WEBVTT
00:00:00.166 --> 00:00:06.139
Welcome to the Talos Takes podcast, where we discuss Talos’ latest research and security news.
00:00:06.139 --> 00:00:12.478
This podcast is for everyone from the C-suite to the frontlines.
00:00:12.579 --> 00:00:17.317
Hello everyone, and Happy New Year! My name is Amy Ciminnisi.
00:00:17.317 --> 00:00:21.821
I am thrilled to be hosting my very first episode of Talos Takes.
00:00:21.821 --> 00:00:25.291
Up until now, you've been hearing Hazel Burton.
00:00:25.291 --> 00:00:32.465
She's done absolutely amazing things with this podcast over the past year and a half, and now she's handing off the reins to me.
00:00:32.465 --> 00:00:36.335
God knows why, but I really couldn't be more excited to be here.
00:00:37.003 --> 00:00:40.173
A little bit about what I do here at Talos.
00:00:40.173 --> 00:00:42.674
I'm the Content Manager and Editor.
00:00:42.674 --> 00:00:54.820
So our researchers and incident responders write their blogs and findings and reports, and they send them my way for a polish before it goes out to the wider community.
00:00:54.820 --> 00:01:01.860
I also run our social media, and I host Humans of Talos over on YouTube, so definitely check that out.
00:01:01.960 --> 00:01:03.595
Now let's get into it.
00:01:03.595 --> 00:01:08.301
Imagine this you are a technical writer with barely a year of experience.
00:01:08.301 --> 00:01:17.209
Before then, you had been working in nonprofit fundraising, so radically different, and suddenly you get laid off.
00:01:17.209 --> 00:01:19.111
It's a cold November day.
00:01:19.111 --> 00:01:26.986
The holidays are coming up, you're on unemployment benefits, and you're reaching out to every connection that you have with open jobs.
00:01:26.986 --> 00:01:29.055
You've landed a few interviews.
00:01:29.055 --> 00:01:39.231
Nothing really sticks yet, but as you scroll through the listings, you notice that more and more content and technical writing openings are in cybersecurity.
00:01:39.231 --> 00:01:41.968
You don't have a ton of experience there.
00:01:41.968 --> 00:01:52.111
And to get maybe a leg up, you start looking at different certifications that you can get, courses that you can take, and you find an entry level one.
00:01:52.111 --> 00:01:55.215
You think, “You know, why not get some baseline knowledge?
00:01:55.215 --> 00:02:00.453
At the very least, it'll give me something to talk about in interviews if I land one.”
00:02:00.453 --> 00:02:08.026
That certification, which was at the time only half finished, probably even less than that...
00:02:08.026 --> 00:02:14.099
That entry level certification is part of why I was offered a position at Talos.
00:02:14.099 --> 00:02:22.975
So for my first episode, I wanted to dive into the very confusing world of cybersecurity certifications.
00:02:22.975 --> 00:02:33.152
And with me is someone who not only has several certifications of their own, but also mentors people through their certification journeys.
00:02:33.152 --> 00:02:35.320
And you know him. You love him.
00:02:35.320 --> 00:02:39.125
It is Joe Marshall! Joe, how are you doing?
00:02:39.125 --> 00:02:41.161
And the crowd goes wild.
00:02:41.161 --> 00:02:41.161
Thanks for having me.
00:02:43.395 --> 00:02:45.664
Yeah. Of course. Thanks for being here.
00:02:45.664 --> 00:02:51.336
When I brought this topic to the group, you very enthusiastically jumped in.
00:02:51.336 --> 00:02:55.542
Can you talk a little bit about your own journey with certifications?
00:02:55.542 --> 00:02:59.913
When, why, How did you decide to get your first one?
00:02:59.913 --> 00:03:00.780
Sure. Yeah.
00:03:00.780 --> 00:03:02.681
So I started off in information technology.
00:03:02.681 --> 00:03:12.991
I didn't start off in cybersecurity, arguably cybersecurity as a mature profession didn't exist when I was in, you know, I'm and I'm in my mid 40s now.
00:03:12.991 --> 00:03:13.659
God help me.
00:03:13.659 --> 00:03:18.931
I started in it in my early 20s and cybersecurity hadn't really matured.
00:03:18.931 --> 00:03:21.033
It's where he is now, obviously.
00:03:21.033 --> 00:03:27.774
And certainly there weren't the plethora of cybersecurity certifications that exist now that did 15 or 20 years ago.
00:03:27.774 --> 00:03:33.145
So the certifications I initially got were for administration.
00:03:33.145 --> 00:03:36.782
So I'm a, you know, Microsoft certified systems engineer.
00:03:36.782 --> 00:03:42.822
I have some vendor certifications outside of that in there, like hardware, basic unveil hardware and things like that.
00:03:42.822 --> 00:03:46.558
Then later as my career for the rest, I went into working for D.O.D.
00:03:46.558 --> 00:03:58.270
and there were some certifications that were mandatory to be, an information, like, assurance management level of of of, professionalism they expect.
00:03:58.270 --> 00:04:01.174
And one of those was called the security plus.
00:04:01.174 --> 00:04:14.820
And then I would later go on in my career to get like a CISSP, which is a much, you know, different type of certification for my mix year of my Security plus or from, all these other certifications that I, that I've, that I've been able to attain over my career.
00:04:14.820 --> 00:04:33.005
So for me personally and has been a fairly long journey, to get the certifications that I have, and swim indirectly in some ways landed me here at Cisco Talos.
00:04:33.005 --> 00:04:36.009
Well, on 11 years ago now.
00:04:33.016 --> 00:04:36.009
Wow.
00:04:36.009 --> 00:04:37.110
Yeah. Yeah.
00:04:37.110 --> 00:04:44.083
So there are a million different certification providers and a million different types.
00:04:44.083 --> 00:04:51.624
And amongst those, kind of like you mentioned, there are vendor specific and then vendor agnostic certifications as well.
00:04:51.624 --> 00:04:58.398
Can you talk a little bit about like who some of the main providers of certifications are?
00:04:58.398 --> 00:05:02.168
The types that they provide, things like that.
00:05:02.535 --> 00:05:13.211
So, so if anyone ever is, able to get a cybersecurity certification or they want to get one, you are going to be just buried in a plethora of choices.
00:05:13.211 --> 00:05:16.415
And, and actually, I hope you link in the show notes.
00:05:16.415 --> 00:05:24.357
The chart that we've been looking at together for just the ridiculous amount of cybersecurity certifications that exist.
00:05:24.357 --> 00:05:35.100
But like, you have some of your major vendors, just so you have and so every major market vendor usually offers a cybersecurity certification with their product.
00:05:35.100 --> 00:05:38.971
Microsoft does, Cisco does, Amazon does.
00:05:38.971 --> 00:05:39.271
Right.
00:05:39.271 --> 00:05:52.084
So like because they want you to use their product and also have a minimum standard of qualification and certification that exists, that your employer or that you may wish to do for professional self-development.
00:05:52.084 --> 00:05:53.752
To go. Yep.
00:05:53.752 --> 00:06:00.959
I have taken Amazon EC2 cybersecurity training and I am now a certified, security administrator.
00:06:00.959 --> 00:06:04.697
I've met the vendor's standards for a qualified person.
00:06:04.697 --> 00:06:11.137
And I have a piece of digital paper to show, or maybe real that this shows you that that you know, you did the thing right.
00:06:11.370 --> 00:06:15.274
There's also certification bodies that exist outside of vendors.
00:06:15.274 --> 00:06:18.244
So you have some that are extremely vendor agnostic.
00:06:18.244 --> 00:06:20.480
So CompTIA would be a good example of that.
00:06:20.480 --> 00:06:25.584
Everyone's familiar with CompTIA in the sense of they offer the you know the plus certification.
00:06:25.584 --> 00:06:31.923
So security plus network plus a plus cloud plus Linux plus those are vendor agnostic.
00:06:31.923 --> 00:06:44.836
You have like ESI two or IEC SC squared certifications that for your security risk management, like so like they're the ones that do out the CISSP or the GSB or the Casb clause and stuff like that.
00:06:44.836 --> 00:06:47.973
Those also are vendor agnostic as well.
00:06:47.973 --> 00:06:51.511
And we're really just scratching the surface.
00:06:51.511 --> 00:06:54.880
The more you dig, the more you start to drown.
00:06:54.880 --> 00:07:05.024
And this, the more analysis paralysis that happens because you're like, especially if you're a beginner in this space, if you're just trying to get your foot in the door, you're looking this going, oh my God, what do I even do here?
