > OSEP ?

I am doing OSWE now, which is more of a whitebox/code review course

[red coral]

Those 4 are the main path and then everything else is more or less additional or specialization kind of stuff?

[smoky slate]

you don't need any certs. just leave your business card on the servers of all the places you want to work

[red coral]

[fleet cypress]

blackhat joke

not nice

[red coral]

I feel like that's more Greyhat.

[warm hinge]

yeah, grey ineed, less regulated still legal just bypassing some steps or small rules

rules can change 🙂

[red coral]

I do not condone nor endorce anything slightly darker than neon whitehat. That's my official statement and I'm sticking to it.

[quick forum]

Not legal. Unauthorized access to a computer system.

[warm hinge]

i am just taking more about the greyzones that exists anyway, but taking about whta's set then yeah, white is that!

[quasi hatch]

QQ, what is a good starting point for certs?

Sec+/PenTest+?

[pseudo creek]

Sec+ is a pretty solid start or even Net+

[quasi hatch]

Would it be a waste to go for both? Sec+ would line up better with what I want to do, but I could probably just pass Net+ if I took the exam

[flat sedge]

If you have work experience or a B.Sc, you can skip some of the entry level certs, depending on your coursework and other practical, personal projects. Sec+ is a very common starting point for security though

[quasi hatch]

I have about 4-5 years of network administration experience

[flat sedge]

Net+ would be a waste, unless it's a checkbox to get the interview

[pseudo creek]

oh yeah I wouldn't do Net+ then

[quasi hatch]

I'll probably go for Sec+

[flat sedge]

Are you looking to get into a specific sector?

[quasi hatch]

Right now I'm not 100% sure where I want to go. I have some connections I could pull on in healthcare, but I'm pretty sure I don't want to have anything to do with hospital security.

[flat sedge]

The good thing about healthcare security, from anecdotal sources: anything you do is an improvement over what they do now

[quasi hatch]

I've done some small contracting work for one of the hospitals in the area

windows xp everywhere

and outdated software because "it works"

I've made sure their network is as good as it can be, but god help them if anyone has physical access to anything

[flat sedge]

Getting healthcare people to understand why that's bad is a tough battle. That will be 99% talking and building bridges and trust before any changes can be made

[quasi hatch]

the problem is the IT budget is practically non-existent

[flat sedge]

Culture will have to change, and the NP, RN and MDs will see it all as damaging to them providing healthcare

[quasi hatch]

they have no problem getting a high-end x-ray, but a switch from this decade is a tough negotiation

[flat sedge]

Keeping track of all the HIPAA violations could be a great way to see that budget get allocated. But likely, it'll be a regulatory penalty that forces the updates.

[oblique vine]

Not to mention the 80s and 90s software that runs the whole thing that doesn't get actively updated very often 🤣 I was a dev for a Healthcare facility for over a year... I can vouch for the dev side lol

[quasi hatch]

oh god don't even get me started

the "but it still works" mentality is strong in healthcare

[oblique vine]

Very lol

[quasi hatch]

Is the study guide for Sec+ worth having?

Would it cover anything not in any of the THM paths?

[pseudo creek]

people say just to follow Professor Messer's videos

[quasi hatch]

Found them, those look great thanks

[warm hinge]

Is the Pentest+ cert valuable or should I just save money for OSCP instead?

[languid hearth]

its good in the sense that it teaches and tests you on some management portions that the OSCP doesn't teach you on. But I wouldn't hold it to as high of a regard as I do OSCP.

If you want to do gov work in the future, it'll be useful. Probably.

[warm hinge]

Thanks. I'll probably just start saving for OSCP then consider other certifications afterwards

[languid hearth]

I'll tell you I really enjoyed this book - https://www.amazon.com/GPEN-Certified-Penetration-Tester-Guide/dp/1260456749

significantly better than Pentest+ study guides and has overlap w/ OSCP domains

[warm hinge]

Have you passed OSCP?

[languid hearth]

yep

[warm hinge]

When did you do it?

[languid hearth]

2019 or so

[warm hinge]

Cool. I'll probably end up doing it in late 2022

[rose quartz]

Where do the GIAC certs line up in comparison to other industry certs?

