(Repost) After living and breathing cybersec for the past 3 years, here are the best resources I've found.

A Reddit post I made a year ago. The offer for mentorship still stands for any cybersec beginners who'd like help. Teaching is the best way to make sure you really know something, so I welcome the opportunity.

After living and breathing cybersec for the past 3 years, here are the best resources I've found...

I just responded to a user asking for mentorship saying that I would help (with some caveats). I ended up putting together what, from my personal experience, is the best path through learning / digging into this profession in a relatively short time-frame. There are certainly other ways to get there, this is just what seems to be working for me.

My reply, pasted:

If you believe in investing your time in learning the topic without being spoon fed, I'll help you. I'm not a SME by any means, but I've been living and breathing the subject matter for the past 3 years.

Scope (Understand the depth of the problem-set)

I will explain ideas and concepts from the highest level (think?NIST) down to the?lowest level?(think?firmware?/?x86-64 architecture), and all the tools in between; think?NIDS,?EDR/XDR (HBIS),?SIEM,?threat intel / taxonomy. The list goes on, seemingly forever (expect these acronyms to be re-branded into new?buzzwords?by vendors yearly, but?it's really not so bad).

I can point you toward resources, but will not be bothered if I can tell you haven't put in the sweat to figure it out yourself. Feel free to DM me.

Resources (Be constantly learning)

In addition to anything we discuss, you should be following Reddit's?r/cybersecurity?and?r/blueteamsec, have a feed from only those communities, and follow up on every interesting post / article / discussion that appears, daily. Five times daily. You should also subscribe to?SANS Institute,?SANS DFIR?(defense) and?John Hammond?(offense) on YouTube and watch at least 3-4 videos per week for the next few years. Over the years, all of this will help you fill in the gaps between book knowledge and all the thousands of important topics and discussion relevant to the industry your college courses won't teach you.

Mindset (Be curious, love the challenge)

None of this should feel like a chore, or some overwhelming mountain to climb. You should be like an astronomer looking up at the sky and realizing how little you know, and not be stressed by that, but rather excited and curious to uncover its mysteries. Some people see this field as a paycheck and nothing more. If that's you, fine, but I've seen one too many posts about depression over on?r/sysadmin?to be able to recommend it. We're putting out fires all the time. It's not an easy line of work; you need to love it and you need to be curious. But?don't take it from me.

Along the way make sure you're climbing?this ladder, and building an info sec resume?correctly.

Get hands-on

Finally, none if this means anything without copious amounts of hands-on experience. I recommend purchasing a?Proving Grounds?membership; it's roughly the cost of two Netflix subscriptions although there are free alternatives if you're cash strapped as many college students are. Offense and defense are two sides of the same coin; you cannot excel at one without the other.

Communication

And one more thing; Communication. Believe it or not, your skills in this industry will be either amplified or diminished by your ability to communicate effectively across different target audiences (your boss, your boss's boss, that new hire you need to train, and also that genius working in the basement who won't look you in the eyes but writes mind-blowing kernel exploits for fun). The two keys here are?language?and?value, and there are?far better resources?than me to learn that from.

P.S. Many people see posts like this covering so much training within such a large scope and lament; "I just want an entry level role. I'm not trying to get my PhD here; why so complicated?"

I want share the answer to that frustration in the way that finally made it click for me. Did you know a seasoned cyber security professional?makes roughly the same?as a?pediatrician? If you're making a PhD's pay it's probably reasonable to infer that this job's difficulty is comparable to a PhD's level of knowledge and skill.

Cyber security is not typically an entry level role. Computer systems are incredibly complex; Defending them is hard.

Also: There?are?some non-technical administrative roles in the industry.