1
00:00:04,730 --> 00:00:09,210
Welcome back to the Career Hacking Village here at DEF CON Safe Mode.

2
00:00:09,310 --> 00:00:16,830
Many times when we're talking on social media or on Discord, we're always asking, what is the best career path?

3
00:00:16,830 --> 00:00:22,670
And several times people will say, no, this is the way, no, this is the way, no, this is the way.

4
00:00:23,030 --> 00:00:26,130
What we can tell you is that there are many different ways.

5
00:00:26,130 --> 00:00:35,270
And I'm really excited to have my friend Pablo explain how he sees it and his recommendations on your career path.

6
00:00:35,270 --> 00:00:36,410
Take it away, Pablo.

7
00:00:36,830 --> 00:00:38,230
Thanks, Kathleen.

8
00:00:38,410 --> 00:00:43,710
So this talk is titled, In Theory, There's No Difference Between Theory and Practice.

9
00:00:44,130 --> 00:00:46,010
And so where did this come from?

10
00:00:46,010 --> 00:00:53,390
First of all, it's normally attributed to Yogi Berra, who dropped other pearls, like when you come to a fork in the road, take it.

11
00:00:53,390 --> 00:00:56,010
But this was actually not one of his.

12
00:00:56,830 --> 00:01:06,070
So the difference between theory and practice actually, according to Snopes, appeared first in the 1986 book about programming, The Art and Science of Programming.

13
00:01:06,070 --> 00:01:07,630
So I thought it was apropos.

14
00:01:07,690 --> 00:01:18,870
A lot of times when we talk about how to get into InfoSec, we devolve into this discussion about going to college and learning theory or the school of hard knocks, the learning practice.

15
00:01:18,870 --> 00:01:22,870
And so there's always this push and pull between theory and practice.

16
00:01:24,250 --> 00:01:26,090
So why are we here?

17
00:01:26,090 --> 00:01:36,050
As Kathleen mentioned, about every six months or so, we see these kind of flame wars and discussions pop up on Twitter about how do you get into InfoSec.

18
00:01:36,170 --> 00:01:38,790
And it comes from all sides.

19
00:01:38,790 --> 00:01:52,010
So you have some people that believe that security is a prestige class and that you have to spend 10 or 15 years on a watch floor or on a call desk before you can join security.

20
00:01:52,110 --> 00:01:55,010
And you have some people saying, look, I didn't go to college.

21
00:01:55,010 --> 00:02:00,590
I've got a fantastic InfoSec career and I make a ton of money and the college kids seem really upset by that.

22
00:02:01,050 --> 00:02:04,450
And the truth is there are many paths and they're all valuable.

23
00:02:04,450 --> 00:02:08,290
It's a matter of what you want to get into it and who you are as a person.

24
00:02:08,290 --> 00:02:13,490
So I thought it would be best to have a nice balanced discussion on that.

25
00:02:14,510 --> 00:02:17,590
So why do we even have these discussions?

26
00:02:17,590 --> 00:02:18,150
Why does it matter?

27
00:02:18,150 --> 00:02:20,430
Well, we all go through these little life transitions, right?

28
00:02:20,470 --> 00:02:27,270
We finish a school, be it high school or college or a trade school, that we have to go out and find work.

29
00:02:27,610 --> 00:02:35,110
Many of us serve some time in the military and we have to figure out what we're going to do once we take the uniform off.

30
00:02:35,390 --> 00:02:37,190
Some of us have life changes.

31
00:02:37,190 --> 00:02:44,230
We get married or we have kids or something in our life changes and we decide that we want to do something else.

32
00:02:44,370 --> 00:02:51,930
Or sometimes our careers just go away or we decide we're just dissatisfied with our careers and we want to get into this thing called InfoSec.

33
00:02:51,930 --> 00:02:54,470
And how do we really do that?

34
00:02:55,010 --> 00:02:56,670
So some disclaimers.

35
00:02:56,670 --> 00:03:00,010
First of all, these views are mine and mine alone.

36
00:03:00,010 --> 00:03:02,590
They don't belong to my employer.

37
00:03:03,130 --> 00:03:07,290
There's an exception to be found for absolutely everything I'm going to say.

38
00:03:07,290 --> 00:03:10,890
So if you try to find fault with this talk, congratulations, you will.

39
00:03:10,890 --> 00:03:14,390
Again, these are my opinions and what I've experienced.

40
00:03:14,730 --> 00:03:18,610
And those opinions are based upon my observations.

41
00:03:19,190 --> 00:03:21,510
But I'm also going to freely admit that I have biases.

42
00:03:21,510 --> 00:03:26,790
I took a very particular path and I've seen what I've seen and I haven't seen what I haven't seen.

43
00:03:26,790 --> 00:03:29,570
And so your mileage may vary.

44
00:03:30,410 --> 00:03:36,310
So a little bit about how my path came into InfoSec so that you understand kind of my latent biases.

45
00:03:36,310 --> 00:03:38,070
I've been doing this for a little bit.

46
00:03:38,070 --> 00:03:48,390
I got access to my first 8088 class computer in 1981 and then played with modems and BBSs.

47
00:03:48,410 --> 00:03:52,130
In the early 90s, I was a developer for Expert Systems.