[mighty tundra]

They're pretty sought-after, though, I don't know of any of them that have a challenge style exam. They're open book, but given the time limit, you can't just turn page after page through 5 or so bound books, so making a solid index is a must.

I've only earned GCIH and GNFA, and for what it's worth, I only sat those classes because my company paid for them.

[rose quartz]

Thanks! That does seem to be the kicker, because that price is something else.

[serene umbra]

Gave +1 Rep to @mighty tundra

[mighty tundra]

Don't get me wrong, the classes are loaded with info, but yeah, that cost is a huge barrier for those without reimbursement benefits at work

My company won't even pay the $400 or so to re-up for the cert after the three years, so I just let both lapse, lol Edit: fixed my damned grammar.

[flat sedge]

Certs like that are super useful to hang on to if you expect to have similar roles in the future - I would have paid out of pocket and told the company that they aren't allowed to use them for sales or metrics or anything else

[mighty tundra]

@flat sedge That's a good idea. I've never heard of telling the employer something like that.

I've been fortunate to be with my current employer since 2006, so I don't know what it's like to negotiate new terms.

[flat sedge]

I think at a certain point, orgs don't want to pay for that stuff, knowing that they can kind of hold you hostage with the goal of not paying raises or promotions. Average tenure across IT as a whole is something like 2.5 years.

[mighty tundra]

That makes sense to me, especially when I was starting out. 4 years was a long tenure for me.

[rose quartz]

My employer reimbursed me the $749 for the CISSP exam, so maybe they'd do the GCIH ($849) if I didn't ask for the SANS training...

[flat sedge]

It's really easy to fall into that routine of stability; my mindset is that if my employer doesn't allow me to grow and learn new things, it's time to move on

[mighty tundra]

I agree. My work is very engaging and they do provide good training avenues. I'm very very lucky

[flat sedge]

Part of that learning new things are things like certifications that add credibilty to my role and task outputs

[rose quartz]

Oh, nevermind, the GCIH is $2,499 if you don't have the SANS training.

That's a bit of a different beast...

[mighty tundra]

Yeah, that's one thing I love about platforms like this. There are lots of things I don't use everyday in the job, so getting a taste of that at an affordable price makes all the difference to me, especially knowing I'll likely see that in future CTF's and certs like OSCP or the newer one from The Cyber Mentor.

Holy run-on sentences. Apologies, y'all...

[rose quartz]

Haha no worries, I followed

[mighty tundra]

That actually reminds me. I took GCIH back when it was John Strand teaching, and his Black Hills Information Security (I think?) has affordable training as well. Some of the courses are "Pay-what-you-can" so that's a nice gesture, IMHO.

I guess that's the constant cost-benefit analysis we play in our careers 😄

[rose quartz]

Ahh, looks like they branched off from Black Hills: https://www.antisyphontraining.com/

[mighty tundra]

Ahhh, that's the one!

[rose quartz]

This looks like a good resource, thanks!

[stuck rover]

Sister company/under a different name. They're still owned by it

[rose quartz]

Ah okay :)

[warm hinge]

Does anyone know or can recommend soc analyst certifications for beginners 😄

[flat sedge]

Splunk has a free cert

It's not the most common, but it shows interest and a basic understanding of what a SIEM does

[patent lily]

Hello what are good things to research for going in this direction? I have heard master basics first? Like TCP/IP, different OS's

[warm hinge]

Mind providing a link? Thanks ❤️

[serene umbra]

Gave +1 Rep to @flat sedge

[patent lily]

Any good sites or books or topics to make sure to research? while practising on the side?

[faint ice]

https://www.amazon.com/Complete-Guide-Felling-Woodcutting-Methods/dp/0615338798

[warm hinge]

haha 😄

[patent lily]

lol

[faint ice]

one of the better books on how to teach a uncommon topic

[warm hinge]

he didn't specify anything, i guess he meant for soc analysts 😄

[patent lily]

howd u know i wanted to be a lumber jack when i grow up

but i was talking about pentesting mainly lol

[flat sedge]

https://www.splunk.com/en_us/training/free-courses/overview.html

[faint ice]

that book is even more fun when you realise how old it is

[patent lily]

Im a noob only done a couple beginner HTB but still kinda struggle w those

[faint ice]

but still relevant and working

[warm hinge]

Thank you, juun 😗

@flat sedge Your thoughts on security blue team training (https://securityblue.team/training/) and certs?