00:07:05.024 --> 00:07:07.526
Like, how do I even know if this is really good?
00:07:05.033 --> 00:07:07.526
Yeah.
00:07:07.526 --> 00:07:12.899
And then you have the difference between the beginner and expert level certifications, right?
00:07:14.166 --> 00:07:18.370
They exist in all strata of your career progression.
00:07:18.370 --> 00:07:23.509
Like a beginner or a newbie to cybersecurity is not going to get their CISSP.
00:07:23.509 --> 00:07:31.050
As a matter of fact, there's a minimum in time experience that you have to be able to document before they let you sit down for the certification, right?
00:07:31.050 --> 00:07:45.230
But they do offer entry level certifications that, you know, only require a year or less of experience, or they're willing to waive some of that experience based on, say, college education or things that they would sit or, counts as experience sort of sort of standards.
00:07:45.230 --> 00:07:46.865
And that's relatively unique.
00:07:46.865 --> 00:07:48.701
And in that space.
00:07:48.701 --> 00:07:55.374
But, you know, from security operations to asset security to architecture and engineering, there's something for everybody.
00:07:55.374 --> 00:07:56.675
There's something for everybody.
00:07:56.675 --> 00:08:00.346
So like it, it's it's very fluid is what I'm saying.
00:08:00.346 --> 00:08:07.487
It is situationally applicable to where you are in your career, who you're working for, what vendors you're using or not using.
00:08:07.487 --> 00:08:14.392
Because there are certainly generalist cybersecurity certifications that exist that I actually I do recommend because they are vendor agnostic.
00:08:14.392 --> 00:08:20.298
And you can see just by me talking about this, I can see your eyes starting to go, what have I done?
00:08:20.298 --> 00:08:22.201
I've asked Joe these questions.
00:08:22.201 --> 00:08:24.170
I don't understand any of this.
00:08:24.170 --> 00:08:25.872
What the hell, man?
00:08:25.872 --> 00:08:29.242
I'm always thinking in terms of, like, practical steps.
00:08:29.242 --> 00:08:32.577
So, like you said, analysis paralysis.
00:08:32.577 --> 00:08:34.013
And I went, yep. That's it.
00:08:34.013 --> 00:08:35.947
That's what I'm feeling.
00:08:35.947 --> 00:08:53.499
If someone is at that stage where they are trying to figure out where to go next, what certification to work toward next, what are the the best methods you suggest they use to kind of finally drill down and focus on one?
00:08:54.366 --> 00:08:54.767
Yeah.
00:08:54.767 --> 00:09:04.744
So like this is such a hard question to answer because I don't know, like, so for anybody listening to this right now and you're going, yes, Joe, give me the wisdom.
00:09:04.744 --> 00:09:06.846
Tell me what test to go take.
00:09:06.846 --> 00:09:17.389
You have to be able to answer that yourself, because I don't know where the individual background of anyone that wants to go to take a certification exam where they are or you're already in the space.
00:09:17.389 --> 00:09:20.592
Are you trying to get a job into this cybersecurity career field?
00:09:20.592 --> 00:09:22.662
What's your what's your past like?
00:09:22.662 --> 00:09:24.062
Have you done it like I did?
00:09:24.062 --> 00:09:27.832
And you just sort of organically shifting into it or you coming in blind, right.
00:09:27.832 --> 00:09:32.171
So the the advice I have is just that it's advice.
00:09:32.171 --> 00:09:33.873
It's generalized.
00:09:33.873 --> 00:09:41.279
All I want for anyone is to work hard and be successful and be a student of this game.
00:09:41.279 --> 00:09:44.649
And there's certainly a certification that is applicable to you.
00:09:44.649 --> 00:09:45.451
All right.
00:09:45.451 --> 00:09:56.227
From a practical mentor experience because so I'm, one of the mentors of the Women in Cyber program here at Cisco and certainly, personal relationships that I've had outside of my organization where I mentored others.
00:09:56.227 --> 00:09:59.631
I'm kind of a fan of the CompTIA certifications.
00:09:59.631 --> 00:10:02.368
So this would be your A plus your network plus, your security plus.
00:10:02.368 --> 00:10:05.171
And the reason for that is real simple one you can study at home.
00:10:05.171 --> 00:10:06.605
You don't have to go to class.
00:10:06.605 --> 00:10:24.255
You can take online courses like, Udemy or one of the certainly there are if you go to YouTube for the CompTIA base certifications, the reason I kind of like them is they're they're establishing a very vendor agnostic security and technology baseline.
00:10:24.255 --> 00:10:26.458
How does the internet work?
00:10:26.458 --> 00:10:29.528
How does a PC what are the minimum standards to operate something?
00:10:29.528 --> 00:10:31.230
What is an operating system?
00:10:31.230 --> 00:10:32.565
What is hardware?
00:10:32.565 --> 00:10:43.475
Like they're just trying to establish the bare minimum of what you should understand before you go into, like a vendor certification, like the Cisco Certified Network.
00:10:43.475 --> 00:10:46.211
Administrator cannot. Right.
00:10:46.211 --> 00:10:57.288
Where you're going to learn some of that, obviously, but you're also going to learn sort of like the Cisco methodology behind why and how we use our core level and access routing to do the things that we do for switch in route. Right.
00:10:57.288 --> 00:11:15.173
So like, but if you understand, like, a routing protocol like rip G, rip OSPF or if you're going to understand how the both the protocols TCP and IP work, you know, how are they constructed, what is their their packet structure.
00:11:15.173 --> 00:11:27.285
Like like you're you're if you can understand that at a general level, it's going to carry you foundationally into so many different things that if you just wanted to do networking, we haven't even talked about cybersecurity yet.
00:11:27.285 --> 00:11:38.464
So let's say I talk about something like, DNS exfiltration, which is, a way to steal network, data from a victim, and you exfil out using, bogus DNS requests.
00:11:38.464 --> 00:11:46.971
If you don't know how DNS works and you see a DNS exploration question on your security Plus exam, which I don't know if it would be there, but let's say you do.
00:11:46.971 --> 00:11:56.248
Well, then you're not going to get the question right, because you don't have a foundational understanding of what domain naming systems actually are and do and how they make the internet work.
00:11:56.248 --> 00:11:57.082
Right.
00:11:57.082 --> 00:12:03.822
So like there's a core level of of just technical proficiency and acumen that you have to do.
00:12:03.822 --> 00:12:13.798
And the worst part about all of this is when you're studying cybersecurity, generally speaking, this isn't something you can just pick up and touch.
00:12:13.798 --> 00:12:15.267
It's not like I'm learning how to weld.
00:12:15.267 --> 00:12:18.269
I'm learning how to do Hvac repair.
00:12:18.269 --> 00:12:23.042
I can't just do hands on journeyman practice from a found.
00:12:23.042 --> 00:12:27.779
I can't hold the OSI model in my hand and take it apart, per se, right?
00:12:27.779 --> 00:12:29.615
We're talking about a lot of theory.
00:12:29.615 --> 00:12:38.157
We're talking a lot about things with the way the internet was constructed way back in the 1980s, and it's not easy to wrap your brain around sometimes, though.
00:12:38.157 --> 00:12:41.126
Like, what do you mean, what's the data frame?
00:12:41.126 --> 00:12:42.528
What's a packet? What's up?
00:12:42.528 --> 00:12:53.471
You know, like, I don't know what any of this stuff is, but I'm reading some really weird stuff in this book and it says I have to know it from this certification exam. Right? So yeah, it's a challenge.
00:12:53.471 --> 00:13:03.481
It can really be a for if you're coming in cold and you don't have a mentor and you're just wondering what like you're reading this book, I get it, people are intimidated by it and they get lost in it.
00:13:03.481 --> 00:13:11.456
And they're like, my brain shuts down because we're talking about really ephemeral stuff, but all that stuff is super important.
00:13:11.456 --> 00:13:23.568
Every other foundational aspect of cybersecurity, and will really come to pay dividends when you are confronted with something either personally, professionally in your journey for for being a security professional.
00:13:23.568 --> 00:13:26.572
And you're going to go, Emily, do I know how that works?
00:13:26.572 --> 00:13:32.610
I can understand the exploit or the vulnerability that's being discussed because of how it works.
00:13:32.610 --> 00:13:35.413
Yeah, honestly, it's the greatest feeling in the world.
00:13:35.413 --> 00:13:42.354
You know, I'm doing the Google Cybersecurity Professional certificate on Coursera, right now, and it's really basic stuff.
