How to safely shift from an IT field to malware analysis?
I got this question multiple times,
from lots of people who are working right now
in administration or in SOC analysis,
and they want to start learning malware analysis.
And, they always have this question,
"how we can safely shift from here to there?".
And I will answer this question in three parts.
The first one, your experience,
your years of experience in SOC analysis
or administration, doesn't count in malware analysis.
It's not really important.
The two fields are very different.
I know in administration and SOC analysis,
there's the culture of that,
to move from one step to the next,
from administration to security,
and from let's say, low level security to another level,
or to network security,
you need to spend some years in each step.
In malware analysis, to move from administration
to malware analysis you don't have
to stay in administration, or in SOC,
for two or three years to switch to malware analysis.
The connection between both is not that much.
There's not so many things in common
between this job and that job.
Cyber security, general cyber security information,
or network knowledge will help you in both,
but malware analysis is a bit different when it comes
to the next steps after the basics.
This is the first thing.
The second part of the answer,
malware analysis is more of a skill or an art.
You need to learn the foundation
and practice a lot.
Practice, practice, practice, every single day.
There is so many malwares,
and so many crack-mes.
Their answers are there.
There are so many malwares
that there's a malware analysis report
for them to read and to test yourself,
and that's what will make you actually learn the skill.
It's more an art.
It's a crafting art, and you really need to practice a lot.
And when you are learning malware analysis,
you need to focus on the foundation.
Not the tools, the tools are changing from time to time.
And not the languages.
If you're learning how to unlock analyzer PHP malware,
you'll be able to analyze malware in powershell,
or in Perl, or in AutoIt, or in whatever the language.
I don't know how to write code in powershell,
but I know how to analyze the malware.
Because it is not that complicated
once you learn the foundation,
it's easy to analyze the different malware.
I will talk about the socials exactly in another video,
but I want you to get that right.
The third part, and it's very important,
is that you need to change your mindsets
about learning malware analysis,
about building your skills in the IT field.
Administration and SOC, they rely so much
on certification and years of experience.
To be able to work as an administrator,
as an IT administrator for Linux,
you need to have Red Hat certificates,
or if you want to work in networks, then Cisco,
and you go with Cisco until you reach the level
when you are working in security, or network security.
In malware analysis it's not about that.
Because it's a skill, it's more an art,
you need to have something that shows your skills
than certificates or years of experience.
Once you learn malware analysis
and you have practiced a lot,
you can actually write a technical report
about a malware, a malware analysis report,
for a famous malware like Emotet, Stuxnet,
or WannaCry, or Petya,
whatever the malware is.
Run a malware analysis report
and show your work in LinkedIn
and a blog, and in different places.
Even in conferences if you have something
that's really interesting.
If you like programming then you can write too,
and show it as a way to prove your skills
in malware analysis.
So, in conclusion, you need to first,
start right now, you don't need to wait
for a specific number of years
in administration or in SOC.
Second, you need to learn the foundation, right?
The foundation, not tools.
Learn the foundation and practice a lot.
The third thing, once you have practice,
once you learn the skill,
then you need to write a malware analysis report
or something that proves your skills.
And this will make you outstand more
when your up line for a company.
Not the certificates.
This is not like the administration point of view.
That's it for this video,
and see you in the next video, bye-bye.