[flat sedge]

Unknown, haven't looked at it

[warm hinge]

@flat sedge Fair enough. What else can you recommend from certifications, regarding soc analyst position (beginner certs)? Thanks.

[serene umbra]

Gave +1 Rep to @flat sedge

[flat sedge]

SOC Analyst 1 is entry level blue team, in my opinion. Should know about system logging and aggregation, having some kind of experience with a SIEM is a big plus. @ancient prairie You are currently closer to this world than I am, any thoughts?

[warm hinge]

@flat sedge Nice.

Would be awesome to hear what @ancient prairie or others have to say about it. Thanks @flat sedge

[serene umbra]

Gave +1 Rep to @ancient prairie

[languid hearth]

content looks very good - doubt that the certification is overly well known. Finding certifications with generic names on job sites is difficult :(

[mild badger]

what's different between bug bounty & pentester ?

[rigid mantle]

I’m looking to hire a threat detection engineer, if I wanted to post the job request in the jobs board, how can I do that since it’s read only? Do I need to coordinate with someone from TryHackMe for this server?

[rigid mantle]

Both are security researchers but one is contracted with the target company under specific guidelines, strategy, and initiative over the duration of the engagement. Bug Bounty is freelance penetration testing against target companies under their terms and agreement to identify vulnerabilities, exploit them, and report in good faith in return for a bounty or “reward” which could have some monetary value.

[undone shore]

Bug bounty is freelance -- like bounty hunting in the wild-west. You track down bugs according to a scope and then (hopefully) get paid.
Pentesting is contracted -- like being a police officer as opposed to a vigilante bounty hunter

[undone shore]

Drop me an email from a corporate account with a link to the job posting and preferably a summary 🙂
I can either give you the recruiter role so you can post it (and others) yourself, or just post it myself, depending on what suits better

[rigid mantle]

Thanks will do 🙂

[mild badger]

what langage need to learn for bug bounty - (like javascript & python c++) ?
php & mysql ??

[undone shore]

Just realised you may need the email address 😆
[e-mail] 🙂

[rigid mantle]

Was just about to DM with that question haha

[mild badger]

what room should learn for bug bounty ?

[warm hinge]

does anyone blog about their findings?

[pseudo creek]

the web rooms would be what you'd want including the web fundamentals path

also #bug-bounty is a channel for that as it really isn't considered career related

[ancient prairie]

the cert has a little traction in some blue team circles but its generally not well-known, if you are trying to break into a SOC position you fare much better grabbing a few Splunk certs and Security+

[warm hinge]

Thanks, mate!

[serene umbra]

Gave +1 Rep to @ancient prairie

[frigid nymph]

[inland zephyr]

I have always had some sort of an interest in health care. I started to read online about health care IT and specifically HIPAA compliance. This seems like something that I would be interested in as a career.
Does someone have a nice overview of how to get into compliance?
I have previous work experience in health care informatics but nothing security related. I have a Bachelor's degree in Computing Science and going back to school for a Master's in Computer Science in January. I am putting together the courses that I would like to take.

Introduction to Graduate Algorithms
Machine Learning

Deep Learning
Data and Visual Analytics
Big Data for Health

Software Development Process
Software Architecture and Design
Software Analysis
~ Health Informatics
https://omscs.gatech.edu/sites/default/files/documents/course_page_docs/syllabi/cs_6440_sample_syllabus.pdf
~ Introduction to Information Security
https://omscs.gatech.edu/cs-6035-introduction-to-information-security

~ Information Security Policies
https://omscs.gatech.edu/pubp-6725-information-security-policies
https://omscs.gatech.edu/sites/default/files/documents/course_page_docs/syllabi/pubp_6725_syllabus_and_schedule_2021-3.pdf

I will be swapping one of the Software * courses for Information Security Policies, not sure which one yet.
Is this a step in the right direction? They have more security-related courses but those are mostly focused on red team or malware analysis.
I have put links to the course pages (or the syllabus if available) of the courses that are probably most relevant.
I understand the second part of my message is a bit more loaded but I appreciate any input.