00:13:42.354 --> 00:14:00.773
But like once I finish a module and I, you know, I've completed everything and I come back to work and I hear people talking about stuff, it is the most rewarding thing to be able to go, yes, I know this, I understand it, and people have like a super beginner level conversation.
00:14:01.039 --> 00:14:05.778
But like, it's so like I said, it's so rewarding.
00:14:05.778 --> 00:14:18.823
Knowing that I am increasing my understanding of really important concepts, but like just because it's rewarding toward the end doesn't mean that I am motivated throughout all of it, right?
00:14:18.823 --> 00:14:30.201
So like, I end up having to put like three hour time blocks on my schedule in order to find the motivation to keep on, going with the certification.
00:14:30.201 --> 00:14:37.976
And there are just times when I really struggle to sit down and pay attention to these videos and especially the readings.
00:14:38.409 --> 00:14:47.318
So I'm curious, in your experience as a mentor, what are the biggest challenges other than it being super ephemeral content?
00:14:47.318 --> 00:14:48.921
That people face?
00:14:48.921 --> 00:14:52.857
I could see the look on your face right now.
00:14:52.857 --> 00:14:54.894
We're asking the hard questions today.
00:14:54.894 --> 00:14:56.195
Yeah, coming at me hard.
00:14:56.195 --> 00:15:01.200
All right, so not everyone is on the same playing field when it comes to taking these tests.
00:15:01.200 --> 00:15:05.169
I've done 11 certification exams in my career.
00:15:05.169 --> 00:15:06.605
All right?
00:15:06.605 --> 00:15:11.610
All of them require a level of commitment for me to set aside the free time.
00:15:11.610 --> 00:15:13.511
And the money.
00:15:13.511 --> 00:15:15.047
Because these tests aren't free.
00:15:15.047 --> 00:15:17.850
They can be really expensive.
00:15:17.850 --> 00:15:20.119
And to be able to go do it. Yeah.
00:15:20.119 --> 00:15:27.359
So, listeners, if you click on the link in the description, it takes you to a security certification roadmap.
00:15:27.359 --> 00:15:32.264
And I was just amazed at how expensive some of these are.
00:15:32.264 --> 00:15:45.110
So I'm looking at the crest registered technical security architect, certification right now, that's $2,300, two exams, and they're in-person in the UK.
00:15:45.110 --> 00:15:54.519
You know, you're gonna see security expert is almost 7500 for ten exams.
00:15:54.519 --> 00:16:02.160
And so, I mean, those are kind of more on the expert level, but these are really steep prices.
00:16:02.160 --> 00:16:07.365
The beginner intermediate ones are more in the 300 to $500 range.
00:16:07.365 --> 00:16:10.802
But that's not always accessible to other people.
00:16:10.802 --> 00:16:11.235
Right.
00:16:11.235 --> 00:16:17.576
Like, sure, if you're in the security industry, you might have the salary that will allow you to do those exams.
00:16:17.576 --> 00:16:29.721
But if you are trying to get into the industry and you know you're working a minimum wage job studying for these certifications, that's really expensive.
00:16:29.721 --> 00:16:40.698
And I'm not saying that these certifications aren't worth it, but they are a huge investment, especially if you're not financially privileged.
00:16:41.466 --> 00:16:48.841
You know, the first certification exam I ever studied for was my CCNA, Certified Cisco Network Administrator.
00:16:48.841 --> 00:16:59.518
I was working at Krispy Kreme at the time, and in between batches of donuts because I was a cook, I was studying my CCNA book because I knew the donut life was not for me.
00:16:59.518 --> 00:17:03.922
Like a big, big donut was not going to bring me in.
00:17:03.922 --> 00:17:10.796
Yeah, I and also like if you're working a minimum wage job, that's probably not the only job that you're working.
00:17:10.796 --> 00:17:24.009
And so it's the time commitment as well, not only finding the motivation to study for the test, but also, you know, when you have free time, that's the last thing that you want to do.
00:17:24.009 --> 00:17:27.278
So you really have to be focused.
00:17:27.378 --> 00:17:30.249
And also, what if you're a single parent?
00:17:30.249 --> 00:17:31.784
What if you're a primary caregiver?
00:17:31.784 --> 00:17:34.787
What if your partner is sick and you have to take care of them?
00:17:34.787 --> 00:17:38.957
What if you are already in school?
00:17:39.357 --> 00:17:41.026
Let's say you're trying to get into this field.
00:17:41.026 --> 00:17:43.494
You go to the Barnes and Noble or your local bookstore.
00:17:43.494 --> 00:17:58.477
You find a book on, say, security plus or plus or as an example, and you go to your house, you start to read chapter one in chapter two, and then you realize, well, that I've got self-testing, I've got things I can do to see where I'm at and that I'm understanding material.
00:17:58.477 --> 00:18:09.253
And then you get, you know, you get 3 or 4 weeks into it, you read a little bit less and you read a little bit less, and then by two months you've already forgotten that you have this book and it's sitting on your desk and it's just collecting dust.
00:18:09.587 --> 00:18:14.125
That is a such a common narrative from my mentees that I've talked with.
00:18:14.125 --> 00:18:23.102
And one of the things I tell them is when I start reading a book, I've already found the money to take the test in 90 days, 90 to 120 days.
00:18:23.102 --> 00:18:24.702
I'm going to be taking this test.
00:18:24.702 --> 00:18:34.712
When you put the money down and you commit to a date, you're going to be shocked at what a great motivator that is, because you don't want to waste this money and you want to be prepared for this test.
00:18:34.712 --> 00:18:41.153
So because you know you will find the mental justification to go, well, I'll sign up for it next week.
00:18:41.153 --> 00:18:42.921
I'll sign up for the test next week.
00:18:42.921 --> 00:18:44.655
Oh. Next month. Oh, no, I better take it.
00:18:44.655 --> 00:18:45.891
I mean, like you will be.
00:18:45.891 --> 00:18:53.699
Excuses will eject from you because you don't want to go take a very hard, painful exam to get your certification in whatever you're trying to be certified in.
00:18:53.699 --> 00:19:03.741
So I always tell my mentees, commit the time and the money in advance so that you hold yourself accountable for being able to invest this effort into it.
00:19:04.308 --> 00:19:26.731
Yeah, you got to be honest with yourself and know yourself well enough to let you be able to tell what you know, what your motivation is and like, whether or not you feel like you actually, you know, are ready and like want to go do it, there's like no worse feeling than like knowing an exam is coming up in a few weeks and you have done nothing yet.
00:19:26.731 --> 00:19:35.907
And so like to me that is such a powerful motivator of like, okay, yeah, put that money down, put that time in my calendar.
00:19:35.907 --> 00:19:40.578
And now I'm, you know, I have to come up with a plan to figure out how to do this.
00:19:41.145 --> 00:19:48.186
On on the other side of it, like certifications are really great.
00:19:48.186 --> 00:19:54.593
They, you know, may not be a replacement for experience, but they do show a certain level of skill.
00:19:54.593 --> 00:19:55.359
Right.
00:19:55.359 --> 00:20:06.605
There are a lot of loud people on LinkedIn, on Reddit who tell people not to waste their time with certifications.
00:20:06.605 --> 00:20:12.211
What would you say to people who are certification skeptics?
00:20:06.882 --> 00:20:19.017
So where I'm at in my career right now, it would make a tremendous amount of sense for me to go get, say, my A plus or my security plus.
00:20:19.017 --> 00:20:22.086
I already have Nici, SSP.
00:20:22.086 --> 00:20:28.626
My career path has pushed me more from architectural engineering into security and risk management.
00:20:28.626 --> 00:20:35.133
So there's like a lot of certifications I can look at and go, nah, I just this is not right for me and my time in my career.
00:20:35.133 --> 00:20:37.435
That math changes.
00:20:37.435 --> 00:20:45.743
If that certification is a requirement to a job like like plane like you have like they will not hire you unless you have it.
00:20:45.743 --> 00:20:46.845
Right.
00:20:46.845 --> 00:20:51.182
So that has to be the first consideration that anybody has to take.
00:20:51.182 --> 00:20:52.483
All right.
00:20:52.483 --> 00:20:56.587
If you're a job seeker, you have to pass the AI firewall.
00:20:56.587 --> 00:21:00.525
And you, you need to be able to do that.
00:21:00.525 --> 00:21:03.494
So first off, love it.
00:21:03.494 --> 00:21:04.328
Hate it.
