How do you become a Cyber Security Expert?

Hello and welcome to another episode of CISO Tradecraft, the podcast that provides you with the information, knowledge, and wisdom to be a more effective cybersecurity leader. My name is G. Mark Hardy, and today we're going to talk about how to provide advice and mentoring to help people understand how to become a cybersecurity expert. As always, please follow us on LinkedIn, and subscribe to our podcasts.

As a security leader, part of your role is to develop your people. That may not be written anywhere in your job description and will probably never be on a formal interview or evaluation, but after years of being entrusted with leadership positions, I have learned what differentiates true leaders from those who just accomplish a great deal is the making of the effort to develop your people.

Now, you may have heard the phrase, "take care of your people," but I'll take issue with that. I take care of my dog. I take care of a family member who is sick, injured, or incapacitated. Why? Because they are not capable of performing all of life's requirements on their own. For the most part, your people can do this. If you are constantly doing things for people who could have otherwise done it themselves, you run the risk of creating learned helplessness syndrome. People, and even animals, can become conditioned to not do what they otherwise could do out of a belief that someone else will do it for them. I am NOT going to get political here, so don't worry about that. Rather, I want to point out that effective leaders develop their people so that they may become independent actors and eventually become effective leaders themselves. In my opinion, you should measure your success by the promotion rate of the people entrusted to you, not by your own personal career advancement or financial success.

That brings me to the subject of today's podcast -- how do you counsel and mentor others on how to become a cyber security expert? If you are listening to this podcast, there's a very good chance that you already are an expert in our field, but if not, keep listening and imagine that you are mentoring yourself, because these lessons can apply to you without having seek out a mentor. Some people figure it out, and when asked their secret, they're like Bill Murray in the movie Stripes, "We trained ourselves, sir!" But most of the time, career mastery involves learning from a number of others.

Today on CISO Tradecraft we are going to analyze the question, " How do you become a Cyber Security Expert?" I'm going to address this topic as if I were addressing someone in search of an answer. Don't tune out early because you feel you've already accomplished this. Keep listening so you can get a sense of what more you could be doing for your direct reports and any proteges you may have.

Let’s start at the beginning. Imagine being a high school kid with absolutely zero work experience (other than maybe a paper route -- do kids still do that?) You see someone that tells you they have a cool job where they get paid to ethically hack into computers. Later on, you meet a second person that says they make really good money stopping bad actors from breaking into banks. Somehow these ideas stick into your brain, and you start to say to yourself, you know both of those jobs sound pretty cool. You begin to see yourself having a career in Cyber Security. You definitely prefer it to jobs that require a lot of manual labor and start at a low pay. So, you start thinking, "how I can gain the skills necessary to land a dream job in cyber security that also pays well?"

At CISO Tradecraft we believe that there are really four building blocks that create subject matter experts in most jobs. The four building blocks are:

Getting an education
Getting certifications
Getting relevant job experience, and
Building your personal brand

So, let’s explore these in detail.

Number 1: Getting an education. When most people think about getting an education after high school, they usually talk about getting an associate's or a bachelor's degree. If you were to look at most Chief Information Security Officers, you will see the majority of them earn a bachelor’s degree in Computer Science, an Information Systems or Technology degree from a college of business such as a BS in Management of Information Systems (MIS) or Computer Information Systems, or more recently a related discipline such as a degree in Cyber Security.

An associate degree is a great start for many, particularly if you don't have the money to pay for a four-year university degree right out of high school. Tuition and debt can rack up pretty quickly, leaving some students deeply in debt, and for some, that huge bill is a non-starter. Fortunately, community colleges offer quality educational opportunities at very competitive rates relative to four-year degree institutions. For example, Baltimore County Community College charges $122 per credit hour for in-county residents. A couple of miles away, Johns Hopkins University charges $2,016 per credit hour. Now, that's a HUGE difference -- over 16 times if you do the math. Now, Hopkins does have some wonderful facilities and excellent faculty, but when it comes to first- and second-year undergraduate studies, is the quality and content of the education THAT different? Well, that's up to you to decide.