48
00:03:52,130 --> 00:03:54,470
Those of you that are in AI may know what that is.

49
00:03:54,470 --> 00:03:58,890
In 1993, I went through a life change and I decided to join the United States Navy.

50
00:03:58,890 --> 00:04:01,590
Got a degree in computer science in 1998.

51
00:04:01,590 --> 00:04:04,430
Spent some time at NSA.

52
00:04:04,850 --> 00:04:08,730
Got a master's degree in computer science 10 years after my bachelor's.

53
00:04:08,730 --> 00:04:10,230
Went back to Cyber Command.

54
00:04:10,230 --> 00:04:17,630
Then was faculty at the Navy's postgraduate school teaching master's level computer science and information sciences.

55
00:04:17,950 --> 00:04:22,750
Then I went to US Special Operations Command Hacker Makerspace called SoftWorks.

56
00:04:22,750 --> 00:04:26,690
And I just finished a PhD in information sciences.

57
00:04:26,690 --> 00:04:36,290
Now that said, the picture is a little dated, you might be able to make out that that's actually me with the rest of the school of root.

58
00:04:36,350 --> 00:04:39,190
So I have been in the community for quite a while.

59
00:04:40,690 --> 00:04:44,810
So with that all being said, we're going to have this discussion.

60
00:04:44,810 --> 00:04:47,870
Let's try not to turn it into a flame war.

61
00:04:48,010 --> 00:04:52,550
We can disagree, but we should be respectful about how we disagree with each other.

62
00:04:54,990 --> 00:05:01,950
So those of us that have been around for a really long time remember the quote-unquote traditional path to an infosec job.

63
00:05:01,950 --> 00:05:07,650
There was no cybersecurity degree when I came up and went through college.

64
00:05:07,810 --> 00:05:25,710
And so the running joke was that if you wanted to be a computer security expert, and you could either go out and work at a SOC watch floor, become a forensic analyst, and then a lab director, and a chief security officer, and 20 years later, you would be highly paid consultants.

65
00:05:25,870 --> 00:05:37,810
Or the hacker method, where you became a hacker, you became a criminal, you got convicted of a crime, and two years later, you were a highly paid consultant, maybe 14 months with good behavior.

66
00:05:38,170 --> 00:05:45,170
Those days, unfortunately, or fortunately, depending on your standpoint, may have gone by the wayside.

67
00:05:45,830 --> 00:05:47,770
So what are the contemporary paths?

68
00:05:47,770 --> 00:05:51,590
How do most of us get into infosec careers this year?

69
00:05:51,590 --> 00:05:53,630
Well, there's typically three paths.

70
00:05:53,630 --> 00:05:59,770
There's the School of Hard Knocks, there's the certification path, and then there's the college education path.

71
00:05:59,770 --> 00:06:02,610
And each of those come with their own pros and cons.

72
00:06:02,770 --> 00:06:06,270
And so we should discuss those a little bit.

73
00:06:06,710 --> 00:06:09,530
So the first one is the School of Hard Knocks.

74
00:06:09,530 --> 00:06:12,670
This is where you kind of teach everything to yourself.

75
00:06:13,590 --> 00:06:18,830
It's a very traditional path for hackers, because there used to not be college classes.

76
00:06:18,830 --> 00:06:24,250
There used to not be a CEH or a CISSP.

77
00:06:24,250 --> 00:06:32,170
You had to go out and read Frack Magazine and read 2600, or go to hacker boards and teach this stuff to yourself.

78
00:06:33,910 --> 00:06:35,590
One of the pros is the cost.

79
00:06:35,590 --> 00:06:37,490
The cost is essentially free.

80
00:06:38,050 --> 00:06:40,850
You only learn the things that you're interested in learning.

81
00:06:40,850 --> 00:06:43,890
You don't have to bother with any baseline things you don't care about.

82
00:06:44,630 --> 00:06:50,590
It takes the least amount of time before you get to the amount of stuff, before you get to the subjects that you care about.

83
00:06:50,650 --> 00:06:53,010
We'll come back to that least amount of time.

84
00:06:53,130 --> 00:06:54,890
And you get practical skills now.

85
00:06:54,890 --> 00:06:57,310
You learn what you need to solve your problems.

86
00:06:57,490 --> 00:07:00,230
And so you become a practitioner immediately.

87
00:07:00,250 --> 00:07:03,070
And really, you're only limited by your personal drive and talent.

88
00:07:03,070 --> 00:07:06,850
Nobody's going to tell you that you've got to learn about X before you learn about Y.

89
00:07:06,850 --> 00:07:11,870
Nobody's going to tell you that you have to spend two years doing this before you go do that.

90
00:07:11,870 --> 00:07:15,470
You can just hop right in and do the things that you're interested in doing.

91
00:07:16,750 --> 00:07:18,110
So what are the cons?

92
00:07:18,110 --> 00:07:19,950
Well, I mentioned time.

93
00:07:20,150 --> 00:07:21,630
Least amount of time are the three paths.

94
00:07:21,630 --> 00:07:23,310
Well, that depends on how you cut it.

