6 Steps To Becoming An Information Security Guru

By Daniel Miessler on October 8th, 2006: Tagged as Career | Information Security | Philosophy

A recent poster in an information security forum asked what it takes to succeed in the information security field. Having met with moderate success in the field myself, I decided to offer a few of my own thoughts on the matter:

  1. Be Passionate About It You can’t get to the top if you don’t truly love what you do. You can do decently well by grinding through, of course, but you won’t ever see the upper levels. This is especially true in infosec where it takes so much continual effort to stay current. I’ve seen dozens of “security professionals” in the field because they heard “there’s money in security”. That’s simply not good enough.
  2. Be An Engineer, Not A Technician If you don’t understand how things work then you will stay at the bottom of the ladder in this field. Knowing how to operate things isn’t going to cut it. Problem-solving, which is ultimately what good consultants and other infosec professionals do, requires an understanding of the problem at hand, as well as how any proposed solution functions. You can’t be a button-pusher and get to the top.
  3. Don’t Be Intimidated By Anything Many people in I.T. are pretty solid with a few technologies but have areas that they’ll never get into because they view them as scary. I often hear, “Oh, that’s programming, I’m not touching that.”, or “I don’t mess with that Unix stuff.” That kind of approach will keep you limited for life, and for a security professional it’s pretty much a sign you aren’t going anywhere. The top security pros approach the unknown very similarly, i.e. by saying, “That can’t be too hard…” That’s the attitude you need to have.
  4. Combine Book Knowledge with Hands-On Many screw this up in one direction or the other, and it’s not something you can get away with easily in information security. In this field you need to not only study theory but also know how to implement that knowledge in real-world situations. If you study diligently but can’t apply it, you’re dead. Alternatively, if you can implement but don’t understand underlying concepts you’re dead there too (see above). I strongly recommend that beginners invest in a serious lab environment and implement what they find interesting during their studies. Nothing is more effective as a learning tool (for me, anyway) than studying something academic/theoretical and then seeing it come to life in your lab.
  5. Sharpen Your Communication Skills Few things are as important as the ability to communicate well. This includes both verbal and written communication. It’s not enough to know lots of things; you have to be able to get that knowledge to your clients/users/management in a way that is useful to them.
    Imagine you have two ratings on a scale of 1-10 — message and interface — and that the overall impact of your communication is the product of the two. So if your message is a 10, but your interface to the client (how well you communicated it) was only a 2, your overall score is just a 20. But if your message is a 9 and your interface is an 8 then your score is a 72. You need both solid content and the ability to convey it to others.
  6. Keep In Mind That There Are People Out There That Make You Look Silly Staying humble is another key attribute. If you think too much of yourself you’ll relax and stop growing. It’s important to realize that there are others that completely dwarf your skills in many areas. Check out some different newsgroups, browse different IRC channels for security related content, etc. Seek out those you can learn from.
  • Carl M

    Thanks for including Communication Skills in your list. When I advise my students as they register for classes, they often make comments like “I don’t really like history” or “Why do we have to take so much English?” If they make the history comment, I tell them that everyone has his or her own interests, but it is important to have a broad education and that history is important to put corrent events into a meaningful context. But if they make the English comment, they get a mini lecture about the importance of communication skills. Regardless of your job, you will need to communicate effectively. Indeed in nearly all aspects of your life you will be judged to one degree or another based on your ability to communicate.

  • Carl M

    Thanks for including Communication Skills in your list. When I advise my students as they register for classes, they often make comments like “I don’t really like history” or “Why do we have to take so much English?” If they make the history comment, I tell them that everyone has his or her own interests, but it is important to have a broad education and that history is important to put corrent events into a meaningful context. But if they make the English comment, they get a mini lecture about the importance of communication skills. Regardless of your job, you will need to communicate effectively. Indeed in nearly all aspects of your life you will be judged to one degree or another based on your ability to communicate.

  • http://dmiessler.com/ Daniel Miessler

    Agreed. It’s the super-skill that everyone needs.

  • http://dmiessler.com Daniel Miessler

    Agreed. It’s the super-skill that everyone needs.

  • brad

    I just wanted to say that these also definately apply directly to attempting to be a “programming guru” there is sooo much out there and you can wreck it if you are afraid to commit wholly to this doctrine. To give my opinion on each of these points…

    be passionate about it – I can not even begin to decribe the out-of-work work that I do. I spend easily 10-20 hours/wk at my favorite local coffee shop simply studying material and learning more about optimization and other things that interest me within the field. I also work endlessly on writing code and researching for my personal benefit. I do this b/c I love programming.

    Be An Engineer, Not A Technician – This should go without saying. If you don’t understand how your code works, you don;t understand your code. You also, without knowing the way things work, are lessening your ability to improvise and create more efficient and effective solutions. Example – you can live without regular expressions, but if you do, you are an idiot.

