Mentorship Monday - Discussions for career and learning!

I'm a bit in over my head I think lol

We're all in a bit over our heads. I suspect that ayone who doesn't feel that way is unaware of the threat landscape, or just isn't paid enough to care.

Does anyone have any good resources on "general" cyber security information?

That's a big topic.

It's hard to go wrong with a well reviewed "Security+" study guide. Hack the Box, SANS, and Cloud Academy have good resources.

Personally, of the paid resources, Cloud Academy is my current favorite.

You're in luck! Cybersec people, for the most part, love sharing what they know/have done with each other. Many believe in freedom of information and find value in open collaboration. We just wanna show you the whacky thing we did with what we had.

The biggest resource I'll share with you is membership with ISAAC. Find whatever category you fit into here and push to get your org membership, if you don't already. This puts you into a huge working group with your industries' peers and they will have all sorts of resources for you to use including discussions, meetings with pros, etc.

There's also SANS who has some free stuff (check their Reading Room) but also has classes (paid, expensive, but veeery worth it imo, again if you can get buy-in)

Outside of the paid membership options, there's still a lot of good options:

• MISP is a great threat intel sharing platform, but will require some setup as a product (free && opensource). Take this one slow, you don't want data leakage. Start small and locked down, gradually open up as you gain buy-in/trust/confidence.

• Cybrary IT is a free+paid learning platform, good stuff here - lots of diversity including business stuff

• OWASP - more so for web-app security, still good knowledge to add to that toolbox

• OpenSecurityTraining - heard some good things about this site, I think you may enjoy it - I have not used it myself, but please let me know if you have any problems/reasons you don't like it.

Then there's always the classic CTF/Hack Challenges websites out there which let you get real experience with red-teaming/bolstering your knowledge of attacker TTPs (Techniques, Tactics, Procedures):

• HackTheBox - challenges for practicing your skills. No hand-holding, just a sandbox for you to play in. They have academy offerings (paid, and a new service, recommend skipping unless you can get buy in from the company/have a team who would benefit from a bulk-license purchase), regular free boxes to challenge yourself with, etc

• TryHackMe - this one is also CTFs but its more so lesson based/training stuff

• Heard good things about KC7 as well, seems to be more threat hunting/blue team focused (blue team = defend, red team = attack)

• LetsDefend - Free + paid options, more blue team stuff, great for SOCs which may or may not hit your mark.

Hope this helps you out, biggest thing is getting integrated with the community, reading the news (religiously), and managing burn out. Security is an uphill battle, but we roll this boulder for others who cannot. Respect your body and take care of your mental, or you will burn out and scar yourself. LMK if you need anything!

@stevedidwhat_infosec@infosec.pub dropped some great resources. I also typically direct people to this resource I wrote a few years back in terms of "getting into infosec" https://shellsharks.com/getting-into-information-security.

It's an odd position to be in; I work in the private sector but my company deals almost exclusively with government and NGO contracts, so at times I feel like I'm public sector.

What I've noticed is that even though the desired outcome is nearly identical for both sectors, the buzz words associated with each is what determines who responds to my job applications. As an example:

Private: IaC and Policy-as-Code, supply chain and software composition analysis, SAST, DAST, etc.

Public: Compliance automation, risk management frameworks, risk quantification (this one has generated a lot of excitement recently), etc.

This is purely anecdotal, but you may find adjusting your resume to include some of these buzzwords as applicable to the industry to which you are applying may help you get your foot in the door.

To reiterate, yes I know in the end all of these companies strive toward the same goals, whether it be passing audits or being able to demonstrate prudent security practices to clients, sometimes the hiring manager is looking for specific terminology and will discard any applications that exclude it.