راهنمای میدانی امنیت سایبری

"How do I get into cybersecurity?" is a question that gets asked every day across the Internet. Individuals in the field are bombarded with time-consuming questions about how to jump-start their career in cyber, but why are people asking in the first place? Well, exciting work, great starting salaries, and being involved in one of the fastest-paced industries currently make cybersecurity a target for many current IT professionals. Unfortunately, getting information about starting a career is time-consuming and a lot of IT professionals went down a convoluted path to get to where they are today because there isn’t enough information out there, much less a career progression chart. Introducing the Cybersecurity Field Manual: covered within is everything from what popular cybersecurity jobs look like day-to-day, advice on getting the job, interview tips, rough career progression charts, and enough IT theory and explainers to get you well on your way to success.I don't pretend for a moment that the CFM is completely exhaustive, but it does contain virtually everything I wish I'd have known at the start of my quest into cybersecurity - as well as advice from me (a penetration tester) and other professionals in the industry, as well as recruiters!15 March 2020Version 2 includes revisions and additions I made based on the feedback I received from respected people in the field. You can expect to see four additional career paths, tailored advice for individuals in specific stages of life (high school, college, or military), and more insight from people in the field. Table of Contents Contributors Introduction Structure of this Book Choose Your Own Adventure - Career Paths Career Path 1 - Penetration Tester Career Path 2- Cyber Risk Consultant Career Path 3 - Malware / Exploit Developer Career Path 4 - Reverse Engineering Career Path 5 - Information Assurance / Auditing Career Path 6 - SOC Analyst Career Path 7 - Threat Hunter Career Path 8 - Project Manager Career Path 9 - Cybersecurity Sales A Word of Advice... "But I'm Still in High School!" - Advice For Those in Full-Time Education "But I'm Still at College/University!" - Advice for Degree/Masters Students Advice for Those In The Military The Lay of the Land - UK The Lay of the Land - U.S Homelabs and Getting Hands-On So Many Cyber Certs, So Little Time! The Theory You ACTUALLY NEED TO KNOW Networking and Network Security: What You Actually NEED to Know The OSI 7 Layer Model Layers 1 and 2: Physical and Data Link Layers Layer 3: The Network Layer Layer 4: The Transport Layer Layer 5: The Session Layer Layer 6: The Presentation Layer Layer 7: The Application Layer IP Addressing, Spaces and Classes Subnets Public and Private IP Addresses (NAT and PAT) DHCP ICMP and Where To Go Next Radio Communication (RF) Cellular Communications (Phones/5G) Satellite Communications Dinner Party Encryption and Cryptography Symmetric Encryption Asymmetric Encryption Systems Architecture and Solutions: What You Actually NEED to Know Domain Name System (DNS) What is Active Directory? Trusts and Trust Relationships Privileges, Permissions and Provisioning Virtual Insanity: Virtualisation and Virtual Environments Head in the Clouds: An Intro to Cloud Computing SELECTing an SQL Joke: An Intro to Databases and DBMSs Memory, Assembly, Coding and Scripting: What You Actually NEED to Know Scripting vs. General-Purpose Programming Languages Scripting Language 1: Bash Scripting Language 2: Python Scripting Language 3: PowerShell Where To Go Next Memory and Machine Language - Some Assembly Required Memory (All Alone In The Moonight) Kernel Space vs. User Space The Stack and Heap - How Programs Lay Out and Use Memory A Quick Rundown on Stack Operations The Heap Other Memory Segments Assembly Language Where To Go Next Compliance, Law and Frameworks - What You Actually NEED to Know The General Data Protection Regulation (GDPR) The Computer Misuse Act (CMA) The Police and Justice Act (PJA) The Health Insurance Portability and Accountability Act (HIPAA) The Family Educational Rights and Privacy Act (FERPA) The Federal Information Security Management Act (FISMA) The Gramm-Leach-Bliley Act (GLBA) The Sarbanes-Oxley Act (SOX) Common Cybersecurity Frameworks ISO27K Series NIST/ SP 800-53 PCI-DSS HITRUST and COBIT ITIL The MITRE ATT&CK Framework The Cyber Kill Chain Where To Go Next Structure of Pentesting/Reporting: What You Actually NEED to Know Structure Of A Penetration Test Introduction to Social Engineering Introduction to The SOC Triage Process The Threat Hunting Process Structure Of A Penetration Test Report The Executive Summary The Conclusion General Report-Writing Tips Getting The Job: The Final Hurdle CV / Resume Writing and Formatting Tips General Advice for Technical Interviews Salary Expectations Other Difficult Interview Questions and How To Answer Them Dealing with Feedback Emotional Intelligence in InfoSec and Wider IT Cultivating a Thirst For Knowledge Staving Off Burnout: Another Essential Skill The Importance of Networking (Not the IP Kind!) Contract Work vs. Permanent Work Dealing With Impostor Syndrome Engaging With The Information Security Community Closing Thoughts