    Don’t Be Intimidated By Anything – Intimidation leads ultimately to ignorance. If you let something that you do not understand intimidate you, You are missing out on an opportunity to further your abilities and hone your skill set. Combine Book Knowledge with Hands-On – I couldn’t agree more with this. I can “accidentally” learn all kinds of great tricks and pick up great reasoning behind things by reading through a good programming book. I can also take a book with me in places that I have no wireless signal (airplane, roadtrip, etc.).

    Sharpen Your Communication Skills – I completely agree with Dr. M on this one. Without good communication skills, you have no ability to express your intentions or plans for implementation of a project to a group. You may also run into trouble when trying to get a projects expectations from a customer. Then there is the fact that without a decent ability to communicate your knowledge and talents, you are setting yourself up for failure when it comes to finding a job in the first place. Overall, without the ability to communicate effectively, you will always sell yourself short.

    Keep In Mind That There Are People Out There That Make You Look Silly – All the time. But, without that, what motivation (other than a passion for the field) do you have to improve? People often seem to get lazy when they are in an obvoiusly dominant position. I also feel that, by thinking that you are “the best guy out there” you are closing off a lot of doors simply because if someone feels this way, they are often of the mindset that anyone that they discuss something with knows less than they do and can’t possibly teach themanything new and interesting. This is wrong.

    To wrap up here, I can say that these are definately rules to live by, and that everyone that want to be a “guru” in their given field should take note of these rules and find a way to apply them to their everyday lives. And that, good sir, would be my two cents.

                                                                                                                 --tbwolfe

  • brad

    I just wanted to say that these also definately apply directly to attempting to be a “programming guru” there is sooo much out there and you can wreck it if you are afraid to commit wholly to this doctrine. To give my opinion on each of these points…

    be passionate about it – I can not even begin to decribe the out-of-work work that I do. I spend easily 10-20 hours/wk at my favorite local coffee shop simply studying material and learning more about optimization and other things that interest me within the field. I also work endlessly on writing code and researching for my personal benefit. I do this b/c I love programming.

    Be An Engineer, Not A Technician – This should go without saying. If you don’t understand how your code works, you don;t understand your code. You also, without knowing the way things work, are lessening your ability to improvise and create more efficient and effective solutions. Example – you can live without regular expressions, but if you do, you are an idiot.

    Don’t Be Intimidated By Anything – Intimidation leads ultimately to ignorance. If you let something that you do not understand intimidate you, You are missing out on an opportunity to further your abilities and hone your skill set. Combine Book Knowledge with Hands-On – I couldn’t agree more with this. I can “accidentally” learn all kinds of great tricks and pick up great reasoning behind things by reading through a good programming book. I can also take a book with me in places that I have no wireless signal (airplane, roadtrip, etc.).

    Sharpen Your Communication Skills – I completely agree with Dr. M on this one. Without good communication skills, you have no ability to express your intentions or plans for implementation of a project to a group. You may also run into trouble when trying to get a projects expectations from a customer. Then there is the fact that without a decent ability to communicate your knowledge and talents, you are setting yourself up for failure when it comes to finding a job in the first place. Overall, without the ability to communicate effectively, you will always sell yourself short.

    Keep In Mind That There Are People Out There That Make You Look Silly – All the time. But, without that, what motivation (other than a passion for the field) do you have to improve? People often seem to get lazy when they are in an obvoiusly dominant position. I also feel that, by thinking that you are “the best guy out there” you are closing off a lot of doors simply because if someone feels this way, they are often of the mindset that anyone that they discuss something with knows less than they do and can’t possibly teach themanything new and interesting. This is wrong.

    To wrap up here, I can say that these are definately rules to live by, and that everyone that want to be a “guru” in their given field should take note of these rules and find a way to apply them to their everyday lives. And that, good sir, would be my two cents.

                                                                                                                 --tbwolfe
  • joat

    Assign yourself weekly homework: learn a new command line tool or technique, read somebody’s paper, sniff your own traffic and pick out something you don’t recognize, read a book – write down any idea or question you have while reading it and after you’re done reading, add those thoughts/questions to your homework list.

    Once per month, research/learn something only remotely related (or completely unrelated) to security or systems administration (current laws, court procedure, growing roses, fishing, raising worms, music appreciation, etc.). It’ll round you out as a person.

  • joat

    Assign yourself weekly homework: learn a new command line tool or technique, read somebody’s paper, sniff your own traffic and pick out something you don’t recognize, read a book – write down any idea or question you have while reading it and after you’re done reading, add those thoughts/questions to your homework list.

    Once per month, research/learn something only remotely related (or completely unrelated) to security or systems administration (current laws, court procedure, growing roses, fishing, raising worms, music appreciation, etc.). It’ll round you out as a person.


Top

Popular

Information Security / Technology

Politics

Philosophy & Religion

Technology & Science

Culture & Society

Miscellaneous

Arguments

Projects

Collections

Twitter

What I'm Reading

Favorite Books and Essays

Top Blog Categories

Inputs