introduction to information security field
Post on 11-Apr-2017
163 Views
Preview:
TRANSCRIPT
Introduction to Information Security Field
Quick Survey
WHOAM I?
WhatIS
InformationSecurity?
Statistics ?
44%of organizations are short on staff with strong cyber security
and networking knowledge.
35%of organizations are unable to fill open security jobs,
despite the fact that 82 percent expect to be attacked this year.
37%Is the growth rate for demand on security analysts
between 2012 - 2020
74%The increase in security jobs postings between 2007 and 2013
103,226Dollars ($)
2.0Is the number of security jobs shortage by 2017
MILLION
Sounds Good ?
SecurityManagement
Security Manager
Responsibilities
Skills?
What to Learn?• Practices and methods of IT strategy, enterprise architecture and security architecture• Security concepts related to DNS, routing, authentication, VPN, proxy services and
DDOS mitigation technologies• ISO 27001/27002, ITIL and COBIT frameworks• PCI, HIPAA, NIST, GLBA and SOX compliance assessments• Windows, UNIX and Linux operating systems• C, C++, C#, Java and/or PHP programming languages• Firewall and intrusion detection/prevention protocols• Secure coding practices, ethical hacking and threat modeling• TCP/IP, computer networking, routing and switching• Network security architecture development and definition• Knowledge of third party auditing and cloud risk assessment methodologies.
Risk Analysis
Risk Analyst Responsibilities
Skills?
Penetration Testing
“A penetration test, or pen test, is an attempt to evaluate the security of an IT infrastructure by safely trying to exploit vulnerabilities. These vulnerabilities may exist in operating systems, service and application flaws, improper configurations, or risky end-user behavior.”
External Penetration TestingInternal Penetration Testing
Application Penetration TestingMobile App Penetration Testing
Wireless Penetration TestingSocial Engineering Testing
Penetration Tester
Responsibilities
Skills?
What to Learn?• Windows, UNIX and Linux operating systems• C, C++, C#, Java, ASM, PHP, PERL• Network servers and networking tools (e.g. Nessus, nmap, Burp, etc.)• Computer hardware and software systems• Web-based applications• Security frameworks (e.g. ISO 27001/27002, NIST, HIPPA, SOX, etc.)• Security tools and products (Fortify, AppScan, etc.)• Vulnerability analysis and reverse engineering• Metasploit framework• Forensics tools• Cryptography principles
DigitalForensics
Forensics Investigator
Responsibilities
Skills?
What to Learn?• Network skills, including TCP/IP-based network communications (much of modern forensics involves
reading network traces)• Windows, UNIX and Linux operating systems• C, C++, C#, Java and similar programming languages• Computer hardware and software systems• Operating system installation, patching and configuration• Backup and archiving technologies• Cryptography principles• eDiscovery tools (NUIX, Relativity, Clearwell, etc.)• Forensic software applications (e.g. EnCase, FTK, Helix, Cellebrite, XRY, etc.)• Data processing skills in electronic disclosure environments• Evidence handling procedures and ACPO guidelines• Cloud computing
ApplicationSecurity
Skills?
What to Learn?• An in-depth understanding of programming languages.
These can include C/C++, C#, Java/JSP, .NET, Perl, PHP, Ruby, Python, etc.• CERT/CC, MITRE, Sun and NIST secure coding guidelines
and standards• Software and web application development practices• Penetration testing and vulnerability assessments
NetworkSecurity
Security Admin Responsibilities
Skills?
What to Learn?• Knowledge of common L4-L7 protocols such as SSL, HTTP, DNS, SMTP
and IPSec• Strong understanding of firewall technologies• Juniper/Cisco/Checkpoint• Packet Shaper, Load Balancer and Proxy Server knowledge• Intermediate to expert IDS/IPS knowledge• TCP/IP, computer networking, routing and switching• Network protocols and packet analysis tools• Windows, UNIX and Linux operating systems• Firewall and intrusion detection/prevention protocols
MalwareAnalysis
Malware Analyst
Responsibilities
Skills?
What to Learn?• Operating System Concepts• High Level & Low Level Programming (familiarity is fine, working
knowledge not required at first)• Fundamentals of networking• How to use the internet to perform research.• Malware Analysis Tools.• Learn about Malware itself.
Security Auditing
Security Auditor
Responsibilities
Skills?
What to Learn?• Working knowledge of regulatory and industry data security standards
(e.g. FFIEC, HIPAA, PCI, NERC, SOX, NIST, EU/Safe Harbor and GLBA)• ISO 27001/27002, ITIL and COBIT frameworks• Windows, UNIX and Linux operating systems• MSSQL and ORACLE databases• C, C++, C#, Java and/or PHP programming languages• ACL, IDEA and/or similar software programs for data analysis• Fidelis, ArcSight, Niksun, Websense, ProofPoint, BlueCoat and/or
similar auditing and network defense tools• Firewall and intrusion detection/prevention protocols
SecurityAwareness
Security Awareness
Offficer Responsibilities
Skills?
Thank You
top related