[paper grove]

The BTL1 cert has only been around since about early 2020. It's growing traction, but can't say how fast. The training and cert has gotten some good reviews from security professionals.

At this point in time, it's pitched at being an entry level cert to help get hands-on experience and certified, but probably has more use after you land a first job. I'm 2 months into my first cybersec job and currently going through their intro courses and I like them. I'm planning to eventually take BTL1 to help grow my knowledge and experience.

[warm hinge]

For people asking about bug bounty training, this is the best source to get practical know-how of bug bounty! i find these very helpful
https://www.stokfredrik.com/bugbountytraining
https://www.youtube.com/watch?v=CU9Iafc-Igs

[pseudo creek]

(would still recommend #bug-bounty vs this channel)

[oblique vine]

Any advice on taking the sec+ cert exam?
I took a cert prep class almost 2 years ago (through college) but didn't take the exam. Now I'm gonna go through a pluralsight just to refresh the info. Would like to take the cert by the end of next month

[mighty tundra]

Sounds like you have a solid plan already. Knock it out, @oblique vine ! 😄

[oblique vine]

lol any advice for the exam itself though? 🤣

[ocean mauve]

I would recommend doing Jason Dion's practice exams on Udemy. They're very similar to the actual test.

[oblique vine]

Oh nice. I was looking for practice exams 🙂

[inland zephyr]

Jason Dion is great. Highly recommend.

[tropic urchin]

@pseudo creek wouldnt bug bounty be considerd grey hat hacking? And in some countries illegal. Since you dont have a legal document to actually preform these tests on their company?

This is my personal opinion but it does seem as something that would be considerd illegal

[ebon mica]

As long as you follow the terms of the bounty program, you should be fine, in general. Cannot comment on local regulations, though.

[tropic urchin]

Ah now i understand. The company has a page(or some form of bounty) and allows people to do this as long as they follow guidelines.

Am i understanding this correctly

[ebon mica]

Yes.

[tropic urchin]

Thx. My bad the. Misunderstood

Missunderstood*

[velvet spindle]

"Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy."

That's a common disclaimer for bug bounty programs

[pseudo creek]

glad it was cleared up for you... bug bounty is basically free pentesting for companies with the option that they throw you some money if you are the first one to find something that they deem significant enough

[flat sedge]

So long as the bug bounty is being done in an ethical way and being reported through correct channels, it's not a grey area. Independently doing it then going to the company to say 'so I found a thing....' is a lot more shady than following company bug reporting/bounty procedure and policy.

[warm hinge]

That's great to hear mate. Congrats on your first cybersec job, cheers! I'm planning to take their BTL1 during 2022 🙂

[inner elm]

I saw a post with a bunch of examples for entry level jobs over on LinkedIn. It seemed to address a lot of questions that pop up in here
https://www.linkedin.com/posts/naomi-buckwalter_entry-level-cybersecurity-job-posts-found-activity-6880897181641957376-g3sy

[inner elm]

For example

[paper grove]

Yeah, there are some jobs out there like that that exist. Not all entry level cyber jobs list CISSP or 5 years experience. But they tend to be harder to find

[zenith needle]

hiiiii

[jolly juniper]

Hey mates. I was wondering, are the certs of completion from THM worth to put on your resume if you are new to the cyber industry(like me)?

For example from the learning paths

[pseudo creek]

I would put in a self learning section on your resume and list there, but not as a certification

[jolly juniper]

Cool, didn’t think of that, thanks

[stoic cave]

As zojja said, I wouldn't put it in an experience section. It's an extracurricular activity so putting it in an extracurricular category or a projects section is the way to go about it

[warm hinge]

Hey guys, has anyone had any experience with Udacity for cybersecurity qualifications?

https://www.udacity.com/course/security-analyst-nanodegree--nd324

I am considering affordable options to supplement my cyber security studies with some kind of qualification which might help me get into the industry.

