data is exposed leaked stolen
and traded every day on the internet
data breaches are now
so common they no longer become
headlines but
mere side notes yet companies are
spending more
and more and more on information
security every year
which is what the cool kits call the
industry infosec
this time so you want to be a security
engineer
in this episode get a sense of what a
cloud security engineer does
what are they really doing and how
exactly do security specialists work on
a day-to-day basis
are they really ninjas
when it comes to cloud what exactly are
you securing as a cloud engineer or
specialist
at its core it is to allow the right
users access to the right places
and disallow everyone else why you ask
well security engineers typically build
things they work with technology and
tools that help them engineer solutions
they are considered experts in data
protection basics such as securing cloud
services
they might assist in or even be
responsible for
conducting comprehensive tests of
software when needed
starting out as a cloud security
engineer can be difficult if you have no
experience in cloud security
so the best place to start could be as
a cloud security analyst and what would
you be analyzing you ask well you
guessed it
the cloud and no that does not make you
a weatherman
person oh sunny
you'll spend your days looking at
information gathered from security tools
such as long lists of data from servers
from your analysis you will be making
recommendations on your observations
being an analyst will give you the
foundation that you need when moving up
to a security engineer role
as a secured engineer you would be
tasked to keep every bit of data
and people's details secure so it's not
shared on the dark web
making headline news
technology is known for having strange
terms
floppy disk there's nothing floppy about
it
bluetooth is named after an ancient
danish king
and an internet cookie is certainly not
a gif
of a choc chip delight to be honest
i don't really have any clue either so
here's ill to explain
i got this let me guide you through some
of the most common terms
you'll come across within cloud security
but hold on to your seats because it's
going to be a bumpy ride
and your hats you should hold on to your
hats first off
let's focus on the word security the
word is so broad that it can refer to
anything from
information security to physical
security
physical security being those who are in
charge of the safety of employees the
facilities
of assets of basically anything that
isn't nailed down
like those hats you're holding on to as
a cloud security engineer your digital
savviness
is focused on the digital assets which
are the bits and the bytes
that make up the important things of
your business such as your customers
credit card numbers that are stored
in the cloud cyber oh
cyber that is a term that is so overused
that it might as well have lost
all meaning think about it we have
cybernetics we've got cybercast and we
even have cyberpunks
cybersecurity often refers to the
ability to protect
and defend the virtual space created by
computers
and networks on the internet aka
cyberspace from
cyber attacks it's possible that you
might end up being a cyber security
engineer
lastly we have information security or
infosec
this is the preferred term for many in
the cyber security industry
in the infosec community this is the
preferred term
in the infosec community think about it
what are you going to be doing as a
security engineer
you'd be protecting information stored
in the cloud from criminals trying to
break in
as an information security engineer your
job will be to protect information
and information assets from unauthorized
access
you're going to be keeping the bad guys
out man i know it's confusing
but in the end it doesn't matter the
truth is that there's no
hard and fast rule now there are some
that have a very strong
opinion on the naming but ultimately
you're responsible for the protection of
your company's digital assets
and a plan for when a network is
breached
on a standard day the life of a cloud
security engineer can look
something like this 9 am analyze 6
gigabytes of log files in notepad
9 30 am advise project stakeholders of
any security policies that may affect a
new cloud hosted project 11
15 am review a potential security
lars what are you on about cloud
security is so much more exciting than
that
for me it means things like helping
developers understand how to use cloud
security paradigms understand how their
data
flows around the internet and through
their cloud providers it also means
helping people understand the risks with
cloud-based applications
all sorts of things can happen in a
typical day i might have a huge amount
of data i need to analyze
and i decide to just spin up a massive
virtual machine in the cloud that's
very very expensive if i run it for a
month but i just chuck stuff at it and i
execute it
over the space for an hour or two turn
it off job done this is part of my cloud
security life
another typical thing in a day for me is
someone reaching out
and asking about why their company has
just had a massive data breach
i had one the other day where i had to
help a company discover that they had
actually appeared in a data breach we
found their data all over the web
not the dark web like the clear web on
all of the clouds
data all over the clouds for me it can
also mean things like
helping organizations understand how
they protect themselves from credential
stuffing attacks
people coming along to their cloud-based
applications and hammering them
with usernames and passwords from other
data breaches people come up
all the time and they say hey troy is
the cloud secure
that's not a good question i can't give
you a yes or no answer for that the
cloud
is differently secure and this is part
of what's so exciting about it the
little
nuances that set it apart from the world
that we're used to and the thing is
that's just
my little cloud security world there's
all sorts of other cloud security worlds
out there we've barely even scratched
the surface
thanks troy for that insight into your
day and for taking over the show
how does a security engineer or an
infosec pro
fight off the bad ninjas trying to make
away with your data
you have to achieve inner peace and
become one
with the cyber not really
the key is to master the three basic
building blocks of information
technology
as well as possess some human skills but
that sounds
way harder than it actually is first you
have computing
this is the hardware that your
application runs on you're watching this
video
right now on computing hardware well
unless you're watching this in the
future and you have a cognitive implant
then you have networking that's the
device that connects the computing
hardware to each other
in this case maybe your brain then you
have operating systems which can be
windows
linux or mac os but also it makes up
all of the networking devices the
operating system makes the computing
work with the networking it's the
beautiful trilogy
of infosec finally you have to have some
understanding of how people work
how they process information how they
communicate
is just as critical the human skills
are just as important as the tech skills
once you have the basic skills covered
the role of a security engineer requires
oversight analytics attention to detail
and the skills to be able to expand
programming and system administration
it's really just about being a jack of
all trades
working in cloud security or infosec can
seem daunting and overwhelming
when you look at the basics to get
started though it becomes
much more bite-sized and delightful
so you want to be a security engineer
but what's next
it's time to put on your hacker hoodie
dial up your cyberpunk and get your
hands dirty
you can get started with the list of
courses and hands-on labs found
with this video or you can check out
other cloud roles become a brilliant
mastermind through data
cloud architecture or devops so thanks
for joining us
and let me know if you like this episode
for more
keep fighting the good fight against
cloud attackers and
keep being awesome cloud security
engineer
infosec guru