95
00:07:23,450 --> 00:07:34,010
Generally speaking, there was a paper called Outliers by Malcolm Gladwell that says, in order to become an expert in any one thing, you have to spend 10,000 hours doing it.

96
00:07:34,030 --> 00:07:43,590
So 10,000 hours, if you break it out into eight-hour work days, means 3.42 years, which sounds remarkably like a bachelor's degree, which takes about four years.

97
00:07:43,590 --> 00:07:47,970
And when you add summer vacation, and when you add spring break, you're at four years.

98
00:07:48,170 --> 00:07:49,910
You can do it faster.

99
00:07:50,150 --> 00:07:52,490
And again, your mileage may vary.

100
00:07:52,490 --> 00:07:56,190
If you're a very talented, very driven person, you might be able to do it in less time.

101
00:07:56,590 --> 00:08:00,690
But it is still a substantial amount of time if you want to become an expert.

102
00:08:01,810 --> 00:08:07,850
Typically speaking, when you go through the School of Hardenomics, you're all practice and very little to no theory.

103
00:08:08,170 --> 00:08:17,070
And the problem with all practice is that the tools change, and the tactics, techniques, and procedures change, and the approaches change.

104
00:08:17,070 --> 00:08:24,430
And if you're not based in a theoretical background, and you're not actively using it, those skills become very perishable.

105
00:08:24,850 --> 00:08:31,250
And so if you're not actively using it, you're going to lose it very quickly, and you're going to have to come back and reteach yourself.

106
00:08:31,510 --> 00:08:33,210
Employment opportunities.

107
00:08:33,350 --> 00:08:39,570
Boutique shops are a good opportunity for you because they're smaller, and they're willing to take a chance.

108
00:08:39,570 --> 00:08:48,830
A lot of the boutique shops are started by rock stars in this community, and they didn't take a college education in many cases.

109
00:08:48,830 --> 00:08:52,330
They learned through the School of Hardenomics, and so they understand it.

110
00:08:52,330 --> 00:08:54,790
Independent consultant is another one.

111
00:08:54,790 --> 00:08:58,410
You have to do your own business development, but you can certainly do that.

112
00:08:58,410 --> 00:09:00,850
You certainly can get hired by a corporation.

113
00:09:00,850 --> 00:09:07,610
The challenge with getting hired with a corporation without a degree is you have to pass the HR check, the human resources check.

114
00:09:07,790 --> 00:09:18,930
And the problem with that is the way that the industry has moved is a lot of times, unless you get a personal introduction, you have to go through an automated resume system, and it's looking for certain ticks.

115
00:09:18,930 --> 00:09:26,810
And if you don't check one of those ticks, like maybe they require a bachelor's degree, your resume may never get seen by an actual human being.

116
00:09:27,510 --> 00:09:31,150
The other issue with the School of Hardenomics is survivability.

117
00:09:31,150 --> 00:09:38,910
So when we go through hard economic times, what happens is usually there's an accountant somewhere, an executive somewhere, that wants to cut cost.

118
00:09:38,910 --> 00:09:46,690
And the first thing they cut is high cost assets, which don't have a whole lot of background.

119
00:09:46,690 --> 00:09:59,570
So it's easy to justify in a business sense, paying somebody with an advanced degree, a large sum of money, because they've got a demonstrated record that the school vouches for it.

120
00:09:59,570 --> 00:10:04,190
That may be harder if you learn through the School of Hardenomics, unless you're a name brand.

121
00:10:04,190 --> 00:10:09,370
If you're a name brand, then that may be different, but it is something to consider.

122
00:10:10,430 --> 00:10:17,370
So here's a fantastic example of an absolute rock star who came up through the School of Hardenomics, Frank Height.

123
00:10:17,770 --> 00:10:20,990
So, you know, Frank got started in this earlier than I did.

124
00:10:20,990 --> 00:10:24,890
He started with a PDP in 1979 at his home.

125
00:10:26,290 --> 00:10:30,670
In 1981, he emancipated and went to go work for Chase Manhattan.

126
00:10:30,750 --> 00:10:32,330
Never finished 10th grade.

127
00:10:32,330 --> 00:10:36,670
So not only does he not have a college degree, he doesn't have a high school diploma.

128
00:10:36,670 --> 00:10:45,850
He's one of the best-read, most educated people I know without any formal education, because he's just a tremendously driven and intelligent individual.

129
00:10:46,110 --> 00:11:08,990
In 88, he went to work for the New York Transit Authority, created the emergency 911 system for MCI, went to go work for NAVSEA and SWFPAC, which are Navy entities, found a NSA penetration testing operation in 1997, and became the 10th employee at at stake in 99.

130
00:11:09,010 --> 00:11:16,230
And since then, he's founded Leviathan Security, which has a tremendous name in the industry, and he's been a TED speaker times three.

131
00:11:16,370 --> 00:11:23,710
So again, no formal education, just a tremendously talented, driven individual with a curious mind.

132
00:11:23,710 --> 00:11:33,030
So absolutely, you can do this without certifications, and you can absolutely do this without education, and here's a fine success example.

133
00:11:34,110 --> 00:11:36,130
So the other way is certifications.

134
00:11:36,130 --> 00:11:43,230
Those have come into vogue of late, and we've all kind of heard the names.

