Tisiphone

As a counterpoint for this fluff piece for Pluralsight (mentioned 29 times), I'd like to offer the following links with very good information by well respected people in the industry: - https://www.corelan.be/index.php/2015/10/13/how-to-become-a-pentester/ - https://tisiphone.net/2015/10/12/starting-an-infosec-career-the-megami… - https://danielmiessler.com/blog/build-successful-infosec-career/

You have a long but very interesting road before you. Infosec is huge. Lesley “hacks4pancakes” Carhart has a great series which provides an overview of what you can choose from: https://tisiphone.net/2015/10/12/starting-an-infosec-career-the-megami… If you're serious about infosec and not just want to run tools and call it a day, I suggest covering the basics first: - programming: would be cool if you learn not only some language but programming “as art and mindset” in general. This includes your typical Computer Science courses, algorithms etc. Great if your school or university teaches those but you can always fall back to online education platforms. When it comes to language, I'd recommend Python over Ruby. Granted, the latter powers Metasploit, but a lot more tools and wrappers around tools are written in Python. Once you know Python, creating Metasploit modules won't be a problem because a lot of things are handled by the Metasploit Framework. Also, this comes from a highly subjective Python developer but suggest to learn Python 3, despite a lot of infosec tutorials and tools still using Python 2 (e.g. socket programming). It's easy to fall back to Py2 if you need but you'll have the power of latest and greatest if you go Py3 because not everything is backported. Most books contain a lot of useless material and are pretty slow-paced and I'm not a fan of “Learn Python The Hard Way” either. I personally started with “Learning Python” by Mark Lutz; after…

Leslie Carhart, a relatively well known infosec community person posted about this: https://tisiphone.net/2019/01/28/security-things-to-consider-when-your… Turns out she was right... https://twitter.com/CharlesDardaman/status/1101626510333673474

The advice is pretty good overall, but the excessive profanity is unprofessional and distracting. It is interesting that he values "SANS" certifications, but not the courses for them. Besides my own rambling[1] you might find these resources valuable instead: * https://tisiphone.net/category/security-education/ * https://krebsonsecurity.com/category/how-to-break-into-security/ * https://s3ctur.wordpress.com/2017/06/19/breaking-into-infosec-a-beginn… [1] http://dfirnotes.net/ etc. hth, adric

How dumb? https://tisiphone.net/2017/01/25/thwart-my-osint-efforts-while-binging… I suspect this is going to be a bigger problem in the future (for society in general) as more and more people have lengthly digital trails.

In order of appearance of '?', here are my responses 1. Market is pretty hot and you will be get multiple choices to pick from the available offers 2. Certifications have very little to do with the job (Full Disclosure - I am currently maintaining CISSP, CCSP, GWAPT, GMOB certs ) That being said, sometimes HR/recruiter use these for filtering candidates. You can look at security+ certification to get a feel. 3. It will make sense even if its not from SANS because people who have done SANS know that a) SANS is very expensive b) its an open bool exam 3) Does not involve hands-on. For that matter, if you will go after coveted OSCP, then people will understand that you have hands-on skills. 4. You should get equivalent or more pay because the market is hot. Most of the earlier security professionals came from SysAdmin/Dev background. You have a better understanding of how systems/apps, so it will be easier to break them or identify vulnerabilities. There are several blogs (e.g. https://tisiphone.net/category/security-education/) available to find a learning path for security, so check them out. Self learning is the biggest skill that you will need. PS - Started my career in Information Security 9 years back, right after coming out of school

1) Schneier's advice from a few years ago is still accurate: https://www.schneier.com/blog/archives/2012/07/how_to_become_a_1.html 2) The Reddit NetSec FAQ has a good list of resources for beginners (and those starting to specialize): https://www.reddit.com/r/netsec/wiki/start 3) Finally, each of these popular "Getting Started in Security" guides has a slightly different, but useful, opinion on the specifics of the path to take: https://medium.freecodecamp.org/so-you-want-to-work-in-security-bc6c10… https://danielmiessler.com/blog/build-successful-infosec-career/#gs.0u… https://www.trustwave.com/Resources/SpiderLabs-Blog/Getting-a-Start-in… https://tisiphone.net/2015/10/12/starting-an-infosec-career-the-megami…