Here’s a phishing campaign that uses a man-in-the-middle attack to defeat multi-factor authentication:

Microsoft observed a campaign that inserted an attacker-controlled proxy site between the account users and the work server they attempted to log into. When the user entered a password into the proxy site, the proxy site sent it to the real server and then relayed the real server’s response back to the user. Once the authentication was completed, the threat actor stole the session cookie the legitimate site sent, so the user doesn’t need to be reauthenticated at every new page visited. The campaign began with a phishing email with an HTML attachment leading to the proxy server.

Read More

The author is a member of AT&T Cybersecurity’s Consulting Center of Excellence. This is part of a blog series from that elite group.

One of the main questions I get asked from people looking to get started in Cybersecurity is, “What certification(s) do I need?”. 

Who you ask and the number of people you ask will determine the number of different answers you will get back on this question.  A few short years ago, there was no such thing as a cybersecurity professional.  At first, people working in system administration or development were asked to take on the additional role of handling security for an organization. 

In contrast, today, most organizations have a complete department dedicated to cybersecurity and find it exceedingly difficult to keep staffed with qualified security professionals.   Qualified cybersecurity professionals are in high demand and enjoy a high-paying salary and opportunities for growth and mobility.  This blog will briefly describe how I got into cybersecurity and the certification path that ultimately led me to my current position as a Principal Architect with AT&T Cybersecurity.  Hopefully, detailing my course will help someone reading this article avoid some pitfalls.

As I was preparing for retirement from the United States Army and working on my MBA, I started a small computer consulting company.  I quickly discovered that 90% of my business was helping small businesses deal with viruses and malware.  Armed with this knowledge, I knew I wanted to become a security professional once I retired from the Army.  Still, I had no idea where to start or what certifications I would need. 

When I began my research into the cybersecurity world, it was with the intent of working within the federal government.  I noticed that all their security-related job positions talked about EC-Council certifications.  After doing a lot more research, I found a business near me that offered bootcamp-style training for several different Microsoft and EC-Council certifications.  After several thousands of dollars and months of feeling like I was drinking from a fire hydrant hose, I came out of the training with my MCSE, MSA, Security+, CEH, and CHFI certifications. 

Long story short, these certifications did help me get my first federal contract position but did not truly give me the “hands on experience” needed to work as a security professional.  True learning and experience came many years after reading countless security-related articles, websites, and Twitter feeds, YouTube videos, creating a home lab and trying different tools and techniques, and finally talking with other security-minded people. 

My point being is a certification does not make you a security professional.  It is only proof that you could take a test and answer most questions correctly.  Becoming a true security professional takes many years of dedication and commitment.  But it would be best if you started somewhere; certifications at least help get your foot in the door.

So, to answer the original question, “What certification do I need to get started in cybersecurity?”  For me, my answer is always the same.  You don’t need a certification to start, but if you can obtain a certification, I recommend starting with the SANS SEC504 course.  The course is titled “Hacker Tools, Techniques, and Incident Handling.”  It is a well-rounded security course that introduces the student to the offensive, defensive, and management aspects of cybersecurity.  Understanding the difference between the offensive, defensive, and management aspects of cybersecurity early is very important and will help decide which cybersecurity career path you prefer.

Over the last decade or so, I have obtained numerous other cybersecurity certifications and the items detailed below are things that I wished I had known when I started:

Choose a cybersecurity career path – Cybersecurity is a vast career field.  To decide on what certification you should get, you must first determine what part of security interests you the most and try to obtain certifications that support that path.  I break down the security fields into three different career paths:

Offensive security – The offensive career path centers around finding and exploiting network, computer hardware, and software vulnerabilities before the bad guys find them.  Some careers in offensive security include:

Vulnerability Management Specialist
Penetration Tester (Network, Web Application, Mobile Application)
Red Teamer

Defensive security – The defensive career path is the opposite of offensive security.  Defensive security professionals protect networks, computer hardware, and software from the bad guys.  Some careers in Defensive security include:

Security Operation Center (SOC) Analyst
Incident Handler
Forensic Investigator

Security management – As with any career field, management must oversee day-to-day operations.  Cybersecurity is no different; the management career path leads to both the offensive and defensive aspects of security.  Some careers in management security include:

SOC Manager
Director of Information Security
Chief Information Security Officer (CISO)

Choose a well-known/industry accepted certification company – Numerous companies offer security certifications, but in my opinion, below are the ones that have the highest reputation and are widely accepted by most organizations:

SANS – https://sans.org
EC-Council – https://eccouncil.org
Offensive Security – https://www.offensive-security.com/
ISC2 – https://www.isc2.org/

Research and practice – As stated earlier, becoming a security professional will not happen overnight or with certifications.  You must develop a passion and be willing to spend much of your free time researching and practicing.  To help get started, you must:

Build a personal home lab
Follow cybersecurity websites (Below are some examples)

https://www.trustedsec.com/blog/
https://posts.specterops.io/

Join Social Media Platforms

Twitter
Discord
YouTube

Getting started in cybersecurity can be daunting at first, but once you decide that this career is for you, it can be both rewarding and fulfilling.  When I retired from the Army, I had no idea what I wanted to do with the next chapter of my life.  For me, deciding to become a security professional has been one of the wisest choices of my life.  It has been rewarding and challenging, and I could not imagine making a better career decision.

Read More

Essilor International resolves False Claims Act allegations

Read More

CIISec study finds few have adopted industry best practices

Read More

It seems like just yesterday that the mad scramble following the SolarWinds compromise elevated supply chain security to the forefront of every entity, regardless of sector. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), formed the Information and communications technology (ICT) Supply Chain Risk Management task force in an effort to unite public and private entities with the goal of developing an actionable strategy to enhance supply chain security.

From the CISO perspective, a recent industry report from Coalfire on Software Supply Chain Risk hit the nail on the head: “Managing risk within software supply chains and product development lifecycles has become as important as protecting traditional, physical inventories and equipment supply lines.” Their survey, conducted with CyberRisk Alliance, highlighted how 52% of managers are concerned about software exposed to attack.

To read this article in full, please click here

Read More

Online fraudsters appear to be upping their game

Read More