-
Computer security is important, primarily to keep your information protected. It’s also important for your computer’s overall health, helping to prevent viruses and malware, allowing programs to run more smoothly. (The Importance of Computer Security)
-
Security is the process of preventing and detecting unauthorized use of the computer. Prevention helps in stopping unauthorized users to access part of the system. Detection helps to determine whether or not someone has tried to break into your system.(Why is computer security important?)
Apprentices will learn secure development basics, common pitfalls, and how to avoid them.
Companies that use Security
- Blackberry
- It's been a long time since BlackBerry was known as the handheld device icon. These days it's doing a brisk business in the cybersecurity market, recently inking a $1.4 billion acquisition of Cylance to further its goal to become the leader in providing end-to-end mobility services that are secure and trusted.(from the software report)
- FireEye
- With a mission to relentlessly protect customers from the consequences of cyber attacks, FireEye develops security software and services that are aimed at meeting the rapidly changing cybersecurity environment where evolving cyber crimes are creating gaps that can be exploited. Its network security and forensics services provides companies with network visibility and protection against cyber attacks through comprehensive endpoint defense.(from the software report)
-
Someone who wants to go further in the security field would have to understand things like xss, csrf, sql injections, input validation, etc.
-
It would depend on where you want to go (i.e. pen tester, defense, red teaming, compliance, etc.). Often, security professionals were initially going the more mainstream route but ended up in security compliance because it was so intriguing to them. There are so many routes that someone can’t really pin down one but just know that you can get there via self-teaching, bootcamp, or college course. It comes down to if you can show what you know and explain it to interviewers. The info security industry has a huge hiring gap and they are looking to hire underrepresented people. You don’t have to know everything but having the attitude that you can learn it and do it says so much more.
Participants will be able to learn:
- Risk Management
- Cryptography & PKI
- Identity and Access Management
- How to implement secure n/w architecture and system design
- Discover security vulnerabilities across an entire network
The basic required skills as a Security Engineer are
- Programming Skills
- Communication Skills
- Risk Management
- Networking Basics
- Situational Awareness
- Toolkit Maintenance
One can join course CompTIA Security+ Certification or CCNA Security to improve the basics of security
After gaining basic skills one can go further as Security Architect or Security Analyst or CISO or any further specialization
- Techtonica's Roles in Tech Presentation (security section starts at 2:57)
- online course at CYBRAY
- course for beginners guru99
- You can refer to the book "Cryptography and Network Security" by William Stallings. It is a very good book for understanding the basic concepts of security
- develop a set of security standards and practices
- create new ways to solve existing production security issues
- recommend the security enhancements to management
- install and uses software, such as firewalls and data encryption programs
- assist with the installation or processing of new security products and procedures
- conduct scans of networks to find vulnerabilities
- conduct penetration testing
- monitor the networks and systems for security breaches or intrusions
- install software that helps with notification of intrusions
- develop an automation script to handle and track incidents
- test security solutions using industry standard analysis criteria
- watch out for irregular system behavior
- supervise the changes in software, hardware, and user needs
- lead an incident response activities
- lead the investigations into how breaches happen
- report the findings to management
- help to plan an organization’s information security strategy
- educate the staff members on information security through training and awareness
- recommend modifications in legal, technical and regulatory areas
(Security Engineer Roles And Responsibilities)
These are some misconceptions that people have in their mind but it is not always true
-
Strong passwords are good enough - It is not necessary to have a strong password but it is also important that how strongly you have designed. i.e. use of special characters or alphanumeric characters. Adding more than one layer of security better than only setting passwords.
-
Antivirus will secure my computer - It is one of the most common misconceptions. But a virus is a piece of code, anti-virus is also the piece of code. They both are created by those having knowledge of both and to fight against each other and competitive with each other.
-
Cyber Security is just a form of defense - “The best defense is a good offense.”
-
You will never be attacked - Unfortunately, the attacked business is often the last to know that it's been breached. It's only after banks discover fraudulent charges that businesses hear about a suspected hack. (Top 8 Data Breach Misconceptions)
-
Hackers are criminals - It is a big misconception. There are type of hackers and not all hackers are criminals. There are three types of hackers called - White Hat Hackers(Who 'hacks' legally), Grey Hat Hackers(who may sometimes violate laws or typical ethical standards, but do not have the malicious intent) and Black Hat Hackers(Illegal hacking).