[stoic cave]

I personally have never heard of them

[flat sedge]

Training on Udacity is a bit hit or miss, just do the the nature of almost anyone can upload content. I also get a lot more out of reading study guides than video content, though.

[warm hinge]

Yeah, I don't feel like i'm lacking educational materials in general, but I was thinking more along the lines of having a qualification to show an employer

[flat sedge]

When I plan to take a cert, I don't take them unless I can get my employer to sign off on it (as its 100% for work) and I can demonstrate value in either my current or next job. If you are actively looking for work, look up the certs that are on the reqs for the jobs you are interested. Getting random certs that your potential employers don't recognize isn't a good way to launch your career

[warm hinge]

Good points, thanks for your input. Trying to reduce the scope for potentially wasting time/money on certs! OSCP does seem to be the way to go for the majority of employers in that case

[serene umbra]

Gave +1 Rep to @flat sedge

[flat sedge]

If you are looking for pentest jobs - competition in that field is very heavy, as it is not entry level and relatively prestigious. If you are looking to get into cyber or info sec, defensive stuff may be a faster route to getting into the field. Pivoting to pentest after you are in somewhere is much easier than just jumping into it without having a pretty deep IT background in at least 1 domain.

[inland zephyr]

I recently became interested in compliance. Does anyone have a roadmap or something of how to get into compliance/auditing?

[flat sedge]

https://www.nist.gov/cyberframework/getting-started#quickstart

NIST CF is a pretty good starting point - breaks down what a framework is supposed to do, and includes grading to rate maturity within the implmentation across the org

[inland zephyr]

I meant more like how to get there as a job. What are the common routes? I'm guessing from a SOC analyst type role?

But still thanks for the article! It looks like a nice read. I'll be sure to go through it.

[flat sedge]

Be good at checklists - routes to getting into compliance can be SOC, legal, accounting, or other security implementations. Audits are a huge part of it, if you can get any kind of experience surviving an audit that's a big plus

[inner elm]

https://www.bls.gov/ooh/computer-and-information-technology/mobile/information-security-analysts.htm

[inner elm]

What's your education? Have you considered an internship?

What got you interested in compliance?

[inland zephyr]

I have a bachelor's degree in CS, with my free electives in finance, accounting and information & data management.
Going back to school to get a Master's degree in CS.
I have previous work experience as a full-stack dev at a startup in the health informatics sector.

[inner elm]

I see health, guessing that's part of it

[inland zephyr]

My interests have always been in security and health care. I have found several job positions as a SOC analyst at hospitals in this area but I don't see myself being on the technical side for my entire career. I recently read about HIPAA and figured that maybe something like compliance in that area might be more of what I would like to end up doing.

[inner elm]

That's awesome, seems like an excellent driver

[inland zephyr]

So yes, your guess is accurate 😂

[inner elm]

One of my degrees is in Security & Risk Analysis and anyone who has been within 10 ft of a hospital knows those places are full of yikes, so I'm glad to hear when there's folks trying to make it better

Just curious but are you ultimately looking for something like this? https://www.indeed.com/m/viewjob?jk=a267d902bc424b90&from=serp

(I'm not a recruiter or anything, just trying to better understand)

[inland zephyr]

Yes, that's pretty much what I'm looking for!

I'm gonna save that position for future reference.

[hidden sky]

Hello friends, I am beginner so my question is from where to start first to get in Cyber Security field ? Is that first programming with Python then move to networks and then to learn Kali Linux and is that enough for one Ethical Hacker or Penetration tester to be able to get a job ? And also any additional explanation is welcome !

[quick forum]

Programming and hackinf are different disciplines

You also don't really learn Kali Linux, you should be learning how stuff works, how to use tools, and understanding why those tools work

[hidden sky]

@quick forum So, this part about learning stuff I understand you, I know at least from where to start but about which tools you are talking about and where I can find them and learn if they are not in Kali Linux ?

