Greetings Community! Intro + a Few Questions

[Dan1010]

Hello, Community!  I would like to introduce myself as I plan to be very active. But, also I have a few questions very important to me and I think this is a perfect place for some amazing answers.

My name is Dan.  I am in my late 20's and I have recently decided to make a career out of Information / Cyber Security.  This choice was not easy for me.  My background is in Computer Engineering.  I tend to pursue many interests; so while software engineering, hardware engineering, programming, robotics, etc. are VERY dear to me (and I will dabble in them still),  I think Information / Cyber Security is what I want to do.  I am leaving the military to pursue my passions and to really have the freedom to unleash myself professionally.  Lucky me, I have been doing IT and Information Security already for 5 years. A couple years ago, I passed the CISSP exam and last year, I finally had the experience to take the title!  It felt and still feels great!  I feel really lucky to be part of such a great organization, shared by so many amazing professionals that have the opportunity to do so much good in this world.

My first question: I decided public-sector work isn't my cup of tea.  I guess I'm not entry-level, but something about going from public-sector to private-sector makes me feel unprepared and new.  I have learned to dress myself.  I am learning how normal people network.  I have put the military-unique stuff in the past.  A few good first steps, but still.  My question is,  what advice would you give a young-ish Information Security professional if they told you, "I want to be an ISO.  I want to be a CISO.  I want to be one of the best. And I want to earn my way into a position to, one day, give back to the field" ?

To shake off some of the unprepared feeling, I am going after more certifications.  I have been reading all the magazines and two certifications really stood out to me; the CCSP and SSCP.  I bought what books I can for both; CBKs and Official Guides (Sybex), exam guides (Gibson and Carter), and an official practice test for CCSP.

Question 2,  what resource did you find most valuable for learning the material and successfully passing the CCSP?

Question 3,  what resource did you find most valuable for learning the material and successfully passing the SSCP?  

Thank you in advanced!  Looking forward to all the great answers.

-Dan

[Early_Adopter]

Congrats Dan.

CISO, eh? Keep senses of proportion and humour, understand that ‘the best’ is subjective, and you will have to balance yourself with regards to, what you can do. Try not to burn bridges with people.

I came from a military where I had twelve yours of experience and, slowing down your gearing while learning how to cope with ambiguity are going to help you. Play your strengths, but remember your colleagues going forwards, are on a balance probably more fragile than you were used to so avoid the ‘have a fight and see who’s right’ frame of mind if you can. Your  ability(assumption) to go 18 hours a day for three months won’t bring everyone with you, and you’ll want to slow down eventually.

Attend B-Sides eetc, and throw yourself into a few communities.

CCSP was Moshe Ferber’s delivery of the ISC2 sponsored virtual training - still in the chat group a few years later. Textbook was propbably OK.

I haven’t done the SSCP, but I’d question why you would want it if you had CISSP and we’re looking at CCSP. Those are more consultant/manager/architect carts whereas the SSCP I feel fits more of a SOC Jockey, entry level incident responder. Not saying it’s bad by any means, just that you might spend the time better. Unless of course you wanted to be a SOC analyst or similar.

I’d say most importantly work out who you want to work for and where, then plan your certifications as you do them off that. On joining civvie-strasse for the first time since I was 17 at the age of 30 I took a number of contracts, and moved a lot and it took me three years to find a company I really enjoyed working for, and, I’m still here ten years later.

[Dan1010]

Couldn't agree more.  I'm really glad to say, my experiences have me looking forward to getting away from the military frame of mind.  I really value work-life balance and team-building communication skills now, haha.    

I think the SSCP certification may just be more of a confidence thing.  You're right in asking why I would go for it.  I have a lot of management experience, but perhaps not as much technical, hands-on experience as I would have liked.  If I am understanding the SSCP material correctly, I was reading some articles about where IT and Information Security lie in relation to eachother.  Considering that conversation, it may not be a bad certification to have.  I think I recall reading that the SSCP exam will be offered online come November of this year?  Overall, it doesn't seem as scary as the CISSP exam and could be helpful. 

[CISOScott]

Welcome Dan. I spent 25 years in the government sector. I found that there were a lot of jobs, including security tasks, that were going undone so I volunteered. That gave me the experience I would have otherwise never been given.

Rule #1: Follow your passion. I switched careers 15 years ago to one that I love and I don't feel like I have worked a day since. I feel like I am getting paid to work with, be around, and help people secure their computers. I make more money now than I ever could have made staying in the other field (aircraft painting) and my health is 200% better than it would have been.

Rule #2: Don't be the dept. of No. You have to understand that anyone who comes to you with a request is a customer and they have a need. Your job is to figure out how many options you can provide in order for them to perform that need in a secure manner. Sometimes 1 option is all that is needed. Sometimes you won't be able to find an option that they can afford. You have to look to see how you can help them accomplish their goals if at all possible. Be willing to come up with innovative solutions. 

