@stevedidwhat_infosec@infosec.pub dropped some great resources. I also typically direct people to this resource I wrote a few years back in terms of “getting into infosec” shellsharks.com/getting-into-information-security.
Comment on Mentorship Monday - Discussions for career and learning!
python@programming.dev 5 months ago
This thread randomly came across my timeline, so yeah why not!
Does anyone have any good resources on “general” cyber security information? Like total Cybersecurity 101 stuff, especially for mid to large sized company infrastructure? I’ve done a bit in school but I could totally use a refresher on all of the concepts.
Officially, I was put into the Role of “Cloud Security Engineer” at work. No one really knows what that means yet, the Roles were handed out last August. There are some AWS specific resources on that and they’re nice and all, but they kind of assume that general security knowledge already exists. I’m a bit in over my head I think lol
shellsharks@infosec.pub 5 months ago
stevedidwhat_infosec@infosec.pub 5 months ago
You’re in luck! Cybersec people, for the most part, love sharing what they know/have done with each other. Many believe in freedom of information and find value in open collaboration. We just wanna show you the whacky thing we did with what we had.
The biggest resource I’ll share with you is membership with ISAAC. Find whatever category you fit into here and push to get your org membership, if you don’t already. This puts you into a huge working group with your industries’ peers and they will have all sorts of resources for you to use including discussions, meetings with pros, etc.
There’s also SANS who has some free stuff (check their Reading Room) but also has classes (paid, expensive, but veeery worth it imo, again if you can get buy-in)
Outside of the paid membership options, there’s still a lot of good options:
-
MISP is a great threat intel sharing platform, but will require some setup as a product (free && opensource). Take this one slow, you don’t want data leakage. Start small and locked down, gradually open up as you gain buy-in/trust/confidence.
-
Cybrary IT is a free+paid learning platform, good stuff here - lots of diversity including business stuff
-
OWASP - more so for web-app security, still good knowledge to add to that toolbox
-
OpenSecurityTraining - heard some good things about this site, I think you may enjoy it - I have not used it myself, but please let me know if you have any problems/reasons you don’t like it.
Then there’s always the classic CTF/Hack Challenges websites out there which let you get real experience with red-teaming/bolstering your knowledge of attacker TTPs (Techniques, Tactics, Procedures):
- HackTheBox - challenges for practicing your skills. No hand-holding, just a sandbox for you to play in. They have academy offerings (paid, and a new service, recommend skipping unless you can get buy in from the company/have a team who would benefit from a bulk-license purchase), regular free boxes to challenge yourself with, etc
-TryHackMe - this one is also CTFs but its more so lesson based/training stuff
-
Heard good things about (KC7)[kc7cyber.com] as well, seems to be more threat hunting/blue team focused (blue team = defend, red team = attack)
-
(Lets Defend)[www.letsdefend.io] - Free + paid options, more blue team stuff, great for SOCs which may or may not hit your mark.
Hope this helps you out, biggest thing is getting integrated with the community, reading the news (religiously), and managing burn out. Security is an uphill battle, but we roll this boulder for others who cannot. Respect your body and take care of your mental, or you will burn out and scar yourself. LMK if you need anything!
stevedidwhat_infosec@infosec.pub 5 months ago
Forgot to mention the NIST Framework, oy vey. This one is pretty good and is an excellent resource, albeit rather scary lookin’ on the cover. Very good resource, and will definitely net you some cred in your org.
-
MajorHavoc@programming.dev 5 months ago
We’re all in a bit over our heads. I suspect that ayone who doesn’t feel that way is unaware of the threat landscape, or just isn’t paid enough to care.
That’s a big topic.
It’s hard to go wrong with a well reviewed “Security+” study guide. Hack the Box, SANS, and Cloud Academy have good resources.
Personally, of the paid resources, Cloud Academy is my current favorite.