I get this question actually many
times and people ask me, can
I learn malware analysis and penetration
testing at the same time? Can
I find a job using malware analysis
skills and penetration testing skills?
Well the answer is between yes
and no. If you are starting
a new career in malware
analysis and that's your focus, then
you need to invest the majority
of your time in malware analysis.
The bigger Circle outside of malware analysis
is the blue team in general, which
is the incident response. Digital forensics
memory forensics, and threat hunting, and
threat intelligence and all this circle
around. If you focus mainly on
Blue Team, then you can actually
get a job in malware analysis
or incident response or threat hunting,
much faster. But if your focus on penetration testing
testing, then learning malware analysis wouldn't
really help you to move forward.
You can Focus on learning the
red teaming or cloud attacks or
even red team weaponization
or adversary simulation when you can simulate real attacks
but after you have enough knowledge
after you become more advanced level and you
are actually working professionally in a
company. This is when the bridging starts to happen
because once you are really in a good level
in blue team? You will need to
understand the attacker mindset so you
can see the attack from a
holistic point of view, so, huh?
This is how the attackers actually.
Bland is attack. I have been
studying incident response for quite some
time. I've been studying malware analysis
and threat hunting, I know how
detection works. I know
how security controls work
but now, I can see how the attacker actually plan his
attack and bypasses defenses, and
by bypass detections as well. Now,
I can adjust my detections and
my and my defenses to match
with these attacks. Now, I can
see how there is the red team will look at my defenses
so I can actually improve them
and better protect my organization when
there is a purple team exercises,
and working with somebody else from
the red team. Now, I know
how I can communicate with him,
how I can actually improve, the
company's security posture using my experience
in red teaming or in the attacker's side
the same thing comes to the penetration testing
if you are working in offensive and
you actually started, you are actually working
in penetration testing. You have done
multiple penetration testing assessments. You have
also learned about red teaming. You actually
simulating real attacks. Now you can
look at "okay, this is how
the detection team how's the SOC
team actually detecting my attacks. This
is how they plan their alerts
How they improve their detections.
This is how to do forensics
This is how to do memory forensics
This is how they do
in-depth investigation. Now, how I can
plan my attack to leave, no
traces to bypass their detections to
bypass their defenses and able to
improve my attack. So there is
a point in your career where
you were learning, the other side
would be very beneficial and at
the end of the day, both
of you is trying to defend
against Advanced APT attacks or Targeted
attacks which is is the
same. You understand the attack, either
you simulated or you write detections
about, but you both understand these
attacks. that you both try to
learn the attackers tactics techniques and
procedures, and how the craft their
attack. So, from both sides, you
will have lots of knowledge in
common. So there are, there is
a point in your career that
you will need to learn about
the other side, but if you
are starting in your in your
cybersecurity career, Then I wouldn't advise
you to learn both defense and
offense. At the same time, focus
on, one field focus on Blue
Team or Red Team and dive into
that, until you reach a level
who you are actually working in
a professionally in a company. If
you're in offensive and defensive side,
and after specific level, you would
say, Okay, learning the other side,
could be very beneficial. Hope, that
answers your question and see you
in the next video. Bye bye.