Rule #3: Work on your skills. Not just book learning and certification test taking, but hands-on skills required in the security field. Set up a home lab. Set one up at work if they have any surplus inventory or inventory they are getting rid of. Every place I have been I have always found old equipment to set up an experimental lab or test lab. This will allow you to avoid the trap of "They won't let me touch the firewalls, servers, etc."

Rule # 4: In order to make it to the C-suite you need to understand the organizational culture and how to communicate effectively. Do not just work on your information security skills. Work on business skills, giving presentations, the power of persuasion, conflict resolution, interviewing skills, management skills and leadership skills. Yes, there is a difference in management skills (managing things/people) and leadership skills (leading people/organizations). Learn that difference. If your boss is holding interviews, ask if you can join in and watch silently so you can see what it looks like from the other side of the table. Once I did that, my interviewing skills improved drastically.

Rule # 5:  Perform job searches for the jobs you want now. See what they are looking for and acquire those skills. Periodically perform job searches for the job you want in the future, not just your next job. Look at CISO job applications now and see what they are looking for. Then work on acquiring those skills too. When you get into management,  don't be afraid to go back down into the weeds to show someone how to do it a better way or to create a process/procedure if one doesn't exist.

Rule # 6: Don't be a jerk. It is amazing to me how many people I was promoted over to get the jobs I got. They were technically qualified, but they were jerks. No one wants to deal with a leader who is a jerk. I didn't back-stab, act in a cutthroat manner or step on people on my way up. Learn the difference between a yes-man and a go to person. Be the go to person your boss can rely on and you will be amazed at how fast you can move up. Learn to do the jobs no one wants to do and do them well. Volunteer. Apply yourself. Be eager to learn new tasks and take them on. Be willing to fail but learning while failing.

I went from a computer operator to CIO in 9 years and to the CISO 6 years later. Yes, I moved where the jobs were in order to get the job I wanted. Along the way I served as a Facility ISO, ISSO, and  ISSM (ISSO Manager) before moving to the CIO of a small military detachment. I then went to Cyber Division Director, Deputy CIO (at a larger organization) and then to the CISO position.  I kept looking for jobs that would stimulate my growth. Now I get paid for what I know, not for how hard I work, even though I still work hard, my work is not hard.

[Flyslinger2]

Having been on the contractor/private sector side of the coin in the DMV for 34 years I've used a phrase repeatedly when working with DoD/FedCIV: "Hurry up and wait".  You have to get used to the stop/starts that are engineered into the Federal bureaucracy of decision making, procurement, integration, implementation, operations, etc.  Every one of those layers has managers that are trying to protect their fiefdoms and their future and you are stepping on their toes because your new fangled tool makes them do something they have no interest in doing.  Add in the constantly legislated unfunded mandates and everyone is grumbling like crazy.  

We all know that the technology life cycle is about 6 months.  DoD/FedCIV is great about stretching that to 10 years.  Try conducting a Risk Management Framework assessment on 10 year old tech and looking the customer straight in the eye and tell them that not only does this fail, it shouldn't be anywhere in a live operation. Truly a challenge.

Getting more certs won't help you navigate this channel any better.  It wasn't 'til my 34th year of professional IT work that I even bothered to get a cert. Another long discussion for another time. Short conclusion is I think that vast majority of them are needless and/or ginned up by external political factors.

But its all still very rewarding and fun.  Experience and mentorship is the best way to accelerate your career path. You have started the right way by asserting yourself in this forum.

[rslade]

> Dan1010 (Viewer) posted a new topic in Career on 08-19-2018 02:13 AM in the

> Hello, Community!  I would like to introduce myself as I plan to be very
> active.

Active is good.

> But, also I have a few questions very important to me and I think this
> is a perfect place for some amazing answers.

Probably not perfect, but some may be amazing (in one way or another).

(Pro tip: if you can tell the difference between good advice and bad advice youu
don't need any advice ...)

>   My name is Dan.  I am in my
> late 20's and I have recently decided to make a career out of Information /
> Cyber Security.

OK, you're a newbie. That's not a bad thing: everybody has to start somewhere.
But know that you've got a long road ahead of you.

>  This choice was not easy for me.  My background is in
> Computer Engineering.  I tend to pursue many interests; so while software
> engineering, hardware engineering, programming, robotics, etc. are VERY dear to
> me (and I will dabble in them still),  I think Information / Cyber Security is
> what I want to do.

That breadth of interests is good. To be really good in ifnosec you *have* to be
willing to pursue lifelong learning, and to get into everything you can. Personally,
I'm in infosec because it demands breadth, and everything you learn, about
anything, has some kind of implications for security somewhere.

