KNOW THIS BEFORE STARTING YOUR CAREER IN CYBERSECURITY

START YOUR JOURNEY IN CYBERSECURITY EQUIPPED

The knowledge obtained from “Introduction to cybersecurity” has given a clear understanding of the history of cybersecurity and a close summary of the definition of cybersecurity.

However, the first history depicts on how cybersecurity came to prominence from the early Morris virus attack. This, has created a huge contradiction when individuals intend to venture into cybersecurity, their excitement stems from their personal believes to start hacking like a professional Blackhat and creating havoc in the cyber-world, and the Hollywood movies and the media at large, has not been able to do justice to the career as well.

When you ask an individual why do you want to venture into cybersecurity, their excitement and response always are “I want to be a hacker.”  I myself is not exempted, but also a deep dive into the career path has shown that the predecessors or should I say OG’s (Old Generals), who have navigated the career path hasn’t been able to shed light on cybersecurity like other career path such as software engineering; even other digital passive income avenues are the worst, when you navigate through various YouTube channels, you notice click-bait words like “ Hack like Mr. Robot, How to break into a secure facility, Bypass antivirus installed in any systems, how to hack your neighbor’s Wi-Fi, build your own ransomware etc.” the click bait words are endless reading about such, it breaks my heart knowing most viewers accessing such channels are obtaining the right knowledge but with the wrong mindset. 

Then we have those who have been able to understand what cybersecurity is all about but do not wish to expand their career path due to certain factors such as not enough time to study (they say, wish it was the truth lol!), certifications involved to navigate the various path is quite expensive (there is an element of truth in this, but you can sacrifice now to have fun later), and then we have those who are not up for the stress (they just want to take a simple journey not bad at all but there is no fun in that), this has given rise to a lot of professionals saying that the cybersecurity field lacks enough or qualified candidates in the profession, and this right here is nothing but the truth.

AS A NEWBIE IN CYBERSECURITY WHAT SHOULD I KNOW?

Firstly, if you have read this far, without skipping any lines of the boring stories I say to you, congratulations!!! you are ready to know what to do to get into cybersecurity, because to be anything in cybersecurity your level of patience has to be extreme, as most of the work seems boring for a less patient individual or person who isn’t passionate about the profession.

I have browsed a lot of forums and when I hear people say the word “cybersecurity is hard (This arise from them thinking cybersecurity is all about coding.)”, I chuckle and smirk at the same time (no not making fun of them), It is just the story of an individual then sharing in a forum of group of persons (who might not have enough motivation), become demotivated, and hence they end up not becoming whom they were meant to be.

 Rabbit the cybersecurity newbie. 

When I ask you what do you do in cybersecurity? Let me guess your response, “How to search for the vulnerability of a system or break into a system, and find ways to secure the system, become an ethical hacker.” If I am not wrong, this certainly is your answer or should I say close to your answer (No I am no Wizard or Sorcerer), it is just the most common answers you will get out there.

That being said, that doesn’t do justice to the profession as a matter of fact is a ridicule to cybersecurity, is like mentioning a continent such as Africa like a country, not knowing Africa comprises of (Nigeria, Togo, Ghana, Chad Cameroun, Gabon, Tanzania, and more). It doesn’t do justice to those who desire to see various countries in Africa, have the dream and aspiration to visit them, enjoy their culture, religious believes, and food. So also, is cybersecurity. Cybersecurity is not about hacking or hackers trying to steal your data or information, or is cybersecurity channeled to just penetration testing etc. Cybersecurity is vast, and as technology grows further there would always be need for new departments or should i say sectors of cybersecurity (not a politician but I guess you grasp the entire idea).

In the profession, not everyone is gifted, and also some are gifted in certain areas, but the ones we often neglect are the unicorns, the ones gifted in all areas but do not know, often as a result of not having adequate resources hence their flower never blossom. This gives rise to a lot of professionals saying the field cybersecurity lacks lots of skills, while they also hiring is not willing to give room for new candidates to work hard and prove themselves. Well, is it the money craze? Or lack of employer trust that the employees haven gained from them might leave in the future for a better pay offer. Well enough of the stories.

Therefore, get to know this before venturing into cybersecurity as it does will help you to be armed with the appropriate skills and build trust to your future employers not having the mindset that you are an empty barrel to be loaded for another cooperation to hunt and make their big kill (popular in business), with your previous employer feeling used (After gaining experience and leaving them). There are various departments in cybersecurity, research in depth what your heart resonates with, then transcend on that path, and if you are a unicorn great the field needs more of your kind.

THE VARIOUS DEPARTMENT YOU NEED TO KNOW BEFORE VENTURING INTO CYBERSECURITY:

Therefore, as a newbie who intend in knowing or is confused about the career cybersecurity, understand that these various departments are all cybersecurity and that cybersecurity is not “Ethical hacking alone or Penetration Testing.” My goal is that after you are done having this knowledge you will be able to have a smooth navigation on the choice you have decided to make for yourself.