The important take-away is, no one should decide NOT to pursue a cybersecurity education because of lack of money. You can get started at any age on an associate degree, and that may give you enough to go on to get your first job. However, if you want to continue on to bachelor's degree, don't give up. Later I'll explain about a program that has been around since 2000 and has provided over 3,300 students with scholarships AND job placement after graduation.

Back to those going directly for a bachelor's degree. Now, the good news is that your chosen profession is likely to pay quite well, so not only are you likely to be able to pay off the investment you make in your education, but it will return dividends many times that which you paid, for the rest of your career. Think of financing a degree like financing a house. In exchange for your monthly mortgage payment, you get to enjoy a roof over your head and anything else you do with your home. As a cybersecurity professional, in exchange for your monthly student loan payment, you get to earn well-above average incomes relative to your non-security peers, and hopefully enjoy a rewarding career. And, like the right house, the value of your career should increase over time making your investment in your own education one of your best performing assets.

Does this mean that you 100% need a bachelor’s degree to get a job in cyber? No, it does not. There are plenty of cyber professionals that speak at Blackhat and DEF CON who have never obtained a college degree. However, if ten applicants are going for an extremely competitive job and only seven of the ten applicants have a college degree in IT or Cyber, you shouldn’t be surprised when HR shortens the list of qualified applicants to only the top five applicants all having college degrees. It may not be fair, but it’s common. Plus, a U.S. Census Bureau study showed that folks who have a bachelor's degree make half a million dollars more over a career than those with an associate degree, and 1.6 times what a high school diploma holder may earn over a lifetime. So, if you want more career opportunities and want to monetize your future, get past that HR checkbox that looks for a 4-year degree.

Now, some people (usually those who don't want to do academic work) will say that a formal education isn't necessary for success. After all, Bill Gates and Mark Zuckerberg were college dropouts, and they're both worth billions. True, but that's a false argument that there's a cause-and-effect relationship there. Both were undergraduates at Harvard University when they developed their business ideas. So, if someone wants to assert a degree isn't necessary, counter with you'll agree once they are accepted into Harvard, and they produce a viable business plan as a teenager while attending classes.

You see, completing four years of education in a field of study proves a few things. I've interviewed candidates that said they took all of the computer science and cybersecurity courses they wanted and didn't feel a need to "waste time" with fuzzy studies such as history and English composition. Okay, I'll accept that that person had a more focused education. But consider the precedent here. When a course looked uninteresting or difficult, that candidate just passed on the opportunity. In the world of jobs and careers, there are going to be tasks that are uninteresting or difficult, and no one wants to do them, but they have to get done. As a boss, do you want someone who has shown the pe d completed it with an A (or maybe even a B), or do you want someone who passed when the going got a little rough? The business world isn't academia where you're free to pick and choose whether to complete requirements. Stuff has to get done, and someone who has a modified form of learned helplessness will most likely not follow through when that boring task comes due.

Remember I said I was going to tell you how to deal with the unfortunate situation where a prospective student doesn't have enough money to pay for college? There are a couple of ways to meet that challenge. It’s time to talk to your rich uncle about paying for college. That uncle is Uncle Sam. Uncle Sam can easily finance your college so you can earn your degrees in Cyber Security. However, Uncle Sam will want you to work for the government in return for paying for your education. Two example scholarships that you could look into are the Reserve Officer Training Corps (ROTC) and Scholarship for Service (SFS). ROTC is an officer accession program offered at more than 1,700 colleges and universities across the United States to prepare young adults to become officers in the U.S. Military. For scholarship students, ROTC pays 100% of tuition, fees, books, and a modest stipend for living expenses. A successful degree program can qualify an Army second lieutenant for a Military Occupation Specialty (or MOS) such as a 17A Cyber Operations Officer, a 17B Cyber and Electronic Warfare Officer, or a 17D Cyber Capabilities Development Officer, a great start to a cybersecurity career.

