topic Do you need development or programming experience? in Career Discussions

Do you need development or programming experience?

scmunk — Thu, 02 Nov 2017 14:46:39 GMT

There are many different types of information security positions covering compliance to architecture. Do you think it is better for an information security professional to have actual development or programming experience?

I think it is very beneficial in many areas, and is good for increasing career opportunities. Here are a couple of examples:

Securing the SDLC
Understanding coding vulnerabilities
COTS assessments
Building application level defenses
Applying access control and IAM
Selecting the right controls
Describing and consulting on security requirements
Writing scripts
Understanding application/API proxies
Knowing how contingency and resiliency is implemented
Exposure to databases or data manipulation
Exposure to common data formats like XML and JSON

Ron Parker CISSP, CCSP

SCMunk

Re: Do you need development or programming experience?

CISOScott — Thu, 02 Nov 2017 15:29:28 GMT

Yes having the experience helps. Anytime you have experience in doing the work, it makes it easier to protect it. Hacking is all about making things behave in ways that were not expected. If you do not fully understand the expected behavior, you will not be in the best position to protect it, or you might suggest the wrong thing.

There is currently a discussion going on in the business world on whether it is better to have a CEO that has knowledge but is weak in many areas or has limited knowledge but is strong in those few areas. Some research says it is better to hire the specialist rather than the generalist. I would argue that it depends on the situation the company is going through.

The same can be said for hiring a supervisor. Do you want someone with strong managerial skills but no knowledge or limited knowledge of the work over which they are supervising or do you want a strong technical person that you will have to give time to learn the managerial roles? I vote for the latter (tech skills) because if you do not have strong skills your employees may be able to lie to you and you may not have enough info to dispute it. But then again the situation could be dependent on other things.

Re: Do you need development or programming experience?

jwilsonjx — Thu, 02 Nov 2017 20:53:39 GMT

I think you provided a nice summary of the benefits of a development background. Some additional benefits I would add are the ability to speak with the same vocabulary as your developers. This helps to ensure there are no misunderstandings.

Additionally, when covering topics such as the OWASP TOP 10, being able to explain remediation steps in terms a developer can understand helps to foster a feedback loop between security and development.

Lastly, it empowers security teams to trust but verify when it comes to looking under the hood to see just what your developers are doing.

Jason Wilson CISSP, CSSLP, CCSP

Re: Do you need development or programming experience?

DAlexander — Fri, 03 Nov 2017 08:16:57 GMT

This is a great question and has been debated at great length by most, if not all, professionals in technical fields of work. In my opinion, it really depends on the information security professional's scope of responsibilities. If you are leading a small team of technicians responsible for testing and implementing security patches and software upgrades then it would definitely help to know the technical details. It's even more important however, to be able to translate those technical details to normal <insert language here> for your supervisors to get their approval and commitment.

Now, if you are leading a large division made of many teams then you will most likely never need to see the 1's and 0's of it all. You may not have programmed since learning COBOL but that's ok. At that level, it is much more important to see the "big picture" and ensure your teams have the training, resources, and confidence to do the job.

That said, I am a strong advocate of lifelong learning. Not necessarily to be able to sit in the driver's seat and sling code but to understand trends.

Re: Do you need development or programming experience?

scmunk — Fri, 03 Nov 2017 12:10:09 GMT

Isn't everything a rehash?

Yes, once you have a basis for understanding it doesn't mean you have to be a Top-Coder. It just means you can translate and relate vertically whether up or down.

For me it also adds a level of realism outside the academic realm. So at the end of the day your advice or solutions are more valuable.

--Ron

SCMunk

Re: Do you need development or programming experience?

CISOScott — Fri, 03 Nov 2017 12:19:54 GMT

Hands-on experience does make a difference. I have heard complaints from other in my field that we (the security community) are sometimes graduating people with knowledge but no (or very little) hands-on experience with the technologies they are going to be attempting to protect. This hampers them on the job when things don't work like they did in the 30 minute lab at school. Labs are often virgin systems that get wiped between classes so you have a very easy and new set-up each time. The real world isn't like that.

Re: Do you need development or programming experience?

dbanks24 — Sun, 26 Nov 2017 21:43:29 GMT

I sure do, but how much does this cost? Where can I get the education for this?

Re: Do you need development or programming experience?

scmunk — Sun, 26 Nov 2017 23:36:38 GMT

If you are already into the InfoSec world there are plenty of resources for you to do work on your own. It really depends on your current area of concentration in InfoSec. Having familiarity in these covers a lot of area plus it helps if you are in the software assurance area. Look at this not-so-all-inclusive for example.

JavaScript/HTML so you can understand and prevent so many of the web-based attacks.

http://eloquentjavascript.net/

https://javascript.info/

Python can be used for file processing, data crunching, creating security tools, is the language used by many security tools on the market today.

https://www.amazon.com/Black-Hat-Python-Programming-Pentesters/dp/1593275900

https://developers.google.com/edu/python/

PowerShell if you do anything with Windows resources. It is the defacto Microsoft scripting tool.

https://docs.microsoft.com/en-us/powershell/index?view=powershell-5.1

SQL, even though it have many variants, they are similar enough. It will also help to have basic database skills too.

https://www.w3schools.com/sql/

http://www.sqlcourse.com/

Go(lang) has been a growing area for several years because of its association with Docker. It is a very utilitarian language that is mostly self-contained. Plus it generates stand-alone EXEs out of the box.

https://tour.golang.org/welcome/1

https://www.tutorialspoint.com/go/

Plus a book on Security Engineering.

http://www.cl.cam.ac.uk/~rja14/book.html

Security Lifecycle/Coding

http://www.opensamm.org/

https://www.owasp.org/index.php/Main_Page

https://www.edureka.co/blog/devops-tutorial

There are also plenty of free cloud resources. You can get free accounts with Microsoft and Amazon for a year at least. You can set up your own development area.