Cybersecurity comprises of the following professional sectors:

1. CHIEF INFORMATION SECURITY OFFICER (CISO): Individuals or persons working in this department are responsible for the entire security of information (Information security) in the organization they work for. This role can be likened to a chief of staff (like the military) in the organization information security. The job role of A CISO belongs to the C-level category (responsible for the entire cybersecurity and IT department of that organization), they are held to a great responsibility and their decisions impact the entire information security and cybersecurity of their organization. To apply or categorize oneself as a CISO, at least one should have a minimum of 15-years’ experience, certain certifications in cybersecurity, and having an MBA is compulsory. 

2. SECURITY ENGINEER: The security engineer is responsible for building, maintaining, and debugging systems that hold sensitive information’s (information security systems), they are responsible for the security efficiency of software application before being deployed. They can work as professional service arm of vendors, and as a part of organizational projects (government, multinationals, and non-profit)

3. SECURITY MANAGER: The role of a Security Manager is categorized unlike that of a CISO, security manager roles are mid-level managerial positions in large enterprises or businesses. The security manager has their responsibilities in specific area of the security of Information. A security manager might be responsible for securing the organization firewalls and internet servers, the other security manager might be responsible in ensuring that the entire staff and team of an organization has a proper security training, the other might be responsible in ensuring physical security. The role of a security manager is limited to the department they are assigned to or responsible for.

4. SECURITY DIRECTOR: The role of a security director is associated with overseeing the information security of an organization. Big organizations usually employ various security directors, to be responsible for sub-division of the organization information security program, and they convey all information to the CISO (Chief Information Security Officer). In the case of smaller organizations, the security director can serve as CISO (smaller organization can’t afford paying a CISO), imagine forking out $260,000 (minimum) annually to pay a CISO, hence smaller organization have no choice than to allow the security director to serve as a

5. SECURITY ANALYST: The word analyst has to do with analyzing or analysis. The role of a security analyst, is to prevent the breach of information security. They review both existing systems, study new emerging vulnerabilities, threats and attackers’ mechanism. This helps them to provide efficient and adequate cyber secure and information secure of their organization.

6. SECURITY ARCHITECT: Architects are associated with designing infrastructures. In cybersecurity, the role of a security architect is to design and monitor the deployment of organization information security elixir (countermeasures). A security architect has to understand, design, and test security infrastructure in its complexity, as well as serve on a regular basis as a group of the security team member involved in the organizations project outside the security department. The role comes with great responsibility it may involve in assisting in the design of the security in an application built by their organization, or assisting the network engineer in designing the layout of the IT networking facilities.

7. SECURITY ADMINISTRATOR: The security administrator (also known as sec-admins), are more focused in details specific area of information security, and systems in general. They are responsible for installing, configuring, managing, and troubleshooting information security and data recovery. They are commonly known as security personnel’s (commonly tag by non-professionals as IT girl or IT guy or IT department), when facing technical problems with facilities they work with in the organization.

8. SECURITY AUDITOR: The word “Audit” sounds like taking inventory or stock of something. The Job of the security auditor is same as an auditor in a financial firm, however in cybersecurity a security auditor, ethically conduct security audit. The audits, involves security of the technologies being used, procedures, and as well security policies etc. They ensure that everything works as intended, as well as without any flaws effectively and efficiently protecting the organization data, systems, and entire network.

9. CRYPTOGRAPHER: I urge you to read about cryptography. The cryptographer are professionals specialized in encryption, which is used in guarantee confidentiality of sensitive data. The cybersecurity Jobs related to cryptography are mostly found working with the government of a country or the military department of a country as this sector work with protecting its citizens and running economy of a state (which is quite a large asset or data) if gotten into the wrong hands. Cryptographers are not limited to encryption, but also hashing, digital certificates and many more. The cryptography sector has people who work as cryptanalysts they focus more on breaking encryption as well as analyzing data’s that are encrypted to ascertain how secured the encrypted system or data is, and in most cases to decrypt the information that was encrypted by the cryptographer.

10. VULNERABILITY ASSESSMENT ANALYST: If you haven’t come across the word vulnerability, do not worry we would talk about it in detail in more subsequent articles. Ok enough of the stories. The Job of a vulnerability assessment analyst is to examine applications, computer systems, databases, organization network as well as the infrastructure of the organization to find loop holes or weakness that could be a threat to the organization they work for. They are personnel’s with explicit permission granted to them to conduct such assessment. They are not external threats or outsiders who try to find a way to gain access to the organization infrastructure or information security, rather they are legitimate insiders who have been granted the authority to have access to the organization systems. Hence, they have the authority and ability to examine in depth of the organization systems from the start.

11. ETHICAL HACKER (PENETRATION TESTERS): These are the polarity of the bad guys (the cyber criminals, hackers or non-ethical hacker). There area of expertise is to attack, or find a way to penetrate (breaking into), and compromise the system and network of an organization. The reason they are ethical (good conduct), is that they have to request and be granted explicit permission of the organization whose technological infrastructure they are trying to hack. The permission granted is limited to the areas of which the organization wants their hacking to be focused or limited to. The purpose of the ethical hacker here is to discover security vulnerabilities (weakness) and call the organization attention to it for a quick remediation. They are commonly called pen-testers and their occupation is penetration testing or ethical hacking, but are mostly known as penetration testing.  The Job of an ethical hacker (penetration tester) is quite large from generalist, down to read teaming. We will discuss this in subsequent articles.