For the Navy, a graduating Ensign may commission as an 1810 Cryptologic Warfare Officer, 1820 Information Professional Officer, 1830 Intelligence Officer, or an 1840 Cyber Warfare Engineer. The Navy uses designators rather than MOS's to delineate career patterns. These designators have changed significantly over the last dozen years and may continue to evolve. The Marine Corps has a 1702 cyberspace officer MOS. Note that the Navy and the Marine Corps share a commissioning source in NROTC (Navy ROTC), and unlike the Army that has over 1,000 schools that participate in AROTC and the Air Force that has 1,100 associated universities in 145 detachments, there are only 63 Navy ROTC units or consortiums, although cross-town affiliates include nearly one hundred more colleges and universities.

There are a lot of details that pertain to ROTC, and if you're serious about entering upon a military officer career, it's well worth the time and effort to do your research. Not all ROTC students receive a scholarship; some receive military instruction throughout their four years and are offered a commission upon graduation. Three- and four-year scholarship students incur a military obligation at the beginning of sophomore year, two-year scholarship students at the beginning of junior year, and one-year scholarship students at the start of senior year. The military obligation today is eight years, usually the first four of which are on active duty; the rest may be completed in the reserves. If you flunk out of school, you are rewarded with an enlistment rather than a commission. These numbers were different when I was in ROTC, and they may have changed since this podcast was recorded, so make sure you get the latest information to make an informed decision.

What if you want to serve your country but you're not inclined to serve in the military, or have some medical condition that may keep you from vigorous physical activity, or had engaged in recreational chemical use or other youthful indiscretions that may have disqualified you from further ROTC consideration? There is another program worth investigating.

The National Science Foundation provides educational grants through the Scholarship For Service program or SFS for short. SFS is a government scholarship that will pay up to 3 years of costs for undergraduate and even graduate (MS or PhD) educational degree programs. It's understood that government agencies do not have the flexibility to match private sector salaries in cyber security. However, by offering scholarships up front, qualified professionals may choose to stay in government service; hence SFS continues as a sourcing engine for Federal employees. Unlike ROTC, a participant in SFS will incur an obligation to work in a non-DoD branch of the Federal government for a duration equal to the number of years of scholarship provided.

In addition to tuition and education-related fees, undergraduate scholarship recipients receive $25,000 in annual academic stipends, while graduate students receive $34,000 per year. In addition, an additional $6,000 is provided for certifications, and even travel to the SFS Job Fair in Washington DC.

That job fair is an interesting affair. I was honored to be the keynote speaker at the SFS job fair back in 2008. I saw entities and agencies of the Federal government that I didn't even know existed, but they all had a cybersecurity requirement, and they all were actively hiring. SFS students qualify for "excepted service" appointments, which means they can be hired through an expedited process. These have been virtual the last couple of years due to COVID-19 but expect in-person events to resume in the future.

I wrote a recommendation for a young lady whom I've known since she was born (her mom is a childhood friend of mine), and as an electrical engineering student in her sophomore year, she was selected for a two-year SFS scholarship. A good way to make mom and dad happy knowing they're not going to be working until 80 to pay off their kid's education bills.

In exchange for a two-year scholarship, SFS will usually require a student to complete a summer internship between the first and second years of school and then work two years in a government agency after graduation. The biggest benefit to the Scholarship for Service is you can work at a variety of places. So, if your dream is to be a nation state hacker for the NSA, CIA, or the FBI then this offers a great chance of getting in. These three-letter agencies heavily recruit from these programs. As I mentioned, there are a lot of other agencies as well. You could find work at the State Department, Department of Health and Human Services, the Department of Education, the Federal Reserve Board, and I think I remember the United States Agency for International Development (USAID). Federal executive agencies, Congress, interstate agencies, and even state, local, or tribal governments can satisfy the service requirement. So, you can get paid to go to college and have a rewarding job in the government that builds a nice background for your career.