135
00:11:43,230 --> 00:11:47,550
There's CEH and OSCP and OSCE and CISSP.

136
00:11:47,930 --> 00:11:49,090
And what are all these things?

137
00:11:49,090 --> 00:11:55,530
Well, the first thing to be aware of is not all these certifications are created equal, and they're intended for different audiences.

138
00:11:56,130 --> 00:12:00,210
For better or worse, if you want to work for the U.S.

139
00:12:00,210 --> 00:12:05,630
government, you're probably going to do much better if you have a CISSP, and that's actually true in industry.

140
00:12:05,650 --> 00:12:06,830
I've got one.

141
00:12:07,070 --> 00:12:23,150
I've got my own thoughts on that certification as compared to other certifications, but it's important for you to weigh what it is that you want to do for a living, what kind of career you want to have, and see if that certification is going to help you get that job or help you become more proficient in what you want to do.

142
00:12:23,750 --> 00:12:29,590
Many of the certifications focus on practice with little to no theory, but there's some exemptions.

143
00:12:30,310 --> 00:12:31,510
They're vendor motivated.

144
00:12:31,510 --> 00:12:34,070
Those certifications are there to make money, right?

145
00:12:34,070 --> 00:12:35,310
They want to sell you a boot camp.

146
00:12:35,310 --> 00:12:36,850
They want you to pay for the class.

147
00:12:37,170 --> 00:12:43,170
They want you to pay to take the certification, and then they want you to pay fees to maintain that certification.

148
00:12:45,830 --> 00:12:56,210
There are lots of paths to getting these, but primarily you can take a class, a boot camp, or you can do online and self-teaching by picking up a book.

149
00:12:56,210 --> 00:13:08,850
Most of these certifications have books where you can teach yourself the same things, and then your certification exams are tends to be to either proctored exams, which means that you go to a testing facility and they verify you are who you say you are before you take the exam,

150
00:13:08,850 --> 00:13:10,830
and then there are online exams.

151
00:13:10,870 --> 00:13:23,930
One of the things that does come up, and it was a problem in the past with some of the certifications, is that the online exams, you could actually go out and pay somebody to take the exam in your stead and get the certification.

152
00:13:23,930 --> 00:13:31,170
So once that's out, those certifications become less valuable in the eyes of industry, and so just be aware of that.

153
00:13:33,010 --> 00:13:35,790
So what, you know, what are the pros of certifications?

154
00:13:36,370 --> 00:13:37,670
It's a great boot camp, right?

155
00:13:37,670 --> 00:13:43,350
If you're starting at zero and you don't know how to get going, you're going to get lots of practice in a very short amount of time.

156
00:13:43,350 --> 00:13:47,770
Most of these boot camps are a couple of days or maybe a week long.

157
00:13:47,770 --> 00:13:50,170
Some of them are a little bit longer if it's a program.

158
00:13:51,110 --> 00:13:54,590
You're going to go from nothing to functional a very short time.

159
00:13:54,990 --> 00:13:58,790
Theory may vary, but typically very little theory in these.

160
00:13:59,830 --> 00:14:07,410
If you do a boot camp, you're going to get some lead learning, which means that you're going to have somebody that's ostensibly a subject matter expert to answer your questions.

161
00:14:07,570 --> 00:14:15,690
There's going to be defined a progression of knowledge, so if you don't know where to start or where to go next, typically these boot camps will help you out with that.

162
00:14:15,910 --> 00:14:30,010
In the certifications, many of them will help you pass an HR check because they're familiar with the vendors, they're familiar with the certifications, and they're familiar with the knowledge you have to demonstrate in order to achieve those certifications.

163
00:14:30,010 --> 00:14:38,330
And so in many cases, those automated resume checkers will actually tick the box if you've got the right certifications that they're looking for.

164
00:14:40,850 --> 00:14:45,550
So what you're looking at on the screen now is two courses.

165
00:14:45,550 --> 00:14:48,910
In the red box is one course, and in the blue box is the other course.

166
00:14:48,910 --> 00:14:51,570
And my question for you is, what is the difference?

167
00:14:51,570 --> 00:14:54,230
And I'll give you a few seconds here to read it.

168
00:15:00,000 --> 00:15:00,680
Good.

169
00:15:00,680 --> 00:15:05,840
So both of these are actually courses in exploitation development.

170
00:15:06,100 --> 00:15:12,260
One of them is a master's level course, the other one is a course from a vendor that you take in one week.

171
00:15:12,260 --> 00:15:16,980
So the master's level course takes 12 weeks, the vendor course takes one week.

172
00:15:16,980 --> 00:15:19,740
You're covering the same information.

173
00:15:20,140 --> 00:15:29,620
But what you should think about is, if you take it in 12 weeks, are you going to get a much deeper understanding and much more practice than if you take it one week?

174
00:15:29,620 --> 00:15:31,640
And I would suggest that, yeah, you will.

175
00:15:32,140 --> 00:15:39,060
You know, if you're spending 12 weeks with the material, you're going to spend more time exploring that material and going deeper on it than if you spend one week.