>  I am leaving the military to pursue my passions and to
> really have the freedom to unleash myself professionally.  Lucky me, I have
> been doing IT and Information Security already for 5 years. A couple years ago,
> I passed the CISSP exam and last year, I finally had the experience to take the
> title!  It felt and still feels great!  I feel really lucky to be part of such
> a great organization, shared by so many amazing professionals that have the
> opportunity to do so much good in this world.

OK, this modifies things slightly. You're still a newbie: the CISSP considers five
years to be a base of experience. Welcome to the fold.

The military background is good, particularly in probably giving you a better
grounding in management than most achieve coming in via the straight technical
path. Management is very important. You will have to learn some things in
civvie security that are different from those in the military, and particularly some
of the jargon. But it's a good start.

Also, what fields/domains of security have you been working in?

>   My first question: I decided
> public-sector work isn't my cup of tea.  I guess I'm not entry-level, but
> something about going from public-sector to private-sector makes me feel
> unprepared and new.

Well, it depends. For most things above base admin, yes, you are kind of entry-
level.

>  I have learned to dress myself.

I haven't. Not for business/fashion. Everyone has a fashion sttement, of course:
Gloria says mine is, "Hey, I got dressed, didn't I?"

>  I am learning how normal
> people network.

Networking is good, and it's a way to learn what you don't know, but it's not the
magic that most people say it is. Remember that, when "networking," you are
building a base of people who are, basically, your competitors. If you can find a
generous mentor in there, great. But don't hold your breath.

>  I have put the military-unique stuff in the past.  A few
> good first steps, but still.  My question is,  what advice would you give a
> young-ish Information Security professional if they told you, "I want to be an
> ISO.  I want to be a CISO.  I want to be one of the best. And I want to earn
> my way into a position to, one day, give back to the field"?

OK:
1) Good ambition.
2) It's going to take some time. Be willing to give it time.
3) Learn. Everything. Do a search on this site for "resource" or "resources" and
start reading those threads. (Actually, do a search for "Ross Anderson" and you'll
find most of the good ones.) Read "Security Engineering" by Ross Anderson.
4) Read books. http://victoria.tc.ca/int-grps/books/techrev/mnbksccd.htm
5) Subscribe to RISKS Forum Digest http://catless.ncl.ac.uk/Risks/
and if you want to play with the big boys,
6) join the CISSPforum
https://community.isc2.org/t5/Welcome/CISSPforum-replacement/m-p/11006

>   To shake off
> some of the unprepared feeling, I am going after more certifications.  I have
> been reading all the magazines and two certifications really stood out to me;
> the CCSP and SSCP.  I bought what books I can for both; CBKs and Official
> Guides (Sybex), exam guides (Gibson and Carter), and an official practice test
> for CCSP.

There's a discussion here on multiplying certifications: go after the work, first.


====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
The magnificent and the ridiculous are so close that they touch.
- Le Bovier de Fontenelle
victoria.tc.ca/techrev/rms.htm http://www.infosecbc.org/links
http://blogs.securiteam.com/index.php/archives/author/p1/
http://twitter.com/rslade

[Dan1010]

CISOScott,  I really enjoyed your response.  I have been reading so many articles recently and you spoke to all my favorite topics.  It is really nice to see these themes again and reassuring that I am getting great information.  Really appreciate it.

Flyslinger2,  hahaha, I have seen a few of those situations and they get me every time.  Really is difficult.  What is the best solution you have found for customers like that?  A customer or organization that has very weak information security while the value of their assets are demanding that they do have decent information security practices. I ask because I have been considering going for a MBA with Information Security concentration; hoping that well give me the edge there and the C-suite language.  I have seen many books dedicated to translating IT/Information Security into business/C-suite speak too, if anyone has any recommendations.  Thanks!  I'm glad; I am looking forward to finding some mentors. 

rslade, I do enjoy lifelong learning.  A lot.  Great to see others here for that same reason.  Always new and interesting information.  It is kind of difficult to say which domains I have worked in; military officer-side throws you into everything.  When I completed my CISSP resume, I touched every domain except Security Assessment and Testing and Software Development Security, if that helps.  Thanks for the readings and forums links!  I will check them out. 

[Steve-Wilme]

Dan,

I'd be wary of seeking to be a CISO without the experience to handle the senior level company officers you'd encounter.  Being a CISO is more about understand company strategy, it's customers, the board and internal politics as it is about understand the subject matter of InfoSec.  You could be an exception engineer, fantastic security architect, great strategist and brilliant security programme manager and yet still not make the mark to be a CISO.  By taking it one logical step at a time and looking 3 to 5 year ahead you're far more likely to come across as credible and employable in the private sector.

[Flyslinger2]

It boils down to whether they want to obey the law or not and the chain of command.  I know that sounds simplistic but it is really is where it is at.

I try to work with them, because I really do want this to work AND be secure.