How would you put all this together? I spent nine years as an advisor to the National CyberWatch Center. Founded as CyberWatch I in 2005, it started as a Washington D.C. and Mid-Atlantic regional effort to increase the quantity and quality of the information assurance workforce. In 2009, we received a National Science Foundation award and grants that allowed the program to go nationwide. Today, over 370 colleges and universities are in the program. So why the history lesson?

What we did was align curriculum between two-year colleges and four-year universities, such that a student who took the designated courses in an associate degree program would have 100% of those credits transfer to the four-year university. That is HUGE. Without getting into the boring details, schools would certify to the Committee on National Security Systems (CNSS) (formerly known as the National Security Telecommunications and Information Systems Security Committee or NSTISSC) national training standard for INFOSEC professionals known as NSTISSI 4011. Now with the help of an SFS scholarship, a student with little to no financial resources can earn an associate degree locally, proceed to a bachelor's degree from a respected university, have a guaranteed job coming out of school, and HAVE NO STUDENT DEBT. Parents, are you listening carefully? Successfully following that advice can save $100,000 and place your child on course for success.

OK, so let’s fast forward 3 years and say that you are getting closer to finishing a degree in Cyber Security or Computer Science. Is there anything else that you can do while performing a summer internship? That brings us to our second building block. Getting certifications.

Number Two: Getting a Certification

Earning certifications are another key step to demonstrate that you have technical skills in cyber security. Usually, technology changes rapidly. That means that universities typically don’t provide specialized training in Windows 11, Oracle Databases, Amazon Web Services, or the latest programming language. Thus, while you may come out of a computer science degree with knowledge on how to write C++ and JavaScript, there are a lot of skills that you often lack to be quite knowledgeable in the workforce. Additionally, most colleges teach only the free version of software. In class you don’t expect to learn how to deploy Antivirus software to thousands of endpoints from a vendor that would be in a Gartner Magic quadrant, yet that is exactly what you might encounter in the workplace. So, let’s look at some certifications that can help you establish your expertise as a cyber professional. We usually recommend entry level certifications from CompTIA as a great starting point. CompTIA has some good certifications that can teach you the basics in technology. For example:

CompTIA A+ can teach you how to work an IT Help Desk.
CompTIA Network+ can teach you about troubleshooting, configuring, and managing networks
CompTIA Linux+ can help you learn how to perform as a system administrator supporting Linux Systems
CompTIA Server+ ensures you have the skills to work in data centers as well as on-premises or hybrid environments.

Remember it’s really hard to protect a technology that you know nothing about so these are easy ways to get great experience in a technology. If you want a certification such as these from CompTIA, we recommend going to a bookstore such as Amazon, buying the official study guidebook, and setting a goal to read every day. Once you have read the official study guide go and buy a set of practice exam questions from a site like Whiz Labs or Udemy. Note this usually retails for about $10. So far this represents a total cost of about $50 ($40 dollars to buy a book and $10 to buy practice exams.) For that small investment, you can gain the knowledge base to pass a certification. You just need to pay for the exam and meet eligibility requirements.

Now after you get a good grasp of important technologies such as Servers, Networks, and Operating Systems, we recommend adding several types of certifications to your resume. The first is a certification in the Cloud. One notable example of that is AWS Certified Solutions Architect - Associate. Note you can find solution architect certifications from Azure and GCP, but AWS is the most popular cloud provider, so we recommend starting there. Learning how the cloud works is extremely important. Chances are you will be asked to defend it and you need to understand what an EC-2 server is, types of storage to make backups, and how to provide proper access control. So, spend the time and get certified. One course author who provides a great course is Adrian Cantrill. You can find his course link for AWS Solutions Architect in our show notes or by visiting learn.cantrill.io. The course costs $40 and has some of the best diagrams you will ever see in IT. Once again go through a course like this and supplement with practice exam questions before going for the official certification.