176
00:15:39,060 --> 00:15:48,580
That doesn't mean that you're missing out on a whole lot of stuff, you're taking the one week, but just be aware that a one-week boot camp is just going to give you an introduction to all of these subjects.

177
00:15:48,580 --> 00:15:53,280
And so you're going to have to go through and spend some of your own time really studying it.

178
00:15:54,960 --> 00:15:57,460
So what are some of the cons of certification?

179
00:15:57,460 --> 00:16:04,300
So I went out to a well-known vendor, who will remain nameless, and I pulled up the cost for achieving their certification.

180
00:16:04,480 --> 00:16:07,800
So their one-week class is $6,200.

181
00:16:08,600 --> 00:16:13,480
And then you have to wait a certain amount of time before you can take the certification.

182
00:16:13,660 --> 00:16:19,540
And so if you want access to their online labs after the course, it's another $729.

183
00:16:19,600 --> 00:16:21,160
So we're up at $7,000.

184
00:16:21,360 --> 00:16:25,640
And then each certification attempt is $729.

185
00:16:25,660 --> 00:16:30,360
So you're up close to $8,000, and that's if you pass it the first time.

186
00:16:30,940 --> 00:16:39,240
If for whatever reason you fail it and you have to go back and take it, well, you're probably going to need access to the labs, and you're probably going to need to pay for another certification event.

187
00:16:39,240 --> 00:16:44,700
So that's another $1,500 every time that you fail to pass.

188
00:16:44,700 --> 00:16:48,940
And then on top of that, you're going to have to pay to renew this every three to four years.

189
00:16:49,080 --> 00:16:56,640
So at $8,000, and we'll talk about the cost of college later, but $8,000 is a substantial amount of money.

190
00:16:56,640 --> 00:17:01,960
Not just compared to college, but compared to anything, $8,000 is a substantial amount of money.

191
00:17:01,980 --> 00:17:06,460
The other part is, as I mentioned, the certifications tend to be tools-focused.

192
00:17:06,460 --> 00:17:10,020
Not always, not all certifications, but they tend to be tool-focused.

193
00:17:10,140 --> 00:17:11,640
And so they're perishable, right?

194
00:17:11,640 --> 00:17:20,980
If you take a certification and then you don't do that on a daily basis for your job, your skill in that set is going to deprecate.

195
00:17:21,000 --> 00:17:22,940
The other thing is, what do they demonstrate?

196
00:17:22,940 --> 00:17:31,280
And so there's this ongoing discussion that always happens about, does that demonstrate knowledge or does that demonstrate your ability to take an exam?

197
00:17:31,280 --> 00:17:33,360
And different people have their own biases on this.

198
00:17:33,360 --> 00:17:39,600
I absolutely know people that could not pass a certification exam that absolutely had mastery of the material.

199
00:17:39,600 --> 00:17:41,020
They just couldn't take a test.

200
00:17:41,020 --> 00:17:47,240
I've also seen it the other way, where somebody passes the test and they clearly knew nothing about the material.

201
00:17:47,580 --> 00:17:57,560
And so there's really a discussion there that happens, and hiring managers will think about this, about does the certification really demonstrate that you know what I need you to know?

202
00:17:59,200 --> 00:18:00,920
So let's talk about college.

203
00:18:00,920 --> 00:18:05,480
I know that this is a very personal subject for a lot of people.

204
00:18:05,940 --> 00:18:08,680
Not all schools and all programs are created equally.

205
00:18:09,040 --> 00:18:22,640
If you go and get a computer science degree from MIT, it's going to be very different than if you get a computer science from, you know, maybe a community college or from University of Phoenix or some other schools.

206
00:18:22,640 --> 00:18:30,140
Take a look at what the reputation is, not just of the school, but of that particular program in that school.

207
00:18:30,280 --> 00:18:34,020
Most of you have never probably heard of University of Texas Dallas.

208
00:18:34,020 --> 00:18:38,620
They happen to have one of the top-ranked schools for computer science in the country.

209
00:18:38,620 --> 00:18:45,580
University of California Santa Barbara has one of the top-ranked schools for cyber security-based computer science.

210
00:18:45,720 --> 00:18:52,980
So really take a look at the programs, take a look at the schools, and realize that they're not all created equal.

211
00:18:52,980 --> 00:18:57,340
Most of the colleges will focus on theory with varying levels of practice.

212
00:18:57,340 --> 00:19:02,020
And again, that is a question that you should ask when you're considering a school in a program.

213
00:19:02,020 --> 00:19:05,020
How much is this theory and how much of this is practice?

214
00:19:06,000 --> 00:19:09,040
Then the other question you want to ask is, do I want to just study?

215
00:19:09,040 --> 00:19:12,560
Do I want to become a full -time college student or do I want to work and study?

216
00:19:12,560 --> 00:19:14,520
Now some of us, we're not going to have that option.

217
00:19:14,520 --> 00:19:21,500
Our life situations are such that we've got people that depend on us, we've got dependents , and so we're going to have to work and study.

218
00:19:21,960 --> 00:19:34,440
And that's okay, but for those of us that have the choice, we've got to balance possibly taking larger loans out to concentrate on our studies, vice taking smaller loans out, and working and studying.

219
00:19:34,440 --> 00:19:36,780
And that's very much a personal choice.

