Hacker News Reader

Comment by joonix | Hacker News Reader

I'm not in IT nor am I a software engineer. That said I'm tech proficient and was an amateur coder in a past life. Security seems like it has a solid future. What's the best way to train for a career (change) in IT security?

View on HN

You have successfully slain the red wumpus. His bleeding corpse lies before your feet. Your quest continues; choose your own adventure:

* If designing and enforcing rules and policy interests you, turn to page 23.

* If deploying and managing complex technical infrastructure interests you, turn to page 12.

* If being a part of teams that ship products is what gets you up in the morning, turn to page 45.

* If being a part of teams that tear shipping or soon-to-be shipping products to shreds is more your thing, turn to page 34.

Which will you choose? I'll tell you what the page says.

If the quest is open to all comers, I turn to page 34.

Shamelessly self-plagiarized:

0. Learn to love programming in at least one language. The C Programming Language has the most cachet in application security, but for this step-by-step list, Java or Python or Ruby will do fine.

1. Grab a copy of The Web Application Hacker’s Handbook and The Tangled Web

2. Go to the “previous releases” archive at WordPress.org and grab very old versions of WordPress; install them at EC2.

3. Download OWASP WebScarab or Burp Suite Free Edition, both of which are free, and use them to find bugs in ancient WordPress.

If you are at step 0 now and are immediately looking for a new gig in Chicago, San Francisco, or New York, you can also email me directly and get step 1 for free.

Page 31 please :)

You have a career in security waiting for you.

You have been eaten by a grue.

I'm torn, but I'll try page 45.

Other people should play this game so I can read the other pages, just like I always used to do when these books came out!

I'm late, but I'll go for page 12.

Page 23'); DROP TABLE Pages;--

Looks at the SANS training classes and certifications. I think their training is one of the best ways to jump start a InfoSec career, and the various training tracks and certifications will give you a general understanding of various roles (job definitions/categories) that are available in InfoSec.

I'm not sure that SANS is really the best place to jumpstart an infosec career. Their prices are far and above what most people will have laying around if they don't already have a previously established career, and most employers are unlikely to foot the bill for someone who wants to transition into a role which they aren't already responsible for.

I'd love to be wrong, though. I've been wanting to get my hands on some of their training for a while now.

If you are looking to do appsec --- and personally I think appsec is the most rewarding branch of security, both dollars-wise and in terms of satisfaction and challenge --- then any hour you spend getting better at coding is going to pay off more than an hour spent with formal security training.

We don't really look at certification or training stuff in candidates (except as a weak signal that someone is seriously interested in doing security, but that's something that's easy to convince us of verbally too), but our recruiting process definitely wants you to be comfortable with code. I think we're similar to a lot of other firms.

Reply on news.ycombinator.com