00:21:04.328 --> 00:21:05.830
It's just the way life is.
00:21:05.830 --> 00:21:22.013
Second thing, there is a tremendous amount of gatekeeping that exists in our profession that says there is no value or worth in a certain certification, and that you, you shouldn't do it, or that you've wasted your time doing it.
00:21:22.013 --> 00:21:32.490
One of the, one of the most frequent penalties that I see is that CISSP, which is the, Certified Information System security professional, it's put out by Ista.
00:21:32.490 --> 00:21:36.694
It's very expensive, reasonably hard exam to go pass.
00:21:36.694 --> 00:21:38.763
I never understood the hate.
00:21:38.763 --> 00:21:41.767
I never understood the things because...
00:21:41.767 --> 00:21:45.269
So let's say you go take your security plus your A-plus.
00:21:45.269 --> 00:21:48.240
You're in plus. And these are considered entry level certifications.
00:21:48.240 --> 00:21:54.211
And you don't immediately like jump out of the gate going I'm security for certified.
00:21:54.211 --> 00:21:59.250
I'm going to be a security a tier one security operations center, analysts or whatever.
00:21:59.250 --> 00:22:06.023
Let's say you go into a different career path, but you took the time to commit to memory and absorb.
00:22:06.023 --> 00:22:15.467
So literally, if you will, the study material that you really, successfully were able to, to do in a test, right, right.
00:22:15.467 --> 00:22:20.971
So you have invested a lot of hard work and doing the thing.
00:22:20.971 --> 00:22:28.846
I cannot envision a world where I ever crap on someone else's hard work, because they took the time to be a better version of themselves.
00:22:28.846 --> 00:22:35.820
They took the time to learn and to grow and to level up themselves up right.
00:22:35.987 --> 00:22:44.229
So obviously I don't subscribe to people, especially, on LinkedIn, which is the most artificial and crappy place that I know of.
00:22:44.229 --> 00:22:48.933
For people who are like, well, if you're a CI, SSP, you don't know anything about cyber security.
00:22:48.933 --> 00:22:51.303
Let me tell you a real story. All right?
00:22:51.303 --> 00:22:57.241
I went from working in the DoD space to the private sector space, working for a large facility.
00:22:57.241 --> 00:23:15.059
And the the way I got my foot in that door was I had a college degree, and I had just passed my CISSP because it was a firm requirement for a lot of the senior level information architecture, security protection roles that I was looking to move into.
00:23:15.059 --> 00:23:17.929
Right? Like if you didn't have it, they weren't even going to consider you.
00:23:17.929 --> 00:23:24.702
And so when you take the exam and you go through all the course material, a lot of it is technical, but a lot of it's not right.
00:23:24.702 --> 00:23:33.211
And so a lot of the things I was able to learn say, well, that and say I took something called an ITL, certification honestly was a vocabulary test.
00:23:33.211 --> 00:23:43.989
But one of the things I learned was the stop thinking, as a purely technical person and be able to translate these technical things in code, switch into business talk.
00:23:43.989 --> 00:23:56.902
Because when I'm talking to the vice president of information technology, when I'm talking to a CTO, which is technology officer, a chief financial officer, they know business risk and they know things like that extremely well.
00:23:56.902 --> 00:24:07.979
It's the language they talk they don't want to know or don't really care about the minutia of something that is technical and requires a security professional to look at.
00:24:07.979 --> 00:24:14.385
They need someone who can sit in between and just do the human work of translating, but who understands both of those things.
00:24:14.385 --> 00:24:15.186
Right.
00:24:15.186 --> 00:24:17.923
And that's something this ISP taught me.
00:24:17.923 --> 00:24:19.590
But that's my career space.
00:24:19.590 --> 00:24:26.364
Someone who's doing more red team and penetration testing, you know, they got to be really great at customer service and customer understanding and writing.
00:24:26.364 --> 00:24:27.932
Really great reports.
00:24:27.932 --> 00:24:36.273
Just because you're an offensive certified security professional with, you know, penetration testing with Kali Linux, you've gone through all that really brutal certification regime.
00:24:36.540 --> 00:24:42.413
You know, it's really funny. Is like, we haven't really talked about the hacking certs like your OCP or AOC, your exploit development, stuff like that.
00:24:42.413 --> 00:24:52.590
But it's really funny to me and I love this is like so when you think about cyber certifications, we think about learning technical stuff and then passing a test and then you go, okay, now how do I apply this stuff?
00:24:52.590 --> 00:24:55.259
Some of these tests are eminently practical.
00:24:55.259 --> 00:25:02.567
So like OCP, there's this really difficult one day hacking competition exam where you have to break into these machines.
00:25:02.567 --> 00:25:06.805
Part two of that, these last I checked, was you writing a report about it.
00:25:06.805 --> 00:25:13.010
Like, you have to summarize all the findings that you've you found and you have to articulate it in a report.
00:25:13.010 --> 00:25:22.621
And I think I know this, is important because when I worked for my electric utility, I paid people to break into systems, and I didn't care what they did.
00:25:22.621 --> 00:25:23.888
I cared about the report.
00:25:23.888 --> 00:25:26.391
That's what I was paying for, right?
00:25:26.391 --> 00:25:32.130
That's why I paid them a lot of money for was that report so I can look at it and go, oh, crap, we are over here.
00:25:32.130 --> 00:25:34.164
We need to get, we need to get the system patched.
00:25:34.164 --> 00:25:37.167
We need to find some money to remediate this, this bad thing.
00:25:37.201 --> 00:25:38.435
Everybody wants to hack stuff.
00:25:38.435 --> 00:25:40.137
Nobody wants to write a report.
00:25:40.137 --> 00:25:40.438
Right?
00:25:40.438 --> 00:25:45.743
So, like, there is professional acumen that is expected of you to pass.
00:25:45.743 --> 00:25:55.519
And that's considered one of the leading cybersecurity certifications in the space for hacking practitioners like Red team, folks who are pen testers and stuff like that.
00:25:55.519 --> 00:25:59.523
And it's not always going to be, can I break into this thing and do this thing?
00:25:59.523 --> 00:26:03.127
That's just called, you know, hack and stuff, right?
00:26:03.127 --> 00:26:06.431
That's but that's the difference between amateur and professional, right?
00:26:08.133 --> 00:26:09.300
No, I totally agree.
00:26:09.300 --> 00:26:11.603
I mean, I am a little biased.
00:26:11.603 --> 00:26:21.046
I'm a former technical writer and my work right now is dealing with, you know, reports and blogs that researchers are writing and then handing to me.
00:26:21.046 --> 00:26:27.451
But I could talk for hours and hours about how important documentation is, how important report writing is.
00:26:27.451 --> 00:26:34.726
It's a bridge between the actual work itself and the people who are giving you budget or trying to make decisions.
00:26:34.726 --> 00:26:45.170
So having skill in that aspect is incredibly desirable for a cybersecurity professional.
00:26:45.170 --> 00:26:48.873
And if a certification is going to teach you that, that is awesome.
00:26:48.873 --> 00:26:53.912
Listeners, Joe is rubbing his head.
00:26:53.912 --> 00:26:56.748
He looks mighty distressed right now.
00:26:53.912 --> 00:26:56.748
I hate it.
00:26:56.748 --> 00:26:59.784
No, I hate it so much I don't like I don't like documenting.
00:26:59.784 --> 00:27:01.385
I know, I know, it's necessary.
00:27:01.385 --> 00:27:07.157
I love it, and I thank God we have people like you and other folks like Kri and other folks at Cisco who are so good at it.
00:27:07.157 --> 00:27:09.426
But man, I'm not a fan of it.
00:27:09.426 --> 00:27:13.030
I just don't have the middle discipline to do it like you find folks do.
00:27:13.030 --> 00:27:14.699
So God bless you.
00:27:14.699 --> 00:27:16.734
You heard it from Joe, folks.
00:27:16.734 --> 00:27:26.411
Get those reports in, write your documentation, no matter how annoying it is, and maybe thank an editor or technical writer in your life today.
00:27:26.411 --> 00:27:30.414
So that's it for this episode of Talos Takes.
00:27:30.414 --> 00:27:32.784
Joe, thank you so much for joining me.
00:27:32.784 --> 00:27:36.554
That was a really great conversation and hopefully it helps a lot of people.
00:27:36.554 --> 00:27:40.392
So stay safe out there and we'll see you in another two weeks.
00:27:40.791 --> 00:27:41.226
Bye friends!
00:00:00.166 --> 00:00:06.139
Welcome to the Talos Takes podcast, where we discuss Talos’ latest research and security news.
00:00:06.139 --> 00:00:12.478
This podcast is for everyone from the C-suite to the frontlines.
00:00:12.579 --> 00:00:17.317
Hello everyone, and Happy New Year! My name is Amy Ciminnisi.
00:00:17.317 --> 00:00:21.821
I am thrilled to be hosting my very first episode of Talos Takes.
00:00:21.821 --> 00:00:25.291
Up until now, you've been hearing Hazel Burton.
00:00:25.291 --> 00:00:32.465
She's done absolutely amazing things with this podcast over the past year and a half, and now she's handing off the reins to me.
00:00:32.465 --> 00:00:36.335
God knows why, but I really couldn't be more excited to be here.
00:00:37.003 --> 00:00:40.173
A little bit about what I do here at Talos.
00:00:40.173 --> 00:00:42.674
I'm the Content Manager and Editor.
00:00:42.674 --> 00:00:54.820
So our researchers and incident responders write their blogs and findings and reports, and they send them my way for a polish before it goes out to the wider community.
00:00:54.820 --> 00:01:01.860
I also run our social media, and I host Humans of Talos over on YouTube, so definitely check that out.
00:01:01.960 --> 00:01:03.595
Now let's get into it.
00:01:03.595 --> 00:01:08.301
Imagine this you are a technical writer with barely a year of experience.
00:01:08.301 --> 00:01:17.209
Before then, you had been working in nonprofit fundraising, so radically different, and suddenly you get laid off.
00:01:17.209 --> 00:01:19.111
It's a cold November day.
00:01:19.111 --> 00:01:26.986
The holidays are coming up, you're on unemployment benefits, and you're reaching out to every connection that you have with open jobs.
00:01:26.986 --> 00:01:29.055
You've landed a few interviews.
00:01:29.055 --> 00:01:39.231
Nothing really sticks yet, but as you scroll through the listings, you notice that more and more content and technical writing openings are in cybersecurity.
00:01:39.231 --> 00:01:41.968
You don't have a ton of experience there.
00:01:41.968 --> 00:01:52.111
And to get maybe a leg up, you start looking at different certifications that you can get, courses that you can take, and you find an entry level one.
00:01:52.111 --> 00:01:55.215
You think, “You know, why not get some baseline knowledge?
00:01:55.215 --> 00:02:00.453
At the very least, it'll give me something to talk about in interviews if I land one.”
00:02:00.453 --> 00:02:08.026
That certification, which was at the time only half finished, probably even less than that...
00:02:08.026 --> 00:02:14.099
That entry level certification is part of why I was offered a position at Talos.
00:02:14.099 --> 00:02:22.975
So for my first episode, I wanted to dive into the very confusing world of cybersecurity certifications.
00:02:22.975 --> 00:02:33.152
And with me is someone who not only has several certifications of their own, but also mentors people through their certification journeys.
00:02:33.152 --> 00:02:35.320
And you know him. You love him.
00:02:35.320 --> 00:02:39.125
It is Joe Marshall! Joe, how are you doing?
00:02:39.125 --> 00:02:41.161
And the crowd goes wild.
00:02:41.161 --> 00:02:41.161
Thanks for having me.
00:02:43.395 --> 00:02:45.664
Yeah. Of course. Thanks for being here.
00:02:45.664 --> 00:02:51.336
When I brought this topic to the group, you very enthusiastically jumped in.
00:02:51.336 --> 00:02:55.542
Can you talk a little bit about your own journey with certifications?
00:02:55.542 --> 00:02:59.913
When, why, How did you decide to get your first one?
00:02:59.913 --> 00:03:00.780
Sure. Yeah.
00:03:00.780 --> 00:03:02.681
So I started off in information technology.
00:03:02.681 --> 00:03:12.991
I didn't start off in cybersecurity, arguably cybersecurity as a mature profession didn't exist when I was in, you know, I'm and I'm in my mid 40s now.
00:03:12.991 --> 00:03:13.659
God help me.
00:03:13.659 --> 00:03:18.931
I started in it in my early 20s and cybersecurity hadn't really matured.
00:03:18.931 --> 00:03:21.033
It's where he is now, obviously.
00:03:21.033 --> 00:03:27.774
And certainly there weren't the plethora of cybersecurity certifications that exist now that did 15 or 20 years ago.
00:03:27.774 --> 00:03:33.145
So the certifications I initially got were for administration.
00:03:33.145 --> 00:03:36.782
So I'm a, you know, Microsoft certified systems engineer.
00:03:36.782 --> 00:03:42.822
I have some vendor certifications outside of that in there, like hardware, basic unveil hardware and things like that.
00:03:42.822 --> 00:03:46.558
Then later as my career for the rest, I went into working for D.O.D.
00:03:46.558 --> 00:03:58.270
and there were some certifications that were mandatory to be, an information, like, assurance management level of of of, professionalism they expect.
00:03:58.270 --> 00:04:01.174
And one of those was called the security plus.
00:04:01.174 --> 00:04:14.820
And then I would later go on in my career to get like a CISSP, which is a much, you know, different type of certification for my mix year of my Security plus or from, all these other certifications that I, that I've, that I've been able to attain over my career.
00:04:14.820 --> 00:04:33.005
So for me personally and has been a fairly long journey, to get the certifications that I have, and swim indirectly in some ways landed me here at Cisco Talos.
00:04:33.005 --> 00:04:36.009
Well, on 11 years ago now.
00:04:33.016 --> 00:04:36.009
Wow.
00:04:36.009 --> 00:04:37.110
Yeah. Yeah.
00:04:37.110 --> 00:04:44.083
So there are a million different certification providers and a million different types.
00:04:44.083 --> 00:04:51.624
And amongst those, kind of like you mentioned, there are vendor specific and then vendor agnostic certifications as well.
00:04:51.624 --> 00:04:58.398
Can you talk a little bit about like who some of the main providers of certifications are?
00:04:58.398 --> 00:05:02.168
The types that they provide, things like that.
00:05:02.535 --> 00:05:13.211
So, so if anyone ever is, able to get a cybersecurity certification or they want to get one, you are going to be just buried in a plethora of choices.
00:05:13.211 --> 00:05:16.415
And, and actually, I hope you link in the show notes.
00:05:16.415 --> 00:05:24.357
The chart that we've been looking at together for just the ridiculous amount of cybersecurity certifications that exist.
00:05:24.357 --> 00:05:35.100
But like, you have some of your major vendors, just so you have and so every major market vendor usually offers a cybersecurity certification with their product.
00:05:35.100 --> 00:05:38.971
Microsoft does, Cisco does, Amazon does.
00:05:38.971 --> 00:05:39.271
Right.
00:05:39.271 --> 00:05:52.084
So like because they want you to use their product and also have a minimum standard of qualification and certification that exists, that your employer or that you may wish to do for professional self-development.
00:05:52.084 --> 00:05:53.752
To go. Yep.
00:05:53.752 --> 00:06:00.959
I have taken Amazon EC2 cybersecurity training and I am now a certified, security administrator.
00:06:00.959 --> 00:06:04.697
I've met the vendor's standards for a qualified person.
00:06:04.697 --> 00:06:11.137
And I have a piece of digital paper to show, or maybe real that this shows you that that you know, you did the thing right.
00:06:11.370 --> 00:06:15.274
There's also certification bodies that exist outside of vendors.
00:06:15.274 --> 00:06:18.244
So you have some that are extremely vendor agnostic.
00:06:18.244 --> 00:06:20.480
So CompTIA would be a good example of that.
00:06:20.480 --> 00:06:25.584
Everyone's familiar with CompTIA in the sense of they offer the you know the plus certification.
00:06:25.584 --> 00:06:31.923
So security plus network plus a plus cloud plus Linux plus those are vendor agnostic.
00:06:31.923 --> 00:06:44.836
You have like ESI two or IEC SC squared certifications that for your security risk management, like so like they're the ones that do out the CISSP or the GSB or the Casb clause and stuff like that.
00:06:44.836 --> 00:06:47.973
Those also are vendor agnostic as well.
00:06:47.973 --> 00:06:51.511
And we're really just scratching the surface.
00:06:51.511 --> 00:06:54.880
The more you dig, the more you start to drown.
00:06:54.880 --> 00:07:05.024
And this, the more analysis paralysis that happens because you're like, especially if you're a beginner in this space, if you're just trying to get your foot in the door, you're looking this going, oh my God, what do I even do here?
00:07:05.024 --> 00:07:07.526
Like, how do I even know if this is really good?
00:07:05.033 --> 00:07:07.526
Yeah.
00:07:07.526 --> 00:07:12.899
And then you have the difference between the beginner and expert level certifications, right?
00:07:14.166 --> 00:07:18.370
They exist in all strata of your career progression.
00:07:18.370 --> 00:07:23.509
Like a beginner or a newbie to cybersecurity is not going to get their CISSP.
00:07:23.509 --> 00:07:31.050
As a matter of fact, there's a minimum in time experience that you have to be able to document before they let you sit down for the certification, right?
00:07:31.050 --> 00:07:45.230
But they do offer entry level certifications that, you know, only require a year or less of experience, or they're willing to waive some of that experience based on, say, college education or things that they would sit or, counts as experience sort of sort of standards.
00:07:45.230 --> 00:07:46.865
And that's relatively unique.
00:07:46.865 --> 00:07:48.701
And in that space.
00:07:48.701 --> 00:07:55.374
But, you know, from security operations to asset security to architecture and engineering, there's something for everybody.
00:07:55.374 --> 00:07:56.675
There's something for everybody.
00:07:56.675 --> 00:08:00.346
So like it, it's it's very fluid is what I'm saying.
00:08:00.346 --> 00:08:07.487
It is situationally applicable to where you are in your career, who you're working for, what vendors you're using or not using.
00:08:07.487 --> 00:08:14.392
Because there are certainly generalist cybersecurity certifications that exist that I actually I do recommend because they are vendor agnostic.
00:08:14.392 --> 00:08:20.298
And you can see just by me talking about this, I can see your eyes starting to go, what have I done?
00:08:20.298 --> 00:08:22.201
I've asked Joe these questions.
00:08:22.201 --> 00:08:24.170
I don't understand any of this.
00:08:24.170 --> 00:08:25.872
What the hell, man?
00:08:25.872 --> 00:08:29.242
I'm always thinking in terms of, like, practical steps.
00:08:29.242 --> 00:08:32.577
So, like you said, analysis paralysis.
00:08:32.577 --> 00:08:34.013
And I went, yep. That's it.
00:08:34.013 --> 00:08:35.947
That's what I'm feeling.
00:08:35.947 --> 00:08:53.499
If someone is at that stage where they are trying to figure out where to go next, what certification to work toward next, what are the the best methods you suggest they use to kind of finally drill down and focus on one?
00:08:54.366 --> 00:08:54.767
Yeah.
00:08:54.767 --> 00:09:04.744
So like this is such a hard question to answer because I don't know, like, so for anybody listening to this right now and you're going, yes, Joe, give me the wisdom.
00:09:04.744 --> 00:09:06.846
Tell me what test to go take.
00:09:06.846 --> 00:09:17.389
You have to be able to answer that yourself, because I don't know where the individual background of anyone that wants to go to take a certification exam where they are or you're already in the space.
00:09:17.389 --> 00:09:20.592
Are you trying to get a job into this cybersecurity career field?
00:09:20.592 --> 00:09:22.662
What's your what's your past like?
00:09:22.662 --> 00:09:24.062
Have you done it like I did?
00:09:24.062 --> 00:09:27.832
And you just sort of organically shifting into it or you coming in blind, right.
00:09:27.832 --> 00:09:32.171
So the the advice I have is just that it's advice.
00:09:32.171 --> 00:09:33.873
It's generalized.
00:09:33.873 --> 00:09:41.279
All I want for anyone is to work hard and be successful and be a student of this game.
00:09:41.279 --> 00:09:44.649
And there's certainly a certification that is applicable to you.
00:09:44.649 --> 00:09:45.451
All right.
00:09:45.451 --> 00:09:56.227
From a practical mentor experience because so I'm, one of the mentors of the Women in Cyber program here at Cisco and certainly, personal relationships that I've had outside of my organization where I mentored others.
00:09:56.227 --> 00:09:59.631
I'm kind of a fan of the CompTIA certifications.
00:09:59.631 --> 00:10:02.368
So this would be your A plus your network plus, your security plus.
00:10:02.368 --> 00:10:05.171
And the reason for that is real simple one you can study at home.
00:10:05.171 --> 00:10:06.605
You don't have to go to class.
00:10:06.605 --> 00:10:24.255
You can take online courses like, Udemy or one of the certainly there are if you go to YouTube for the CompTIA base certifications, the reason I kind of like them is they're they're establishing a very vendor agnostic security and technology baseline.
00:10:24.255 --> 00:10:26.458
How does the internet work?
00:10:26.458 --> 00:10:29.528
How does a PC what are the minimum standards to operate something?
00:10:29.528 --> 00:10:31.230
What is an operating system?
00:10:31.230 --> 00:10:32.565
What is hardware?
00:10:32.565 --> 00:10:43.475
Like they're just trying to establish the bare minimum of what you should understand before you go into, like a vendor certification, like the Cisco Certified Network.
00:10:43.475 --> 00:10:46.211
Administrator cannot. Right.
00:10:46.211 --> 00:10:57.288
Where you're going to learn some of that, obviously, but you're also going to learn sort of like the Cisco methodology behind why and how we use our core level and access routing to do the things that we do for switch in route. Right.
00:10:57.288 --> 00:11:15.173
So like, but if you understand, like, a routing protocol like rip G, rip OSPF or if you're going to understand how the both the protocols TCP and IP work, you know, how are they constructed, what is their their packet structure.
00:11:15.173 --> 00:11:27.285
Like like you're you're if you can understand that at a general level, it's going to carry you foundationally into so many different things that if you just wanted to do networking, we haven't even talked about cybersecurity yet.
00:11:27.285 --> 00:11:38.464
So let's say I talk about something like, DNS exfiltration, which is, a way to steal network, data from a victim, and you exfil out using, bogus DNS requests.
00:11:38.464 --> 00:11:46.971
If you don't know how DNS works and you see a DNS exploration question on your security Plus exam, which I don't know if it would be there, but let's say you do.
00:11:46.971 --> 00:11:56.248
Well, then you're not going to get the question right, because you don't have a foundational understanding of what domain naming systems actually are and do and how they make the internet work.
00:11:56.248 --> 00:11:57.082
Right.
00:11:57.082 --> 00:12:03.822
So like there's a core level of of just technical proficiency and acumen that you have to do.
00:12:03.822 --> 00:12:13.798
And the worst part about all of this is when you're studying cybersecurity, generally speaking, this isn't something you can just pick up and touch.
00:12:13.798 --> 00:12:15.267
It's not like I'm learning how to weld.
00:12:15.267 --> 00:12:18.269
I'm learning how to do Hvac repair.
00:12:18.269 --> 00:12:23.042
I can't just do hands on journeyman practice from a found.
00:12:23.042 --> 00:12:27.779
I can't hold the OSI model in my hand and take it apart, per se, right?
00:12:27.779 --> 00:12:29.615
We're talking about a lot of theory.
00:12:29.615 --> 00:12:38.157
We're talking a lot about things with the way the internet was constructed way back in the 1980s, and it's not easy to wrap your brain around sometimes, though.
00:12:38.157 --> 00:12:41.126
Like, what do you mean, what's the data frame?
00:12:41.126 --> 00:12:42.528
What's a packet? What's up?
00:12:42.528 --> 00:12:53.471
You know, like, I don't know what any of this stuff is, but I'm reading some really weird stuff in this book and it says I have to know it from this certification exam. Right? So yeah, it's a challenge.
00:12:53.471 --> 00:13:03.481
It can really be a for if you're coming in cold and you don't have a mentor and you're just wondering what like you're reading this book, I get it, people are intimidated by it and they get lost in it.
00:13:03.481 --> 00:13:11.456
And they're like, my brain shuts down because we're talking about really ephemeral stuff, but all that stuff is super important.
00:13:11.456 --> 00:13:23.568
Every other foundational aspect of cybersecurity, and will really come to pay dividends when you are confronted with something either personally, professionally in your journey for for being a security professional.
00:13:23.568 --> 00:13:26.572
And you're going to go, Emily, do I know how that works?
00:13:26.572 --> 00:13:32.610
I can understand the exploit or the vulnerability that's being discussed because of how it works.
00:13:32.610 --> 00:13:35.413
Yeah, honestly, it's the greatest feeling in the world.
00:13:35.413 --> 00:13:42.354
You know, I'm doing the Google Cybersecurity Professional certificate on Coursera, right now, and it's really basic stuff.
00:13:42.354 --> 00:14:00.773
But like once I finish a module and I, you know, I've completed everything and I come back to work and I hear people talking about stuff, it is the most rewarding thing to be able to go, yes, I know this, I understand it, and people have like a super beginner level conversation.
00:14:01.039 --> 00:14:05.778
But like, it's so like I said, it's so rewarding.
00:14:05.778 --> 00:14:18.823
Knowing that I am increasing my understanding of really important concepts, but like just because it's rewarding toward the end doesn't mean that I am motivated throughout all of it, right?
00:14:18.823 --> 00:14:30.201
So like, I end up having to put like three hour time blocks on my schedule in order to find the motivation to keep on, going with the certification.
00:14:30.201 --> 00:14:37.976
And there are just times when I really struggle to sit down and pay attention to these videos and especially the readings.
00:14:38.409 --> 00:14:47.318
So I'm curious, in your experience as a mentor, what are the biggest challenges other than it being super ephemeral content?
00:14:47.318 --> 00:14:48.921
That people face?
00:14:48.921 --> 00:14:52.857
I could see the look on your face right now.
00:14:52.857 --> 00:14:54.894
We're asking the hard questions today.
00:14:54.894 --> 00:14:56.195
Yeah, coming at me hard.
00:14:56.195 --> 00:15:01.200
All right, so not everyone is on the same playing field when it comes to taking these tests.
00:15:01.200 --> 00:15:05.169
I've done 11 certification exams in my career.
00:15:05.169 --> 00:15:06.605
All right?
00:15:06.605 --> 00:15:11.610
All of them require a level of commitment for me to set aside the free time.
00:15:11.610 --> 00:15:13.511
And the money.
00:15:13.511 --> 00:15:15.047
Because these tests aren't free.
00:15:15.047 --> 00:15:17.850
They can be really expensive.
00:15:17.850 --> 00:15:20.119
And to be able to go do it. Yeah.
00:15:20.119 --> 00:15:27.359
So, listeners, if you click on the link in the description, it takes you to a security certification roadmap.
00:15:27.359 --> 00:15:32.264
And I was just amazed at how expensive some of these are.
00:15:32.264 --> 00:15:45.110
So I'm looking at the crest registered technical security architect, certification right now, that's $2,300, two exams, and they're in-person in the UK.
00:15:45.110 --> 00:15:54.519
You know, you're gonna see security expert is almost 7500 for ten exams.
00:15:54.519 --> 00:16:02.160
And so, I mean, those are kind of more on the expert level, but these are really steep prices.
00:16:02.160 --> 00:16:07.365
The beginner intermediate ones are more in the 300 to $500 range.
00:16:07.365 --> 00:16:10.802
But that's not always accessible to other people.
00:16:10.802 --> 00:16:11.235
Right.
00:16:11.235 --> 00:16:17.576
Like, sure, if you're in the security industry, you might have the salary that will allow you to do those exams.
00:16:17.576 --> 00:16:29.721
But if you are trying to get into the industry and you know you're working a minimum wage job studying for these certifications, that's really expensive.
00:16:29.721 --> 00:16:40.698
And I'm not saying that these certifications aren't worth it, but they are a huge investment, especially if you're not financially privileged.
00:16:41.466 --> 00:16:48.841
You know, the first certification exam I ever studied for was my CCNA, Certified Cisco Network Administrator.
00:16:48.841 --> 00:16:59.518
I was working at Krispy Kreme at the time, and in between batches of donuts because I was a cook, I was studying my CCNA book because I knew the donut life was not for me.
00:16:59.518 --> 00:17:03.922
Like a big, big donut was not going to bring me in.
00:17:03.922 --> 00:17:10.796
Yeah, I and also like if you're working a minimum wage job, that's probably not the only job that you're working.
00:17:10.796 --> 00:17:24.009
And so it's the time commitment as well, not only finding the motivation to study for the test, but also, you know, when you have free time, that's the last thing that you want to do.
00:17:24.009 --> 00:17:27.278
So you really have to be focused.
00:17:27.378 --> 00:17:30.249
And also, what if you're a single parent?
00:17:30.249 --> 00:17:31.784
What if you're a primary caregiver?
00:17:31.784 --> 00:17:34.787
What if your partner is sick and you have to take care of them?
00:17:34.787 --> 00:17:38.957
What if you are already in school?
00:17:39.357 --> 00:17:41.026
Let's say you're trying to get into this field.
00:17:41.026 --> 00:17:43.494
You go to the Barnes and Noble or your local bookstore.
00:17:43.494 --> 00:17:58.477
You find a book on, say, security plus or plus or as an example, and you go to your house, you start to read chapter one in chapter two, and then you realize, well, that I've got self-testing, I've got things I can do to see where I'm at and that I'm understanding material.
00:17:58.477 --> 00:18:09.253
And then you get, you know, you get 3 or 4 weeks into it, you read a little bit less and you read a little bit less, and then by two months you've already forgotten that you have this book and it's sitting on your desk and it's just collecting dust.
00:18:09.587 --> 00:18:14.125
That is a such a common narrative from my mentees that I've talked with.
00:18:14.125 --> 00:18:23.102
And one of the things I tell them is when I start reading a book, I've already found the money to take the test in 90 days, 90 to 120 days.
00:18:23.102 --> 00:18:24.702
I'm going to be taking this test.
00:18:24.702 --> 00:18:34.712
When you put the money down and you commit to a date, you're going to be shocked at what a great motivator that is, because you don't want to waste this money and you want to be prepared for this test.
00:18:34.712 --> 00:18:41.153
So because you know you will find the mental justification to go, well, I'll sign up for it next week.
00:18:41.153 --> 00:18:42.921
I'll sign up for the test next week.
00:18:42.921 --> 00:18:44.655
Oh. Next month. Oh, no, I better take it.
00:18:44.655 --> 00:18:45.891
I mean, like you will be.
00:18:45.891 --> 00:18:53.699
Excuses will eject from you because you don't want to go take a very hard, painful exam to get your certification in whatever you're trying to be certified in.
00:18:53.699 --> 00:19:03.741
So I always tell my mentees, commit the time and the money in advance so that you hold yourself accountable for being able to invest this effort into it.
00:19:04.308 --> 00:19:26.731
Yeah, you got to be honest with yourself and know yourself well enough to let you be able to tell what you know, what your motivation is and like, whether or not you feel like you actually, you know, are ready and like want to go do it, there's like no worse feeling than like knowing an exam is coming up in a few weeks and you have done nothing yet.
00:19:26.731 --> 00:19:35.907
And so like to me that is such a powerful motivator of like, okay, yeah, put that money down, put that time in my calendar.
00:19:35.907 --> 00:19:40.578
And now I'm, you know, I have to come up with a plan to figure out how to do this.
00:19:41.145 --> 00:19:48.186
On on the other side of it, like certifications are really great.
00:19:48.186 --> 00:19:54.593
They, you know, may not be a replacement for experience, but they do show a certain level of skill.
00:19:54.593 --> 00:19:55.359
Right.
00:19:55.359 --> 00:20:06.605
There are a lot of loud people on LinkedIn, on Reddit who tell people not to waste their time with certifications.
00:20:06.605 --> 00:20:12.211
What would you say to people who are certification skeptics?
00:20:06.882 --> 00:20:19.017
So where I'm at in my career right now, it would make a tremendous amount of sense for me to go get, say, my A plus or my security plus.
00:20:19.017 --> 00:20:22.086
I already have Nici, SSP.
00:20:22.086 --> 00:20:28.626
My career path has pushed me more from architectural engineering into security and risk management.
00:20:28.626 --> 00:20:35.133
So there's like a lot of certifications I can look at and go, nah, I just this is not right for me and my time in my career.
00:20:35.133 --> 00:20:37.435
That math changes.
00:20:37.435 --> 00:20:45.743
If that certification is a requirement to a job like like plane like you have like they will not hire you unless you have it.
00:20:45.743 --> 00:20:46.845
Right.
00:20:46.845 --> 00:20:51.182
So that has to be the first consideration that anybody has to take.
00:20:51.182 --> 00:20:52.483
All right.
00:20:52.483 --> 00:20:56.587
If you're a job seeker, you have to pass the AI firewall.
00:20:56.587 --> 00:21:00.525
And you, you need to be able to do that.
00:21:00.525 --> 00:21:03.494
So first off, love it.
00:21:03.494 --> 00:21:04.328
Hate it.