The last type of certifications we will mention is an entry cyber security certification. We usually see college students pick up a Security+ or Certified Ethical Hacker as a foundation to establish their knowledge in cyber security. Now the one thing that you really gain out of Security+ is a list of technical terms and concepts in cyber security. You need to be able to understand the difference between Access Control, Authentication, and Authorization if you are to consult with a developer on what is needed before allowing access to a site. These types of certifications will help you to speak fluently as a cyber professional. That means you get more job offers, better opportunities, and interesting work. It’s next to impossible to establish yourself as a cyber expert if you don’t even understand the technical jargon correctly.

Number Three: Getting Relevant Job Experience

OK, so you have a college degree and an IT certification or two. What's next? At this point in time, you are eligible for most entry level jobs. So, let’s find interesting work in Cyber Security. If you are looking for jobs in cyber security, there are two places we recommend. The first is LinkedIn. Almost all companies post there and there’s a wealth of opportunities. Build out an interesting profile and look professional. Then apply, apply, apply. It will take a while to find the role you want. Also post that you are looking for opportunities and need help finding your first role. You will be surprised at how helpful the cyber community is. Here's a pro tip: add some hashtags with your post to increase its visibility.

Another interesting place to consider is your local government. The government spends a lot of time investing in their employees. So go there, work a few years, and gain valuable experience. You can start by going to your local government webpage such as USAJobs.Gov and search for the Career Codes that map to cyber security. For example, search using the keyword “2210” to find the job family of Information Technology Management where most cyber security opportunities can be found. If you find that you get one of these government jobs, be sure to look into college repayment programs. Most government jobs will help you pay off student loans, finance master's degrees in Cyber Security, or pay for your certifications. It’s a great win-win to learn the trade.

Once you get into an organization and begin working your first job out of college, you then generally get one big opportunity to set the direction of your career. What type of cyber professional do you want to be? Usually, we see most Cyber Careerists fall into one of three basic paths.

Offensive Security
Defensive Security
Security Auditing

The reason these three are the most common is they have the largest amount of job opportunities. So, from a pure numbers game it’s likely where you are to spend the bulk of your career. Although we do recommend cross training. Mike Miller who is the vCISO for Appalachia Technologies put out a great LinkedIn post on this where he goes into more detail. Note we have a link to it in our show notes. Here’s some of our own thoughts on these three common cyber pathways:

Offensive Security is for those that like to find vulnerabilities in things before the bad guys do. It’s fun to learn how to hack and take jobs in penetration testing and the red team. Usually if you choose this career, you will spend time learning offensive tools like Nmap, Kali Linux, Metasploit, Burp Suite, and others. You need to know how technology works, common flaws such as the OWASP Top Ten web application security risks, and how to find those vulnerabilities in technology. Once you do, there's a lot of interesting work awaiting. Note if these roles interest you then try to obtain the Offensive Security Certified Professional (OSCP) certification to gain relevant skill sets that you can use at work.

Defensive Security is for the protectors. These are the people who work in the Security Operations Center (SOC) or Incident Response Teams. They look for anomalies, intrusions, and signals across the whole IT network. If something is wrong, they need to find it and identify how to fix it. Similar to Offensive Security professionals they need to understand technology, but they differ in the types of tools they need to look at. You can find a defender looking at logs. Logs can come from an Intrusion Detection System, a Firewall, a SIEM, Antivirus, Data Loss Prevention Tools, an EDR, and many other sources. Defenders will become an expert in one of these tools that needs to be constantly monitored. Note if you are interested in these types of opportunities look for cyber certifications such as the MITRE ATT&CK Defender (MAD) or SANS GIAC Certified Incident Handler GCIH to gain relevant expertise.

