Futaba _ Webs 🕸🕸🎃🕸🕸

🎃 How NOT to get into Cyber Security

Ignore All Things Technical 🕸🕸🎃🕸🕸

There is a common misconception going around lately that you don’t need to be technical to be in Cyber Security, a lot of which comes from faulty marketing schemes and training programs that prey on those that desperately wish to enter the field, selling them this false mindset that they can learn Cyber and land a job in a matter of 24 weeks with no technical background or formal training: IT, networking, programming, etc, all in order to make a profit.

This is highly unethical and NOT true, and sets people up for failure in the long run, which leads to a lot of missing talent that is needed in Cyber Security right now. This also leads to a lot of people taking a lot of shortcuts that set them back in the long run, making them underprepared to enter the field.

Regardless of what side you are on: red team, blue team, purple team, or the type of technology you help secure, you NEED to have a deep understanding of it if you truly wish to secure it.

If you are a red teamer, you need to understand how various core technologies work in order to exploit them. This allows you to find critical flaws in the system you are testing against so it can be properly secured. How can you exploit something when you don’t understand how it works? Yes there are tons of tools, SQLmap for example, that can help red teamers pinpoint SQL injection vulnerabilities, but you still need to understand how SQL injection works on a fundamental level to use it properly. The tool is only as good as your fundamental understanding of the vulnerability it was designed to exploit. Not understanding how to find this type of vulnerability, even with the tool could cause you to miss critical vulnerabilities that did in fact exist, which can cause A LOT OF real world damage to an infrastructure if left unchecked.

If you are a blue teamer, you need to understand how core technologies work on a fundamental level so you can properly secure them. How can you secure something when you don’t understand how it works? Take the CTF server I made for example, "Futaba's Playground". It requires me to understand proper secure coding principles, as well as Linux system administration and configurations in order to properly secure the server. This prevents the player from bypassing any security for any and all challenges in unintended ways. I secured the server as if it were a real system from real threats, YOU, the player. If I wanted to take it a step further I can combine it with already pre-made tools and frameworks like SIEM and SOAR for example, that upgrade and smoothen the process for me depending on what I need it for. See where I’m going with this?

YoU DoNt NeEd PrOgRAmMiNg FoR cYBeR sEcUrItY 🕸🕸🎃🕸🕸

I wrote an article a while back on why programming is crucial for Cyber Security. You can check that out here if you would like to. For now, I’m going to talk a bit about forensics, one of the main fields in Cyber that people want to get into but REFUSE to learn how to code for. A lot of this is due to what I mentioned earlier, about people being sold the false notion they don’t need to be technical to work in Cyber. You do need to be technical if you want to get into forensics. Forensics is crucial in that it stops the spread of malware should it pose a real worldwide threat.

Forensics, most of which involves a lot of reverse engineering and malware analysis, does in fact require you to know how to code, as well as be able to read it regardless of what programming language it might be in. Does it require you to understand how to program in every language and framework under the sun? No! But you do need to understand how code works, as well as the technology behind it under the hood. This also requires in depth technical knowledge about stuff like a debugger which allows you to trace binary code flow.

You need to understand how to write code so that you can replicate and/ or tamper with strains of malware you find. This allows you to cross test and find mitigations to secure against future malware infections.

You need to understand how to read code, regardless of whether or not it might be a language you’re familiar with in order to dissect it. Sure, stick to malware in languages that you are familiar with, but often in the realm of Cyber Security, hackers are creative, and you’ll often find unicorn-like malware or techniques that you didn’t know about. You need to be able to adapt, and interpret it. Reading code is hard due to the nature of how sloppy and undocumented most code is written. You need to get comfortable with that and understand how to read and follow along core programming logic to understand how malware works.