(bright music)
- [Marc] There are five major reasons
why you might want to consider
starting a career in IT security.
First, there's much more demand
for qualified IT security professionals than supply.
Recent trends, including the increased number
of successful security attacks
and regulatory requirements for strong security
are driving demand for IT security professionals.
Second, once you have your IT security job,
as long as you're effective in your role,
you can expect long-term job security.
Because good IT security professionals are so hard to find,
a smart organization will want you to stay
as long as possible.
There are many types of IT security jobs to choose from,
you shouldn't have any problem finding a job
that fits your skill set, experience,
personality, and career aspirations.
Fourth, there's plenty of career growth potential
when you have an IT security job.
You can start out as a brand new IT security technician
and take your career all the way to an IT security director
if that's your desire.
And finally, a great reason to start a career in IT security
is you'll probably get paid more.
The 2015 Burning Glass cybersecurity jobs report
identified a security premium of 9%
compared to other IT workers.
In other words, IT security professionals
can expect to get an average salary premium
of nearly $6,500 per year
because their skills are in such high demand.
These five reasons are why many people
are seriously considering
starting a career in IT security.
Let's take a look at some of the key events
in IT security history.
This quick history lesson will give some context
to the quickly evolving world of IT security,
and the growing need for security professionals.
The timeline starts in 1969 when ARPANET,
the precursor to the internet, sent its first message.
TCP/IP, the same transmission protocol
we use on the internet today,
was tested for the first time six years later in 1975.
In 1983, ARPANET began using TCP/IP,
bringing it one step closer to the internet we know today.
The Computer Fraud and Abuse Act,
which criminalized many forms of computer hacks and attacks
was passed by the United States Congress in 1986.
In 1988, the first major network worm
was released by Robert Tappan Morris,
crippling thousands of computers
and causing millions in estimated damages.
The Morris worm led to the creation
of the US Computer Emergency Response Team
Coordination Center or CERTCC later that year.
Morris was the first person convicted
under the Computer Fraud and Abuse Act.
In 1990, the internet as we know it was born
when ARPANET was decommissioned.
In the US, the 1990s brought us laws and standards
still important to us today.
The Health Insurance Portability
and Accountability Act or HIPAA,
defined security safeguards
for Electronic Protected Health Information, or EPHI.
The Gramm-Leach-Bliley Act or GLBA
included a safeguards rule
requiring financial institutions
to develop a written information security plan
to protect clients non-public personal information.
In the early 2000s,
more US laws and standards were established,
including the Federal Information
Security Management Act or FISMA,
which requires all US federal agencies
to develop, document, and implement
an information security program.
In 2002, California became the first state
to require companies who have suffered a data breach
to notify their customers.
Then in 2004, the Payment Card Industry
Data Security Standards, or PCIDSS,
outlined the basic security levels for merchants
who store, process, and transmit cardholder data.
In the late 2000s, the number of hacks and attacks
continued to increase
starting with the T.J. Maxx hack in 2005,
which led to the theft of 45 million customer credit
and debit account details.
Also in 2005, the ISO/IEC 27001 was published
as an international security standard,
which is still used today
as the basis for organization's security policies.
From 2010 to 2015,
we saw a major spike in hacks and attacks.
Government, healthcare, technology, and finance
are just a few of the many industries
that have suffered data breaches.
Altogether, many millions of sensitive organizations
and personal records were breached over these five years.
As you can see, a lot has happened
in the world of IT security since 1969.
Two major trends are evident in these events.
The first is that cyber threats
are becoming more sophisticated, frequent, and successful.
No one is safe from a cyber attack.
Another significant trend
is the increasing need for IT security professionals
due to regulatory requirements for stronger security,
organizations seeking to protect themselves
from cyber threats,
and customer demands that businesses protect
their sensitive information.
You should now see why businesses
and organizations worldwide
seek qualified security professionals
to help protect their systems and data.
One of the benefits of being in the IT security industry
is the great variety of resources available
which can enhance your career.
Some of these resources are educational,
while others are more entertaining,
but luckily, many of them are free.
We'll start with a few general security resources.
The National Institute of Standards and Technology or NIST
maintains a Computer Security Resource Center.
The CSRC is a helpful site when you're looking for examples
of security policies and standards,
especially if you're writing these for your organization
and you need some inspiration.
Next is CERIAS, the Center for Education and Research
in Information Assurance and Security at Purdue University.
Here, you'll find free IT security seminars
plus industry news and opinion.
And you'll want to check out the SANS Reading Room
where you can reference
more than 2,500 IT security white papers
written by other IT security professionals.
As an IT security professional,
people will expect you to know and have an opinion
about current security events.
You can stay on top of IT security news, events, and trends
by reading these blogs,
Krebs on Security, Naked Security,
Threat Level, Dark Reading, Threatpost,
and Information Security Magazine.
Sometimes it's easier
to listen to security news and commentary,
so you might enjoy these popular security podcasts,
Breaking Down Security,
Down the Security Rabbithole,
Southern Fried Security Podcast,
Security Current Podcast,
and the SANS Internet Storm Center daily podcast.
There is no lack of paid training opportunities
in the IT security field,
but there are also high quality free training resources
if you know where to look.
Check out these free trainings
if you need to expand your knowledge in these areas,
Cybrary which provides free IT security training
on a wide variety of topics,
including many certification exams.
Metasploit Unleashed, a free course on ethical hacking
using the Metasploit framework.
CISSP Cryptography Mini Course
a free course covering the basics of cryptography.
And SANS Cyber Aces which provides courses
on fundamental IT security topics like operating systems,
networking, and system administration.
For a mix of education and entertainment,
there are plenty of great IT security books worth reading.
"Schneier on Security" is a great read
that explores a security expert
Bruce Schneier's security philosophy.
There are also four riveting titles
that tell real stories
of hacking, espionage, and cyber crime.
"Ghost in the Wires: My Adventure as the World's
Most Wanted Hacker" by Kevin Mitnick.
"Spam Nation: The Inside Story of Organized Cybercrime
from Global Epidemic to Your Front Door" by Brian Krebs.
"The Cuckoo's Egg: Tracking a Spy
Through the Maze of Computer Espionage" by Cliff Stoll.
And finally, "Kingpin: How One Hacker
Took Over the Billion-Dollar Cybercrime Underground"
by Kevin Poulsen.
Of course, there many more resources
for IT security professionals
than the ones I've covered here.
And as you progress in your career,
you'll find your own favorites.
In the ever-changing world of IT security,
the most important factor
when determining where you get your news is data quality.
(gentle music)