220
00:19:36,880 --> 00:19:38,040
Job placement.

221
00:19:38,040 --> 00:19:42,960
If you're going to go to a college, you should find out if they're going to help you get a job afterwards.

222
00:19:43,400 --> 00:19:51,260
College degrees are not cheap, they're very expensive, and so getting the degree shouldn't be where your college stops.

223
00:19:51,260 --> 00:19:55,960
Your college or university should help you with job placement afterwards.

224
00:19:56,540 --> 00:19:59,620
And then there's a value proposition versus cost.

225
00:20:00,180 --> 00:20:08,020
If you... getting a college degree in something that is not marketable is a personal choice.

226
00:20:08,020 --> 00:20:13,740
So really, if you want to work in InfoSec, you know, that history degree may or may not help you.

227
00:20:13,740 --> 00:20:15,900
And we'll talk more about unrelated degrees either.

228
00:20:15,900 --> 00:20:24,680
But if you know you want to work in InfoSec, perhaps you want to consider cybersecurity or an IT or a computer science degree.

229
00:20:25,170 --> 00:20:27,460
But there are other degree paths.

230
00:20:27,680 --> 00:20:34,720
You can either get an unrelated degree and get into InfoSec, or you can get a related degree and get into InfoSec.

231
00:20:34,720 --> 00:20:36,880
And those have their own pros and cons.

232
00:20:36,980 --> 00:20:43,080
And I'll show you an example of somebody that has an unrelated degree and has a fantastic InfoSec career.

233
00:20:44,020 --> 00:20:52,840
So the pros of colleges is that all industries and all companies recognize bachelor's degrees and master's degrees and PhDs.

234
00:20:53,120 --> 00:20:59,080
They're resilient, they tend to be theory focused, which moves at a much slower pace than practice.

235
00:20:59,400 --> 00:21:02,980
And so the tools change, the theory very rarely does.

236
00:21:03,060 --> 00:21:06,580
But if you've got a degree in that field, you're going to get that HR pass.

237
00:21:06,580 --> 00:21:15,220
If they're looking for a bachelor's degree, I'm not aware of someone that says, well, you've got a bachelor's degree, but it's not the right bachelor's degree, and therefore we're not going to take you.

238
00:21:15,220 --> 00:21:28,360
Job survivability, I talked about when we hit hard economic times, the people with degrees that are working in a field with their degree tend to be more survivable than the people that don't have degrees that are working in a field.

239
00:21:28,420 --> 00:21:32,340
Right, wrong, or otherwise, that's just kind of how it happens.

240
00:21:32,880 --> 00:21:34,940
It's a non-perishable skill, right?

241
00:21:34,940 --> 00:21:42,800
Again, I talked about the 10,000 hours to become an expert, 3.42 years, that's roughly the amount of class time that you're going to spend getting a bachelor's degree.

242
00:21:43,280 --> 00:21:46,780
Writing, writing is absolutely critical.

243
00:21:46,780 --> 00:21:47,920
I'll talk more about that.

244
00:21:47,920 --> 00:21:50,200
You're going to spend a lot of time writing in college.

245
00:21:50,440 --> 00:21:56,460
You can be the best penetration tester in the world, but you have to be able to communicate your findings in writing.

246
00:21:56,460 --> 00:22:00,220
And if you can't do that, you're probably not going to be hired back.

247
00:22:00,980 --> 00:22:04,140
Non-related courses, is that actually a benefit?

248
00:22:04,140 --> 00:22:05,940
I actually believe it is.

249
00:22:06,580 --> 00:22:10,640
It's easy for us to learn things that we're interested in within our chosen major.

250
00:22:10,640 --> 00:22:15,120
It is much harder to pay attention, learn things that we're not familiar with and we're not good at.

251
00:22:15,380 --> 00:22:17,180
But learning is like anything else.

252
00:22:17,180 --> 00:22:19,840
The more you practice at learning, the better you become at learning.

253
00:22:19,840 --> 00:22:28,680
And so as you're asked to learn new things throughout your career, it actually becomes easier to learn things the more you've practiced it.

254
00:22:28,680 --> 00:22:31,900
And then cost, it may or may not be a pro.

255
00:22:31,900 --> 00:22:35,920
Again, that depends on how you choose to fund your college education.

256
00:22:35,920 --> 00:22:41,400
If you use grants and scholarships, then cost is probably not prohibitive.

257
00:22:41,400 --> 00:22:46,600
But you also have to make some lifestyle choices about how you want to live while you're going through college.

258
00:22:46,600 --> 00:22:52,440
Otherwise, you're going to end up racking up a lot of debt that may or may not be a good value proposition.

259
00:22:56,260 --> 00:22:58,600
So writing and unrelated courses.

260
00:22:58,600 --> 00:23:00,380
Writing is absolutely critical for success.

261
00:23:00,380 --> 00:23:02,780
That's not just me saying that's Lenny's ulcer.

262
00:23:03,360 --> 00:23:08,700
Lenny's ulcer, among various and sundry other things, is a fantastic SANS instructor.

263
00:23:08,840 --> 00:23:11,900
And he teaches the reverse engineering of malware.