[quick forum]

They are in Kali for the most part, but you don't learn Kali. You learn the tools. Kali is a convenient Linux distro with the tools easily available. What you learn is applicable outside Kali.

Just remember, being a hacker is a mindset. It's understanding how something functions fully, and using that understanding to break it where possible

[hidden sky]

@quick forum Ok, maybe I said it wrong when I meant to learn Kali Linux and yes I meant on tools inside it but what you think because I am not talented for programming can I succeed to get a job with only networks and Kali Linux tools and what would be mine call in future ?

[quick forum]

In roughly 6mo as a pentester, I have used programming roughly twice

It helps to be able to program, but a lot of that is being able to understand code and how things work.

[ebon mica]

Then again, they weren't exactly asking about pentesting, but the wider field of cyber security

[quick forum]

one Ethical Hacker or Penetration tester to be able to get a job

[ebon mica]

get in Cyber Security field

[quick forum]

I can't speak for blue team beyond some forensics

[ebon mica]

there are programming intensive parts of cyber security.

[hidden sky]

@quick forum So, you think with networks and Kali Linux tools I can be Ethical Hacker or Penetration tester ?

[ebon mica]

but yeah, pentesting doesn't really need you to know a lot about programming.

[quick forum]

It's worth bearing in mind that pentesting isn't usually an entry level position

A lot of companies will expect you to have IT or blue team experience

There are entry level positions out there, but they're less common

[hidden sky]

@quick forum So, what to do brother from where to start ?

[quick forum]

I'd recommend starting on tryhackme, working through some content and trying your very best to understand everything that you're doing.

If nothing else, you'll definitely learn what you like and what you dislike in cyber

[hidden sky]

But Penetration tester is easier then Ethical Hacker it's just a part of Ethical Hacking, right ?@quick forum

[coral jacinth]

On same boat

Very new to cyber security need to start from the scratch. But don’t know where to start.

[inland zephyr]

I meant to ask you, since you have a degree in Security & Risk Analysis, can you recommend any books?

[inner elm]

depends, B.S. was like a mile wide and an inch deep even though my concentration was in Cybersecurity. This is one of my textbooks - https://www.amazon.com/Management-Information-Security-Michael-Whitman/dp/133740571X

[quick forum]

Can confirm, Whitman and Mattord book is fairly standard for infosec management

[inland zephyr]

Going by the brief contents, seems like a good read! Thanks!

[inner elm]

honestly I've been wanting to make a point of staying up to date in the arena, but my interests have been more in international relations. the two intertwine at some point but I'm just at the beginning stages of all this

[merry matrix]

https://github.com/DFIRmadness/5pillars/blob/master/5-Pillars.md

You can learn a good chunk of the stuff mentioned here on TryHackMe, but just know that it’s not a sprint, it’s a marathon

[coral jacinth]

👍

[coral jacinth]

Yes .

[old crater]

Hey guys i been looking for jobs and i always see a bachelor's degree in the requirements but i didn't it is there a way around this ?

[languid hearth]

apply anyways.
No circumvention other than formal exp

[short pike]

Heyo, I'm a 3rd year undergrad in CS-Math (and Physics) getting pretty interested in cybersec lately. I was curious if people had advice on finding/applying to cybersec summer internships--I didn't have the time nor motivation to go through most of the SWE internship applications in the fall, but I'm currently on break and am getting pretty excited to learn more in this field

[old crater]

well

how do i get experience ?

am still building up my career

[stoic cave]

Go get a degree or start somewhere else in the computer world. Even with a degree Cyber is hard to break into because it's not an entry level area. Pentesting is an even more niche area that is nigh impossible to break into as an entry level. Not saying it can't be done, just unlikely.

IT is a common starting point for a lot of people

[stoic cave]

Get on LinkedIn and Indeed and start applying. Now that we're in January it's getting kind of close to the end of hiring for 2022 summer. Talk you your career center at school, they may even have a career board like Indeed. Brush up your resume and be prepared to take an internship that may not be Cyber specifically.

[warm hinge]

Security+ is hard ?

[stoic cave]

Depends

Each person is different and one may find the exam more difficult than another