-
If wi-fi has a password, then it is secure - If the person who travels to different workplaces and needs to use public wi-fi it is not recommended to do sensitive transactions through it. The same password is shared with many users and anyone can see the information that is being transferred.
-
By turning off GPS, you will not be traced - Almost half of the people surveyed either didn't know or were unsure whether disabling GPS prevents all tracking. Your phone's built-in location service is just one-way data can be collected. As Pew Research notes, your phone also connects to cell towers and Wi-Fi networks, and connection to these technologies allows tracking too.(4 myths -- and facts -- about online security)
-
Emails are secure - Over 400 businesses are targeted daily, and these emails are growing increasingly and it is challenging to identify since they’re designed to mimic legitimate communication so they can gain access to your sensitive information – including usernames and passwords.(Cybersecurity Misconceptions and Challenges Faced by Small Businesses)
-
Small organizations will not be attacked - Major organizations assume that they are small and will not be targeted as we are a small company. The research shows that 70% of cyber attacks target small businesses. So today for everyone it is very important to take care of its security if its data is worth value for money, whether it is a website for fun or it is a huge organization. (9 Steps to Land a Cyber Security Job, According to Experts)
Form small groups and discuss:
-
What are the two elements of computer security? Why is computer security important?
-
What are the 3 different types of hackers?
-
What are two of the responsibilities of people working in computer security? Did any of the responsibilities surprise or interest you?
-
Is email considered a secure channel, why or why not?
- You can start playing CTFs. It is a great way to learn ethical hacking.
-
Don’t underestimate the importance of ethics and integrity
Working in cybersecurity, you need to be behaving responsibility and with integrity at all times – an especially fraught task given the nature of the work. So, think about the content you publish on your social media accounts and be especially wary of posting insensitive material which could come back to haunt you later in life. You need to be able to demonstrate you’re trustworthy.
As a software developer of any kind, you'll need to know the basics of securing your code. But there are also specialized roles in security.
-
Many organizations, no matter their domain or product, have positions that are specific to security. If you wanted to specialize in security, there are security roles at all kinds of companies.
- Sample systems security job description [Workable]
- Organizations also often need non-engineering roles to govern the security or trust of their software. Trust & abuse teams solve problems relating to misuse that can deter other users from the product. Large companies often have risk & governance positions to identify a company's largest risks; A "cybersecurity risk & governance" professional will assess a company's software risks to prioritize security work accordingly.
- Forensics and investigations.
- Other companies focus on security. These will have security roles, R&D roles, as well as more general software developer roles. If you wanted to work on security, such an organization might make sense. Or if you're interested in security, but still want to work as more of a generalist, you could work on a product that's security-minded.
- Endgame needs security engineers and researchers since it's a provider of enterprise security software, but it also has a web team for its product.
- Still, other organizations deliver "white hat hacker" services which are hackers hired to attack systems to discover vulnerabilities before "black hat" hackers find them, and deliver such findings to their client in a report. These systems can be software the company has developed or is bringing in from outside; they can also be internal or external tests of a company's network. This is even more specialized but interesting!
- Security consulting firms will often offer many roles as contract services or managed services embedded within a client organization, including pen-testing, code auditing, network analysis, system design, and reverse engineering.
- Research-oriented work can range from threat research and bug-hunting to application, protocol, malware analysis.
-
Bug bounty programs usually include security vulnerabilities.
- One aggregator of bug bounty programs: bugcrowd
-
Offensive Security Certified Professional(OSCP) certificate: There is an OSCP certification in Security role also. It is an ethical hacking certification that teaches penetration testing methodologies and the use of the tools included with the Kali Linux distribution. It is a hands-on penetration testing certification, requiring holders to successfully attack and penetrate live machines in a safe environment. For more information regarding OSCP certification
-
Talk to as many professionals as you can
-
Connect with other women security orgs like Women in Security and Privacy and Women Cyberjutsu (see full list below). They tend to have free training and offer scholarships. See if you can connect with their members and find a mentor.
- It is leading UK's cyber defense against cyber attacks. It is a collaboration of UK Government, Industry, Academia and also Law enforcement, Military and the wider community to make UK one of the safest places in the world to live and do business online. When a serious cyber attack occurs the security center acts as a government source of information and advice. They work to minimize the damage and help to recover. For more information watch NCSC Launch Video.
- WiCyS, Women in Cyber Security, annual, various US cities
- Black Hat, annual, Las Vegas, NV
- Lists security and hacker conferences on Wikipedia
- InfoSec Events Directory
- General software conferences often have security tracks, or at least sessions on security topics.