264
00:23:11,900 --> 00:23:16,360
And he says, listen, if you want to excel in information security, you've got to have strong writing skills.

265
00:23:17,480 --> 00:23:19,420
Often these things are ignored.

266
00:23:19,620 --> 00:23:21,220
Many of us don't like to write.

267
00:23:21,220 --> 00:23:24,560
I am not a fan of writing.

268
00:23:24,560 --> 00:23:26,180
I'm not going to sit there and practice writing.

269
00:23:26,180 --> 00:23:28,700
I don't do short stories or any of those things.

270
00:23:28,700 --> 00:23:30,500
I know lots of people do and I envy them.

271
00:23:30,500 --> 00:23:33,320
It is something that I've had to work very hard at.

272
00:23:33,600 --> 00:23:38,620
Most of us in this field tend to ignore writing because we're more interested in the technical skills.

273
00:23:38,780 --> 00:23:41,940
But just like technical skills, writing requires practice.

274
00:23:42,440 --> 00:23:47,700
And so if you go to college and you're forced to take unrelated classes, you're going to be forced to practice writing.

275
00:23:48,240 --> 00:23:54,340
And it's one of those things that if you're not going to do it on your own, you need to find somebody that's going to force you to do it.

276
00:23:54,560 --> 00:23:55,680
This may help you do it.

277
00:23:55,680 --> 00:24:00,760
The other thing is that understanding other fields helps you explain things.

278
00:24:01,400 --> 00:24:04,440
Very rarely are we going to do InfoSec for the sake of InfoSec.

279
00:24:04,440 --> 00:24:08,000
Normally we're going to do InfoSec for the sake of a company.

280
00:24:08,000 --> 00:24:11,980
That company's mission may not be InfoSec.

281
00:24:11,980 --> 00:24:13,060
It may be a bank.

282
00:24:13,060 --> 00:24:14,800
It may be an educational institution.

283
00:24:14,800 --> 00:24:16,640
It may be an engineering institution.

284
00:24:16,640 --> 00:24:24,720
And if you can't understand what it is that that company does, you're probably not going to be able to communicate very well why they should be concerned about InfoSec.

285
00:24:27,570 --> 00:24:29,030
So what are the cons?

286
00:24:29,030 --> 00:24:29,830
Well, cost, right?

287
00:24:29,830 --> 00:24:33,610
You have to be cognizant of the financial cost of college.

288
00:24:33,610 --> 00:24:35,810
College is definitely not cheap.

289
00:24:36,450 --> 00:24:39,770
You have to think, make some choices about how you're going to live.

290
00:24:40,010 --> 00:24:43,150
You have to discuss, think about the applicability.

291
00:24:43,690 --> 00:24:45,610
Unrelated courses are going to be required.

292
00:24:45,610 --> 00:24:53,230
Listen, any degree that you get, you're going to have to take English Composition, and you're probably going to have to take History, and you're probably going to have to take College Math.

293
00:24:53,230 --> 00:24:59,290
It's something we all kind of suffer through, but you're just going to have to do that.

294
00:25:00,310 --> 00:25:07,350
The baseline related courses are good because that's where you get your introduction to theory, but they tend to be not very exciting.

295
00:25:07,350 --> 00:25:11,810
For those of us that love this stuff, we already kind of know how to program in Python, right?

296
00:25:11,810 --> 00:25:21,110
We don't really need an Intro to Python class, but the college is going to probably require that if you're taking Computer Science, and so you're just going to have to suffer through it.

297
00:25:21,270 --> 00:25:24,910
One of the criticisms is that college is not practical.

298
00:25:24,910 --> 00:25:28,590
They tend to be a little bit behind, and that's true in many programs.

299
00:25:28,590 --> 00:25:32,470
They're not keeping up with the latest and greatest because they're not trying to teach you practice.

300
00:25:32,470 --> 00:25:36,150
In many cases, they're trying to teach you theory, which moves at a much slower pace.

301
00:25:36,330 --> 00:25:38,030
The other problem is time.

302
00:25:38,150 --> 00:25:41,630
College requires a significant time investment.

303
00:25:41,770 --> 00:25:46,170
Even if you're a full -time student, it's probably going to take you three or four years to finish a bachelor's.

304
00:25:46,170 --> 00:25:50,570
A master's is going to take you, even if you're a full-time student, probably two years.

305
00:25:51,930 --> 00:25:54,110
So, let's talk a little bit about the cost.

306
00:25:54,110 --> 00:26:01,670
This is the average cost as pulled from an independent journalist for a university.

307
00:26:01,670 --> 00:26:04,810
So, a public two-year in-district is $3,400.

308
00:26:06,830 --> 00:26:09,650
A public four-year is $9,000.

309
00:26:09,650 --> 00:26:16,950
Now, if you remember a few slides ago, we talked about certifications, and a one-week class in a certification tent was $8,000.

310
00:26:17,670 --> 00:26:26,830
So, for $1,000 more, you get to spend an entire year at a university becoming a dedicated learner.

311
00:26:26,830 --> 00:26:29,810
So, what's the value proposition there?

312
00:26:29,870 --> 00:26:32,930
If you're going to go to an out-of-state school, yeah, it's going to be a lot more expensive, right?