12. SECURITY RESEARCHER: I guess you are surprised? Yes, in cybersecurity there is a sector responsible for security research. The security researchers are departments who employ their specialty in discovering vulnerabilities that are existing in systems and potential issues that may arise in new technologies and products. The security researcher often times develop new security models and advance towards their research. The security researcher must also have permission either from the government (In the case of working for the government of a country), or an organization (in the case of working for a cooperate organization), as not obtaining permission is considered breaking the law.

13. OFFENSIVE HACKER: The offensive hacker, specializes on either to obtain sensitive information or destroy the adversary’s system. The nature of offensive hacking is regulated and restricted by law, hence to be a legal offensive hacker you should be aligning yourself in seeking such jobs with the government (the government is the law) as they are legalized with the intelligence agencies and armed forces. However offensive hacking requires security clearance (as the government wouldn’t want to employ someone who might go rogue someday).

14. SOFTWARE SECURITY ENGINEER: The sector of software security engineer is concerned with integrating security into software during design and development stage. They are responsible for testing software’s to ascertain if there still some vulnerabilities in it, and fix it before it is deployed. Most software security engineers are also the ones who develop the software itself as they have both knowledge and good security practices’ in coding.

15. SECURITY CONSULTANT: The role of security consultant is not limited to one specific area. It consists of different types. The security consultants range from advising cooperate executives on best security strategies, they also can serve as expert witnesses, and contribute towards the growth of a company, and success. Certain security consultants can be hands-on penetration testers, others may be responsible for the designing and operation of components of security infrastructure, that specialize in certain technologies. The security consulting area comprises of all sectors of information security.

16. SECURITY EXPERT WITNESS: The job role of an expert witness are more aligned to the judicial system. To be considered a security expert witness, one must have acquired so many years at minimum 2-decades (20-years) of experience, in the area of security they are called by a judicial panel to testify against.

Example: A forensic investigator who has practiced for over 20-years, if called by a judge to testify if the evidence gotten from a compromised server, is reliable and not tampered with, should be able to prove to the judge that the evidence is to be trusted. This comes with their years of dealing with forensic investigation with regards to server attacks, they are well grounded and can prove with no doubt why such evidence gathered in the current investigation is reliable.

There statements are trusted by the judge who depend on them to provide “expert opinions” related to the matter that is investigated.

17. SECURITY SPECIALIST: The position of a security specialist is a term referring to persons who serves in various types of roles. These roles requires that the individual have many years of professional experience working in the field of information security.

18. FIRST RESPONDER (INCIDENT RESPONSE PROFESSIONALS): They are the first responders in the occurrence of security incidents. When an organization experience a cyber-attack, they are the department responsible for containing and eliminating such attacks, and help in the recovery process while minimizing the damage cause by the cyber-attack. The first responder analyses what happened and ascertain if corrective activity is required or not. The department often deal with dangerous cyber warfare attacks that has occurred.

19. FORENSIC ANALYST: You might think that the job of A first responder and forensic analyst are similar, but that is not true. A first responder often has to do with contain evidence (in the case of a cyber-attack which occurred), while a forensic analyst is one who is given the evidence to analyze. The forensic analyst examine data, computer servers, computers and computing devices, as well as network to gather the evidence contained (by first responder) and analyze as well as properly preserve the evidence and deduce what exactly occurred, how it occurred, and who made it to occur. Their job role can be likened to that of law enforcement and insurance company investigators that analyze in the event of a fire outbreak of what happened and who was responsible for such outbreak.

20. CYBERSECURITY REGULATIONS EXPERT: People who work in this sector specializes on having wide knowledge on regulations related to cybersecurity and ensures that their organization adheres to such regulations.

Example a cybersecurity regulatory expert who works for an Ecommerce company that conducts business globally or to citizens of the EU irrespective of where they are located, should be aware of the GDPR 2016/679 (General Data Protection Regulation) A regulation in the EU on data protection and privacy in the EU and EEA (European Economic Area), and ensure the regulations compliance by the ecommerce company they work for, as failure to do definitely will attract heavy sanctions  (you do not want to be responsible for such event as a result of lack of proactiveness)

21. PRIVACY REGULATIONS EXPERT: If you decide to go on a career path as a privacy regulation expert, one caveat is that you have to be on your toes researching and reading a lot of Acts and laws, as the global world (all countries), role out various laws daily, monthly and yearly. The Job description of a privacy regulation experts are related to all matters regarding privacy and ensuring their organization adheres with such regulations. They might at most but not always be attorneys with lots of experience in the past, working with various regulatory compliance matters.

Example: A cybersecurity privacy regulation expert working for an organization that deals with health must ensure the organization adheres to the HIPAA Act.1996 (Health and Insurance Portability and Accountability Act), a federal law that is responsible in ensuring the creation of national standards which protects sensitive health information of patients from being disclosed without the knowledge of the patient.

Put your comments below in the comment section on your thoughts about this.

Find this article and information helpful? Show some love and support  “Click-Here”