Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/29/2019
04:00 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

7 Types of Experiences Every Security Pro Should Have

As the saying goes, experience is the best teacher. It'll also make you a better and more well-rounded security pro.
2 of 8

1. Experience a Breach
John Sawyer, director of services at IOActive, says surviving a breach makes security pros stronger. Though it's a painful experience, it teaches that anyone can be hacked and the best way to learn is from reviewing any mistakes the team may have made, he says. Angela Dogan, director of vendor risk and compliance services at Lynx Technology Partners, adds that security pros need to be familiar with all of the testing exercises that need to take place following a breach.

All security pros should take part in an incident response effort, says Doug Helton, intel architect at TruStar. 'Even if it's in a secondary role, it's an important experience,' he says.

[Hear John Sawyer, director of services at IOActive, present Tactical Infosec: A Hands-On Guide From the Attacker's Perspective, at Interop 2019 next month] 
 
[Hear Angela Dogan, director of vendor risk and compliance services at Lynx Technology Partners, present Cybersecurity Careers: Is There More Than IT?, at Interop 2019 next month]

Image Source: Adobe Stock: sheelamohanachandran

1. Experience a Breach

John Sawyer, director of services at IOActive, says surviving a breach makes security pros stronger. Though it's a painful experience, it teaches that anyone can be hacked and the best way to learn is from reviewing any mistakes the team may have made, he says. Angela Dogan, director of vendor risk and compliance services at Lynx Technology Partners, adds that security pros need to be familiar with all of the testing exercises that need to take place following a breach.

All security pros should take part in an incident response effort, says Doug Helton, intel architect at TruStar. "Even if it's in a secondary role, it's an important experience," he says.

[Hear John Sawyer, director of services at IOActive, present Tactical Infosec: A Hands-On Guide From the Attackers Perspective, at Interop 2019 next month]

[Hear Angela Dogan, director of vendor risk and compliance services at Lynx Technology Partners, present Cybersecurity Careers: Is There More Than IT?, at Interop 2019 next month]

Image Source: Adobe Stock: sheelamohanachandran

2 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
gmax28
100%
0%
gmax28,
User Rank: Strategist
5/10/2019 | 6:21:22 PM
Just not realistic...
The author is obviously not in the business of InfoSec.  Working in major enterprises for almost 20 years, you do your piece of the pie.  Rarely are there opportunities to learn other skills because your piece of the pie is quite large.  And shadowing an exec... yeah... ok.  Yes, InfoSec should understand the business aspects of IT just as much as the business should understand the importance of securing the environment.  

And to add to this, employers think that there are a plethora of experienced infosec guys out there and they make demands on "requirements" that just are not realistic.  Many times asking for what would equate to multiple jobs.  "Segregation of duties" anyone?  I had an HR person tell me that I was not considered because I performed the duties they were after more than 5 years ago.  Apparently they think that if you haven't done it lately, you clear your cache of any unused information.  I actually asked one HR person, " Did you forget how to ride a bike?"  She was stunned and didn't know how to answer that question. 

So this article is just another journalistic waste of time, and waste of my time perusing it.   Employers must consider a person's experience and allow some room for training/learning of new skills particular to their environment.  That's the only way you are going to get past a couple of skills unless you work for a very small company and are doing it all. 
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17537
PUBLISHED: 2019-10-13
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring.
CVE-2019-17538
PUBLISHED: 2019-10-13
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring.
CVE-2019-17535
PUBLISHED: 2019-10-13
Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.
CVE-2019-17536
PUBLISHED: 2019-10-13
Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.
CVE-2019-17533
PUBLISHED: 2019-10-13
Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.