Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/29/2019
04:00 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

7 Types of Experiences Every Security Pro Should Have

As the saying goes, experience is the best teacher. It'll also make you a better and more well-rounded security pro.
2 of 8

1. Experience a Breach
John Sawyer, director of services at IOActive, says surviving a breach makes security pros stronger. Though it's a painful experience, it teaches that anyone can be hacked and the best way to learn is from reviewing any mistakes the team may have made, he says. Angela Dogan, director of vendor risk and compliance services at Lynx Technology Partners, adds that security pros need to be familiar with all of the testing exercises that need to take place following a breach.

All security pros should take part in an incident response effort, says Doug Helton, intel architect at TruStar. 'Even if it's in a secondary role, it's an important experience,' he says.

[Hear John Sawyer, director of services at IOActive, present Tactical Infosec: A Hands-On Guide From the Attacker's Perspective, at Interop 2019 next month] 
 
[Hear Angela Dogan, director of vendor risk and compliance services at Lynx Technology Partners, present Cybersecurity Careers: Is There More Than IT?, at Interop 2019 next month]

Image Source: Adobe Stock: sheelamohanachandran

1. Experience a Breach

John Sawyer, director of services at IOActive, says surviving a breach makes security pros stronger. Though it's a painful experience, it teaches that anyone can be hacked and the best way to learn is from reviewing any mistakes the team may have made, he says. Angela Dogan, director of vendor risk and compliance services at Lynx Technology Partners, adds that security pros need to be familiar with all of the testing exercises that need to take place following a breach.

All security pros should take part in an incident response effort, says Doug Helton, intel architect at TruStar. "Even if it's in a secondary role, it's an important experience," he says.

[Hear John Sawyer, director of services at IOActive, present Tactical Infosec: A Hands-On Guide From the Attackers Perspective, at Interop 2019 next month]

[Hear Angela Dogan, director of vendor risk and compliance services at Lynx Technology Partners, present Cybersecurity Careers: Is There More Than IT?, at Interop 2019 next month]

Image Source: Adobe Stock: sheelamohanachandran

2 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
gmax28
100%
0%
gmax28,
User Rank: Strategist
5/10/2019 | 6:21:22 PM
Just not realistic...
The author is obviously not in the business of InfoSec.  Working in major enterprises for almost 20 years, you do your piece of the pie.  Rarely are there opportunities to learn other skills because your piece of the pie is quite large.  And shadowing an exec... yeah... ok.  Yes, InfoSec should understand the business aspects of IT just as much as the business should understand the importance of securing the environment.  

And to add to this, employers think that there are a plethora of experienced infosec guys out there and they make demands on "requirements" that just are not realistic.  Many times asking for what would equate to multiple jobs.  "Segregation of duties" anyone?  I had an HR person tell me that I was not considered because I performed the duties they were after more than 5 years ago.  Apparently they think that if you haven't done it lately, you clear your cache of any unused information.  I actually asked one HR person, " Did you forget how to ride a bike?"  She was stunned and didn't know how to answer that question. 

So this article is just another journalistic waste of time, and waste of my time perusing it.   Employers must consider a person's experience and allow some room for training/learning of new skills particular to their environment.  That's the only way you are going to get past a couple of skills unless you work for a very small company and are doing it all. 
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9342
PUBLISHED: 2020-02-22
The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions before 17.0.605.474 (on Linux) of Cloud Protection For Salesforce, Email and Server Security, and Internet GateKeeper.
CVE-2020-9338
PUBLISHED: 2020-02-22
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.
CVE-2020-9339
PUBLISHED: 2020-02-22
SOPlanning 1.45 allows XSS via the Name or Comment to status.php.
CVE-2020-9340
PUBLISHED: 2020-02-22
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter.
CVE-2020-9341
PUBLISHED: 2020-02-22
CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI.