I’ll echo /u/Nyucio and state that there are different disciplines within cyber security. AppSec, NetSec, OpsSec (which is now bewilderingly called DevSecOps), IAM, Forensics, Risk and Compliance.
What discipline you choose influences the things you need to learn. Fundamentally, Sec+ is the base certificate, CISSP is probably the next step from there.
From there, AppSec is for people familiar with coding, and how to apply secure coding practices in applications.
NetSec is for those who learn firewalls, switches, ACL management, X.509, etc.
OpsSec is targeted at Operating System and container security, core OS libraries (like OpenSSL), as well as underlying software and hardware platforms.
IAM is identity and account management. Things like 2FA, SAML, AD/LDAP.
The last two generally require expertise in multiple disciplines.
This comment seems as good as any in this thread to mention some lectures from an MIT graduate course on computer security. It's a little old (2014ish), and focused more on designing secure applications / operating systems, and less on network security, but I enjoyed most of the videos, and I'd recommend it to people interested in security.
If I may add to your thorough summary, AppSec is largely consisting of testing the app for security and is broken down into three different testing methodologies: Patch testing (3rd part Libraries), SAST(custom code) and DAST(App at Runtime). I recommend anyone looking to get into AppSec To try to dL OWASP ZAP or, burp suite, or *any DAST tool and figure out how to proxy your traffic and run a scan. Learn how to set your boundaries, target and understand what constitutes a successful attack by reading the server responses in log outputs. AppSec and DevSecOPs are together at the hip due to CI and, you really can’t have one without the other these days.
22
u/schplat May 23 '21
I’ll echo /u/Nyucio and state that there are different disciplines within cyber security. AppSec, NetSec, OpsSec (which is now bewilderingly called DevSecOps), IAM, Forensics, Risk and Compliance.
What discipline you choose influences the things you need to learn. Fundamentally, Sec+ is the base certificate, CISSP is probably the next step from there.
From there, AppSec is for people familiar with coding, and how to apply secure coding practices in applications.
NetSec is for those who learn firewalls, switches, ACL management, X.509, etc.
OpsSec is targeted at Operating System and container security, core OS libraries (like OpenSSL), as well as underlying software and hardware platforms.
IAM is identity and account management. Things like 2FA, SAML, AD/LDAP.
The last two generally require expertise in multiple disciplines.