Tom Gorup

I was working a forensic case a number of years back when I discovered the power of Python. The short of it, I built a tool in bash and someone else built the same tool in Python. Guess who's worked consistently and ran in a fraction of the time? If you're either in security or looking to get into security, learn to script! It's likely one of the single most underrated capabilities of a good security analyst. How do you get started? Get hands on. Try to solve some basic problems by parsing a spreadsheet or querying an API, or both. Take the time and learn to script, you won't regret it! Here's a short list I would recommend you pick from: 1. Python 2. Go 3. Javascript

Certifications do not trump experience. Certifications are a proof of work, and you must come prepared to speak to them in an interview. Having the alphabet after your name means nothing if you can't speak to what you've learned. That being said, certs are a tremendous way to get your foot in the door. Don't also think you need to spend 1000's of dollars to get them. CompTIA and Security Blue Team certs are extremely valuable. And recognized as such by those in the industry. Once you've established your footing with a cert or two, it's time to go get some experience!

Check out the 1Password Incident Report. You'll notice the first line of defense was a member of IT. That individual single-handedly prevented a catastrophic breach for 1Password. We should all applaud that person. https://blog.1password.com/files/okta-incident/okta-incident-report.pdf Security is a team sport. It requires everyone in the business to play a part. Let's look at another example, check out the MGM breach. An IT help desk team member was social engineered into giving access to another users account. https://www.cyberark.com/resources/blog/the-mgm-resorts-attack-initial-analysis Members of IT are the front-line of defense for all businesses. Don't think because your title doesn't have Security in it you don't play a part.

There's a great book that focuses entirely on Network Security Monitoring. Some call it the network security bible. Amazon calls it, "The Practice of Network Security Monitoring: Understanding Incident Detection and Response". Get it, read it, and apply it. You won't regret it. https://a.co/d/hZM9hs0

Pay attention to the news and ask yourself some questions like, "how could an attacker do this to us?" For example, you might have seen the recent Okta breach hitting headlines. You may have also read the attackers leveraged the HAR files uploaded by customers to the Okta support portal to gain access to those customers (1Password, BeyondTrust and others) Okta tenant. I just did a quick Google search for "generate a HAR file"+"support" and it came back with 18,700 results. So, how many businesses are collecting and storing that same data in their ticketing system How could an attacker target your customers? Sounds like a hoard of valuable data for any bad actor. How could you help to protect your customers from this same attack?