Since red team and even pen testing positions feel like kind of advanced level skills to
me. What are some of the first steps you would take to sort of put you on this path?
Sure. This is my own personal opinion, and you can take this or leave this, but I think
that the first thing a person should ask themselves if they want to get into cybersecurity work,
even just vulnerability assessments, is are you comfortable working with the command prompt
or shell? If that's something that you're familiar with, you should study it and see
if it's something that maybe you have the knack for.
But some people, they just – They see the command prompt and they see the little flashing
cursor and they know they’re supposed to type something, and that's overwhelming and
too much. You know what? That’s okay, because –
Right. So many choices.
There are other positions in cybersecurity that you don't have to get on the keyboard
in that way. You can work in security policy and auditing or hundred other areas.
Risk assessment or – Yeah.
Sure. If you are comfortable on the command line, then I would say you should pursue some
entry-level certifications that will help you build – You want to build a foundation
in both networks and security. In my opinion –
So like a Net+, Security+ combo possibly?
Yes, and it’s just scary to say Security+, Net+ and maybe the CEH. They’re great entry
level courses that will really help you build a strong foundation both offensively and defensively
and kind of just understanding networking and information technology.
Okay. Is there any sort of like hands-on type lab situations or whatever you'd recommend
or sort of like ways apart from just the study? I mean, does study give you sort of hands-on
elements or like – Especially if you don't really have like a support system around you
or whatever, like what are some ways that you can sort of like test this out in your
bedroom?
Sure. There's an organization that provides free training called Cybrary that I have gotten
a lot of use from as well as – I guess back in 2009 when I was just starting to learn
about this stuff. I walked into a Barnes & Noble and bout a Security+ book, and I read it cover
to cover, and that was great. I learned a lot. I mean, for me personally. But I definitely
think there's a lot of online resources available out there.
Now, I haven't had to step back to what I would call introductory stuff in a long time.
But I can definitely say that Cybrary, and there’s some other that are similar as well
as reading.
My opportunities say infosecinstitute.com/skills, enter code Cyber Work for one free month.
We have also have a skills –
That too.
But yes. No. Yeah, there are those options out there, and I guess we’re just – More
than anything, more than sort of like the programs or whatever, we just want people
to sort of understand that this is not an unattainable thing and that it's not – The
sort of barrier to entry is pretty low. Like you say, if you get a book of the library
or you test out with some of these skills assessments, like you can get a pretty good
sense early on whether this is a thing you’d be comfortable with doing for the rest of
your life, right?
I would certainly agree. To expand that even further, prior to going to college and getting
in this service, I was a cashier at Walmart for a long time. Self-study and, of course,
the opportunities the military provided me. But it's not something that people can't get
into. It really is an approachable field.
New episodes of Cyber Work are available every Monday at 1pm central, and don't forget to
claim your free month of Infosec Skills. Sign up using the code 'cyberwork' and you'll get
unlimited access to hundreds of courses, hands-on labs, certification practice exams, skills
assessments and more. Use code 'cyberwork' for Infosec Skills.