00:21:04.328 --> 00:21:05.830
It's just the way life is.
00:21:05.830 --> 00:21:22.013
Second thing, there is a tremendous amount of gatekeeping that exists in our profession that says there is no value or worth in a certain certification, and that you, you shouldn't do it, or that you've wasted your time doing it.
00:21:22.013 --> 00:21:32.490
One of the, one of the most frequent penalties that I see is that CISSP, which is the, Certified Information System security professional, it's put out by Ista.
00:21:32.490 --> 00:21:36.694
It's very expensive, reasonably hard exam to go pass.
00:21:36.694 --> 00:21:38.763
I never understood the hate.
00:21:38.763 --> 00:21:41.767
I never understood the things because...
00:21:41.767 --> 00:21:45.269
So let's say you go take your security plus your A-plus.
00:21:45.269 --> 00:21:48.240
You're in plus. And these are considered entry level certifications.
00:21:48.240 --> 00:21:54.211
And you don't immediately like jump out of the gate going I'm security for certified.
00:21:54.211 --> 00:21:59.250
I'm going to be a security a tier one security operations center, analysts or whatever.
00:21:59.250 --> 00:22:06.023
Let's say you go into a different career path, but you took the time to commit to memory and absorb.
00:22:06.023 --> 00:22:15.467
So literally, if you will, the study material that you really, successfully were able to, to do in a test, right, right.
00:22:15.467 --> 00:22:20.971
So you have invested a lot of hard work and doing the thing.
00:22:20.971 --> 00:22:28.846
I cannot envision a world where I ever crap on someone else's hard work, because they took the time to be a better version of themselves.
00:22:28.846 --> 00:22:35.820
They took the time to learn and to grow and to level up themselves up right.
00:22:35.987 --> 00:22:44.229
So obviously I don't subscribe to people, especially, on LinkedIn, which is the most artificial and crappy place that I know of.
00:22:44.229 --> 00:22:48.933
For people who are like, well, if you're a CI, SSP, you don't know anything about cyber security.
00:22:48.933 --> 00:22:51.303
Let me tell you a real story. All right?
00:22:51.303 --> 00:22:57.241
I went from working in the DoD space to the private sector space, working for a large facility.
00:22:57.241 --> 00:23:15.059
And the the way I got my foot in that door was I had a college degree, and I had just passed my CISSP because it was a firm requirement for a lot of the senior level information architecture, security protection roles that I was looking to move into.
00:23:15.059 --> 00:23:17.929
Right? Like if you didn't have it, they weren't even going to consider you.
00:23:17.929 --> 00:23:24.702
And so when you take the exam and you go through all the course material, a lot of it is technical, but a lot of it's not right.
00:23:24.702 --> 00:23:33.211
And so a lot of the things I was able to learn say, well, that and say I took something called an ITL, certification honestly was a vocabulary test.
00:23:33.211 --> 00:23:43.989
But one of the things I learned was the stop thinking, as a purely technical person and be able to translate these technical things in code, switch into business talk.
00:23:43.989 --> 00:23:56.902
Because when I'm talking to the vice president of information technology, when I'm talking to a CTO, which is technology officer, a chief financial officer, they know business risk and they know things like that extremely well.
00:23:56.902 --> 00:24:07.979
It's the language they talk they don't want to know or don't really care about the minutia of something that is technical and requires a security professional to look at.
00:24:07.979 --> 00:24:14.385
They need someone who can sit in between and just do the human work of translating, but who understands both of those things.
00:24:14.385 --> 00:24:15.186
Right.
00:24:15.186 --> 00:24:17.923
And that's something this ISP taught me.
00:24:17.923 --> 00:24:19.590
But that's my career space.
00:24:19.590 --> 00:24:26.364
Someone who's doing more red team and penetration testing, you know, they got to be really great at customer service and customer understanding and writing.
00:24:26.364 --> 00:24:27.932
Really great reports.
00:24:27.932 --> 00:24:36.273
Just because you're an offensive certified security professional with, you know, penetration testing with Kali Linux, you've gone through all that really brutal certification regime.
00:24:36.540 --> 00:24:42.413
You know, it's really funny. Is like, we haven't really talked about the hacking certs like your OCP or AOC, your exploit development, stuff like that.
00:24:42.413 --> 00:24:52.590
But it's really funny to me and I love this is like so when you think about cyber certifications, we think about learning technical stuff and then passing a test and then you go, okay, now how do I apply this stuff?
00:24:52.590 --> 00:24:55.259
Some of these tests are eminently practical.
00:24:55.259 --> 00:25:02.567
So like OCP, there's this really difficult one day hacking competition exam where you have to break into these machines.
00:25:02.567 --> 00:25:06.805
Part two of that, these last I checked, was you writing a report about it.
00:25:06.805 --> 00:25:13.010
Like, you have to summarize all the findings that you've you found and you have to articulate it in a report.
00:25:13.010 --> 00:25:22.621
And I think I know this, is important because when I worked for my electric utility, I paid people to break into systems, and I didn't care what they did.
00:25:22.621 --> 00:25:23.888
I cared about the report.
00:25:23.888 --> 00:25:26.391
That's what I was paying for, right?
00:25:26.391 --> 00:25:32.130
That's why I paid them a lot of money for was that report so I can look at it and go, oh, crap, we are over here.
00:25:32.130 --> 00:25:34.164
We need to get, we need to get the system patched.
00:25:34.164 --> 00:25:37.167
We need to find some money to remediate this, this bad thing.
00:25:37.201 --> 00:25:38.435
Everybody wants to hack stuff.
00:25:38.435 --> 00:25:40.137
Nobody wants to write a report.
00:25:40.137 --> 00:25:40.438
Right?
00:25:40.438 --> 00:25:45.743
So, like, there is professional acumen that is expected of you to pass.
00:25:45.743 --> 00:25:55.519
And that's considered one of the leading cybersecurity certifications in the space for hacking practitioners like Red team, folks who are pen testers and stuff like that.
00:25:55.519 --> 00:25:59.523
And it's not always going to be, can I break into this thing and do this thing?
00:25:59.523 --> 00:26:03.127
That's just called, you know, hack and stuff, right?
00:26:03.127 --> 00:26:06.431
That's but that's the difference between amateur and professional, right?
00:26:08.133 --> 00:26:09.300
No, I totally agree.
00:26:09.300 --> 00:26:11.603
I mean, I am a little biased.
00:26:11.603 --> 00:26:21.046
I'm a former technical writer and my work right now is dealing with, you know, reports and blogs that researchers are writing and then handing to me.
00:26:21.046 --> 00:26:27.451
But I could talk for hours and hours about how important documentation is, how important report writing is.
00:26:27.451 --> 00:26:34.726
It's a bridge between the actual work itself and the people who are giving you budget or trying to make decisions.
00:26:34.726 --> 00:26:45.170
So having skill in that aspect is incredibly desirable for a cybersecurity professional.
00:26:45.170 --> 00:26:48.873
And if a certification is going to teach you that, that is awesome.
00:26:48.873 --> 00:26:53.912
Listeners, Joe is rubbing his head.
00:26:53.912 --> 00:26:56.748
He looks mighty distressed right now.
00:26:53.912 --> 00:26:56.748
I hate it.
00:26:56.748 --> 00:26:59.784
No, I hate it so much I don't like I don't like documenting.
00:26:59.784 --> 00:27:01.385
I know, I know, it's necessary.
00:27:01.385 --> 00:27:07.157
I love it, and I thank God we have people like you and other folks like Kri and other folks at Cisco who are so good at it.
00:27:07.157 --> 00:27:09.426
But man, I'm not a fan of it.
00:27:09.426 --> 00:27:13.030
I just don't have the middle discipline to do it like you find folks do.
00:27:13.030 --> 00:27:14.699
So God bless you.
00:27:14.699 --> 00:27:16.734
You heard it from Joe, folks.
00:27:16.734 --> 00:27:26.411
Get those reports in, write your documentation, no matter how annoying it is, and maybe thank an editor or technical writer in your life today.
00:27:26.411 --> 00:27:30.414
So that's it for this episode of Talos Takes.
00:27:30.414 --> 00:27:32.784
Joe, thank you so much for joining me.
00:27:32.784 --> 00:27:36.554
That was a really great conversation and hopefully it helps a lot of people.
00:27:36.554 --> 00:27:40.392
So stay safe out there and we'll see you in another two weeks.
00:27:40.791 --> 00:27:41.226
Bye friends!
