Hacking the Industry S. Malone & N. Beddome. Page 1

Transcription

1 Hacking the Industry 2012 S. Malone & N. Beddome Page 1

2 Step 1: Build Your Tool Kit Page 2

3 What Your Tool Kit Should Contain To be successful in the industry just like in a penetration test you need a robust tool kit. 5 P s Approach Research Entry Level Certifications & Degrees Developing Basic Aptitudes & Skills Page 3

4 5 P s Approach Proper Preparation Prevents Poor Performance Page 4

5 Research Do it early Do it thoroughly Identify: What the industry wants What you want Personal strategy that satisfies both Page 5

6 Entry Level Certificates Select certifications that serve your goal Security+ CEH [Others, depending on your goal] Page 6

7 Basic Aptitudes Look for something that sets you apart and makes you valuable to as an employee Problem solving Troubleshooting Web-Design Public Speaking Self-Management Computer Repair Page 7

8 Step 2: Conduct Reconnaissance Page 8

9 Top Down Approach Industry Team / Region / Office Needs Market Position Leader Priorities Focus Company Corporate Values Your Role Page 9

10 Step 3: Gain Access Page 10

11 Getting in the Front Door Don t give up! Instead, try to: Set yourself apart Escalate your approach Widen your net Follow up Page 11

12 Set Yourself Apart Define your unique offerings To yourself To an interviewer Prevents landing in the slush pile of similar applications Page 12

13 Escalate Your Approach Know the industry-standard approach to the application process Know when to push those boundaries Know when to stop so you aren t booted back out the door Page 13

14 Widen Your Net If at first you don t succeed Adapt your standards Change your scope Evaluate your expectations Be flexible Page 14

15 Follow Up Don t let them silence you out the door Always follow up Continue to do so until you receive a concrete answer or next steps Page 15

16 Step 4: Escalate Privilege Page 16

17 Find Your Niche What is lacking in your organization? How can you fill that hole? Be as valuable as possible to as many people as possible Page 17

18 What is Your Goal? What do you want to be doing in 10 years? Penetration Testing Security Architecture Security Management Your Own Company Page 18

19 How do you get there? Look at job postings and talk to people who have that role What do you lack that is required for that position? Experience Training Certification Page 19

20 Certifications Primarily book knowledge Useful to get to the interview stage Acting like certifications should matter to a security industry veteran is a Bad Idea Page 20

21 Security+ CompTia Security+ Entry-level general-purpose security certification Experience Requirements Format Value to HR Value to Peers None Multiple-Choice Medium Low Page 21

22 CEH Certified Ethical Hacker Entry-level penetration testing certification Experience Requirements Format Value to HR Value to Peers Formal training or 2 years professional experience Multiple-Choice Medium Low Page 22

23 CCNA Cisco Certified Network Associate Entry-level networking certification Experience Requirements Format Value to HR Value to Peers None Multiple-Choice & Simulation Tests Medium Medium Page 23

24 OSCP Offensive Security Certified Professional Mid-level penetration testing certification Experience Requirements Format Value to HR Value to Peers None Live, limited-time capture-the-flag challenge Medium High Page 24

25 CISSP Certified Information Systems Security Professional Mid-level general-purpose security certification Experience Requirements Format Value to HR Value to Peers 5 years professional infosec experience (waivers available) Multiple-Choice High Low Page 25

26 CISA Certified Information Systems Auditor Mid-level IT auditing certification Experience Requirements Format Value to HR Value to Peers 5 years of professional information systems auditing, control or security work experience (waivers available) Multiple-Choice High Medium Page 26

27 Step 5: Pivot Page 27

28 The Aggressive Career Cycle Recruited: new challenges and required skills Competent: able to perform as expected with enthusiasm Recruited Optimized: performing all duties at peak efficiency and interest Plateaued Competent Plateaued: doing the same tasks repeatedly with little engagement Optimized Page 28

29 Passive Marketing Recruiters are out there looking make it easy for them to find you! Google yourself; know what s out there How would this look to a hiring manager? Page 29

30 LinkedIn Primary way that recruiters find candidates Fill it out include: Work history Certifications Skills Photo Contact Information Page 30

31 Personal Website Cover Letter Photo Resume Projects Contact Information Page 31

32 Page 32

33 Page 33

34 Networking Conferences Industry organizations Page 34

35 Step 6: Maintain Access Page 35

36 Fallback Plan If I were let go tomorrow, I would. Know what companies you would look at Know what recruiters you would talk to Know who could provide a good reference Page 36

37 Continual Improvement Don t go stale! Keep learning. What are the emerging trends in security? Change your niche as necessary the market for COBOL programmers is small. Find and minimize your weak points. Page 37

38 Soft Skills Be able to: Listen Speak Write Manage Projects Interview Page 38

39 Questions and Discussion Page 39