Hope this helps.

Ron Parker CISSP, CCSP

@scmunk

Re: Do you need development or programming experience?

JoePete — Mon, 27 Nov 2017 22:46:11 GMT

Certainly it depends on what you do, but I think some kind of programming and development experience always makes for a better security professional. Even someone works in big picture, strategic areas, the ability to understand the specifics of software based vulnerabilities and their exploits is extremely valuable. Pull any category you want from the CVE, it's not like these things are easily grasped concepts. I think you need some practical experience with them.

Re: Do you need development or programming experience?

wimremes — Mon, 04 Dec 2017 00:06:27 GMT

I think you just can't be an effective security professional without some level of coding experience. As everything our businesses use and rely on has become code (literally everything), we need this knowledge. Understanding development teams and working with them as they push products towards a deadline (ha! no release == no income for your organization. Deal with it!), can only be done by professionals that lived it.

Just the other week I sat through an ISO audit with one of my clients. We rely heavily on AWS and most of our infrastructure is deployed using code. Spinning up a client environment is 100% scripted. The auditor had never seen this and it wasn't the most pleasurable experience walking him through it.

Re: Do you need development or programming experience?

VinnyR — Fri, 15 Dec 2017 15:34:32 GMT

I believe you can function without it, but it always helps to understand the people that you are working with.

I had 10 years dev experience before moving to a security role (also 10 years). I really see the difference in some of my security specialist colleagues especially when it comes to understanding the complex dependencies and effects that making changes in software has on other parts of a system. To many security consultants it is clear cut that the risk of a vulnerability overrides any other consideration, but the complexity of software especially in enterprise systems makes such decisions complicated. Understanding the development processes and the time it takes to verify knock-on effects of a change is essential and it is difficult to do if you don't have the experience.

I also see this in the CISSP materials on software development. The assumption seems to be that many developers do not care about security, although my experience is that this is far from being the case. Often it is the security education & training that is lacking and that is for all of us to address within our organisations.

Re: Do you need development or programming experience?

Ravenshroud — Sat, 27 Jan 2018 18:42:43 GMT

The answer to all 'do you need or is it valuable questions' is very simple.

You do not need ANY particular experience or education to find a job. However, the broader and deeper your experience and knowledge the more opportunities that will be available to you.

Depth and breadth will eventually compete with each other. You CANNOT be a master of all. Do what you enjoy.

I enjoy people and hate head-down analysis. I could never be a hunter.

I lead down well, but lead up poorly, so the management, director, CISO chain is not good for me as politics becomes more and more of the job.

I am organized and a good mediator so I lead projects and programs and there are plenty of opportunities.

Re: Do you need development or programming experience?

sharadtricks — Mon, 18 Mar 2019 15:19:47 GMT

Check DevOps interview Questions

Re: Do you need development or programming experience?

Shannon — Mon, 18 Mar 2019 19:04:48 GMT

The answer depends on what you do --- including what you deal with in your line of work, your role in an organization, and your place in its hierarchy.

For example, a CISO should have excellent managerial abilities but wouldn't need technical skills, although having these or a good know-how is a definite benefit. A penetration tester or system analyst should have technical expertise relevant to systems being used, with acceptable communication and interpersonal skills.

Skills should be backed by experience, as was concluded in many posts in the community, including this one.

To analogize, a diplomat who's adept in multiple languages that are spoken where he's stationed would be better off than one who's dependent on an interpreter...

Re: Do you need development or programming experience?

rslade — Wed, 20 Mar 2019 17:45:13 GMT

> Shannon (Community Champion) posted a new reply in Career on 03-18-2019 03:04 PM

> For example, a CISO should have excellent managerial abilities but wouldn't need
> technical skills, although having these or a good know-how is a definite
> benefit.

In general, I would agree with this. However, in the case of delevopment and
programming, I would tend to suggest that this *is* a skill you should develop.
Not that you need to become a programmer, but, in the current tech and security
environment, there are too few security people who know how to program (and
too few programmers who *care* anything about security).

I would suggest learning about half a dozen languages, at least one of which should
be assember or ML. (That's "machine language," not "machine learning,"
although learning an AI language would be another specific suggestion, because
they tend to be distinct from procedural or object languages.) This means you
know "programming," not just a coding vocabulary. That might sound like a lot
to do, all at once, but you can make it a long term goal and do, perhaps, a language
a year.

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Brevity is the soul of lingerie. - Dorothy Parker
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

In this blog post, you will get a comprise list of top DevOps interview questions

rocksy — Sat, 22 Feb 2020 12:34:27 GMT

Thanks for your suggestions Sharad your blog is not now trending if you want to know DevOps interview questions just visit at Courseya:- https://www.courseya.com/