Security Auditing is a third common discipline. Usually reporting to the Governance, Risk, and Compliance organization, this role is usually the least technical. This discipline is about understanding a relevant standard or regulation and making sure the organization follows the intent of the standard/regulation. You will spend a lot of time learning the standards, policies, and best practices of an industry. You will perform risk assessments and third-party reviews to understand how we certify as an industry. If you would like to learn about the information systems auditing process, governance and management of IT systems, business processes such as Disaster Recovery and Business Continuity Management, and compliance activities, then we recommend obtaining the Certified Information Systems Auditor (CISA) certification from ISACA.

Ok, so you have a degree, you have certifications, you are in a promising job role, WHAT’s Next? If you want to really become an expert, we recommend you focus on…

Number Four: Building your personal brand.

Essentially find a way to give back to the industry by blogging, writing open-source software, creating a podcast, building cybersecurity tutorials, creating YouTube videos, or presenting a lecture topic to your local OWASP chapter on cyber security. Every time you do you will get smarter on a subject. Imagine spending three hours a week reading books in cyber security. If you did that for ten years, think of how many books you could read and how much smarter you would become. Now as you share that knowledge with others two things happen:

People begin to recognize you as an industry expert. You will get invited to opportunities to connect with other smart people which allows you to become even smarter. If you spend your time listening to smart people and reading their works, it rubs off. You will absorb knowledge from them that will spark new ideas and increase your understanding
The second thing is when you present your ideas to others you often get feedback. Sometimes you learn that you are actually misunderstanding something. Other times you get different viewpoints. Yes, this works in the financial sector, but it doesn’t work in the government sector or in the university setting. This feedback also helps you become smarter as you understand more angles of approaching a problem.

Trust us, the greatest minds in cyber spend a lot of time researching, learning, and teaching others. They all know G Mark's law, which I wrote nearly twenty years ago: "Half of what you know about security will be obsolete in eighteen months."

OK so let’s recap a bit. If you want to become an expert in something, then you should do four things. 1) Get a college education so that you have the greatest amount of opportunities open to you, 2) get certifications to build up your technical knowledge base, 3) find relevant job experiences that allow you to grow your skill sets, and 4) finally share what you know and build your personal brand. All of these make you smarter and will help you become a cyber expert.

Thanks again for listening to us at CISO Tradecraft. We wish you the best on your journey as you Learn to Earn. If you enjoyed the show, tell one person about it this week. It could be your child, a friend looking to get into cyber security, or even a coworker. We would love to help more people and we need your help to reach a larger audience. This is your host, G. Mark Hardy, and thanks again for listening and stay safe out there.

References:

https://www.todaysmilitary.com/education-training/rotc-programs
www.sfs.opm.gov
https://www.comptia.org/home
https://www.whizlabs.com/
https://www.udemy.com/
https://learn.cantrill.io/p/aws-certified-solutions-architect-associate-saa-c03
https://www.linkedin.com/feed/update/urn:li:activity:6965305453987737600/
https://www.offensive-security.com/pwk-oscp/
https://mitre-engenuity.org/cybersecurity/mad/
https://www.giac.org/certifications/certified-incident-handler-gcih/
https://www.ccbcmd.edu/Costs-and-Paying-for-College/Tuition-and-fees/In-County-tuition-and-fees.aspx
https://www.educationcorner.com/value-of-a-college-degree.html
https://www.collegexpress.com/lists/list/us-colleges-with-army-rotc/2580/
https://www.af.mil/About-Us/Fact-Sheets/Display/Article/104478/air-force-reserve-officer-training-corps/
https://www.netc.navy.mil/Commands/Naval-Service-Training-Command/NROTC
https://armypubs.army.mil/pub/eforms/DR_a/NOCASE-DA_FORM_597-3-000-EFILE-2.pdf
https://niccs.cisa.gov/sites/default/files/documents/SFS%20Flyer%20FINAL.pdf
https://www.nationalcyberwatch.org/

#93 - How to Become a Cyber Security Expert

CISO Tradecraft®

#93 - How to Become a Cyber Security Expert