What Certifications do I need to work in Cyber Security? Part 2a — Technical
Tags: Work, Cyber, Information Technology, Information Security, Cybersecurity

For part two in this series we are going to discuss why it is better to complete Cyber Technical certifications first rather than Cyber Governance certifications. This is part 2 of a series, if you’re interested in starting from the beginning, here is the link to Part 1 so you can follow along.

As I will be discussing my opinion, I think it is relevant to share a little background information of my own life experience here.

When I finished high school, I learned a trade (Refrigeration Mechanic to be specific). This trade certification comprised of three years of trade school and four years being on the tools. Without tooting my own horn too much, I aced the trade school part of my apprenticeship. I have a technical mind, so the concepts (refrigeration chemistry, electrical wiring etc) came easily to me. Unfortunately, I am extremely uncoordinated, and this made applying the trade school skills I learned very difficult. After numerous jobs, I decided I had enough and looked for other career options.

As I’m sure many of you know, not many places will look at your job application without a degree of some sort. Realising this I went off to university to earn a Bachelor of Computer Science degree. Through university, I fell in love with Apple and became an ‘Apple Fan Boy’ (I cant say I care for the title, but it is pretty catchy, damn it).

Back to my point, I chose the most technical subjects in university to hopefully secure a job at Apple (what job at Apple? I didn't care, I could have been a janitor and still been happy!). During my last year at University I secured a job working as a technical consultant. It was here I met people from the Cyber industry, most importantly to my story it was here I met Chris McDonald. Chris is an expert in both the technical and governance sides of cyber, I highly recommend looking him up on Linkedin. While at work I was still enrolled in university and completing various assignments and projects. Chris took an interest and saw that I had some tech skills in coding, databases, software development and other relevant areas. After a few times catching up for beers I worked with Chris to complete a penetration testing engagement on a web application.

It is here that I fell in love with Cyber. Specifically, the challenge of a penetration test, the technical knowledge, searching for vulnerabilities and so many other things I could list. Chris knew he had me hooked on Cyber. After he and my boss confirmed my intent to pursue Cyber as a career path, I was lucky enough for work to pay for me to undertake the OSCP course. I will cover OSCP in other posts (here is a link for some basic information on the course).

Why did they want me to do OSCP first? Why technical first? These are great questions, questions I didn’t think of to ask for months.

While sitting with Chris I asked these questions and he replied with:

“The technical controls are what actually protect your environment and are always necessary. To implement technical controls, you need to understand what your aligning to risk wise and the framework of the business.”

Lets dissect this quote to break down what it really means.

The first half:

“The technical controls are what actually protect your environment and are always necessary.”

Is referring to the technical side of Cyber, how is the business actually protecting itself? Firewalls? Antivirus? To assess these protections you need to understand them, hence technical knowledge is needed.

The second half:

“To implement technical controls, you need to understand what your aligning to risk wise and the framework of the business.”

Cyber protections are useless to the business if it doesn’t align with their risk or frameworks. If the business view’s your cyber controls as useless why would they hire you? The most common mistake I have seen is over protection. For example, a small business wont need to adopt Defence Force cyber security practices.

I think it is important to note here each halve of Cyber is just as important as the other. One could not exist without the other. Some of the brightest people I have worked with are purely Cyber Governance focused. That’s what makes team work great. You have people that are experts in their own field coming together to provide the best product.

When I pressed Chris how doing technical certifications first reflected in a business(consulting) role, he followed up the previous advice with the following:

“You’ll get 10x more respect being able to explain the technical risk as to why you need a governance control”

My response? “huh?”. It took me a little while to realise that this was personal advice from Chris. Our cyber industry is growing, which is a great thing. It means there are more people every day I can talk cyber security about. It also means there are some people that will act like experts in the field when they may not have the background to corroborate their ‘expertise’. These people can create a claim regarding cyber security and when they are asked for evidence or reasoning behind the claim they will crumble. If you have the technical knowledge to support a claim you made, you (and your opinion) will be respected among the industry.

So, there it is, the reason to do tech first summed up in two quotes. If you can disprove the logic Chris was saying please reach out and let me know as I would be very interested in hearing it, as I’m sure he would be too.

For the next article in this series, I will be taking a deep dive into each technical certification listed in the ‘Technical Cert’ pillar from Part 1. Showing which ones should be taken first and why.

If you have any questions, please leave a comment and I will answer it as soon as I can.

Alternatively my contact details are:

linkedin.com/in/bobby-simmonds Profile URL

@bobby_simmonds2