313
00:26:32,930 --> 00:26:35,490
You're looking at, on average, $24,000.

314
00:26:35,910 --> 00:26:39,550
And if you go to a private university, you're looking at $32,000.

315
00:26:40,010 --> 00:26:41,890
So, these are all things to keep in mind.

316
00:26:41,890 --> 00:26:57,150
Maybe the best option is not to move far away from home, unless you're chasing a particular school and a particular program, because they really teach the things exactly that you want to learn, or they have good insight in the industry that you want to go.

317
00:26:57,550 --> 00:27:01,650
If you want to work in Silicon Valley, absolutely go to a University of California school, right?

318
00:27:01,650 --> 00:27:04,150
Because they're there, and they have established relationships.

319
00:27:05,850 --> 00:27:09,010
But these are just the costs for tuitions and fees.

320
00:27:09,010 --> 00:27:12,350
These don't include things like your living expenses.

321
00:27:12,350 --> 00:27:15,750
They don't include things like your meal plans, and they don't include things like your books.

322
00:27:15,750 --> 00:27:19,450
Let's have a little bit of a discussion about reducing cost.

323
00:27:19,950 --> 00:27:22,570
This is a mock-up of my dorm room.

324
00:27:22,610 --> 00:27:24,630
Actually, that's not quite true.

325
00:27:24,630 --> 00:27:30,950
This is a mock-up of the dorm room after they remodeled it after I graduated.

326
00:27:31,150 --> 00:27:32,930
It looks pretty much like a prison.

327
00:27:32,930 --> 00:27:39,810
I lived a very spartan lifestyle, but because I did that, I incurred very little... actually, in my case, I incurred no cost.

328
00:27:40,010 --> 00:27:50,910
But if you want to have a really nice apartment, and you're a full -time student, and you're not working, recognize that your lifestyle is going to go on your student goals, and so that's going to drive up your cost.

329
00:27:51,250 --> 00:28:07,970
And so, while I fully recognize that college is expensive, I often question when people say, well, I've got a hundred and some odd thousand dollars of debt for going to school, and I ask if they lived in a dorm, and they show me pictures of this fully laid out apartment with giant screen TVs.

330
00:28:09,050 --> 00:28:10,710
Delayed gratification is a thing .

331
00:28:10,710 --> 00:28:17,030
If you don't want to incur a lot of cost while you're in college, you may want to cut back your living expenses a little bit.

332
00:28:20,000 --> 00:28:26,020
So, commons of college, you know, the applicability, you're going to be taking a lot of unrelated courses.

333
00:28:26,020 --> 00:28:27,860
You're still going to have to pay for those courses.

334
00:28:27,860 --> 00:28:30,240
Again, they're tangentially related.

335
00:28:30,880 --> 00:28:32,240
Practice varies.

336
00:28:32,240 --> 00:28:37,900
Not all programs provide you the same amount of practice, and not all schools are the same, right?

337
00:28:37,900 --> 00:28:41,680
Contact hours with your professors and your instructors matter.

338
00:28:41,940 --> 00:28:49,140
Faculty that have been in the real world and really are subject matter experts matter.

339
00:28:49,140 --> 00:28:54,820
One of the things I will tell you is you are going to meet a lot of faculty members at some schools that have never been in the real world.

340
00:28:54,860 --> 00:29:07,320
They've spent their entire life in academia, and so their view of industry and what's needed to succeed in industry is going to be very different than someone who has spent some time in industry doing it.

341
00:29:07,940 --> 00:29:10,120
Usually, you get good, fast, or cheap.

342
00:29:10,120 --> 00:29:11,120
Choose two.

343
00:29:11,120 --> 00:29:15,320
With universities and college education, it's normally choose one.

344
00:29:15,680 --> 00:29:19,420
There are some that are good and cheap, but that's rare.

345
00:29:19,420 --> 00:29:28,060
You really have to be lucky enough to be living close to a school that has a good program, but they're definitely not fast.

346
00:29:28,060 --> 00:29:33,400
If it's fast, there are some schools out there that are online, and they will tell you that you can get a master's degree in one year.

347
00:29:33,640 --> 00:29:36,720
It's probably not going to be cheap, and it's probably not going to be good.

348
00:29:36,720 --> 00:29:38,180
Let's be honest about that.

349
00:29:38,180 --> 00:29:40,160
So, go into it with your eyes open.

350
00:29:40,260 --> 00:29:47,100
The other thing that you see is a lot of schools are going to advertise that they're NSA Academic Centers of Excellence.

351
00:29:47,100 --> 00:29:55,480
I will tell you, having taken two schools through that certification program, that that certification is absolutely worthless.

352
00:29:55,700 --> 00:30:02,800
It is not that hard to get accredited as an NSA Academic Center of Excellence, and it's a paperwork drill.

353
00:30:02,840 --> 00:30:16,080
The NSA asks schools to make sure that they teach certain things, and if they have one slide on one course that mentions that subject, then they get to claim that they taught it.

354
00:30:16,080 --> 00:30:20,320
That is really not what NSA and Cyber Command were after.

355
00:30:20,460 --> 00:30:27,580
So, I would not really consider that Academic Center of Excellence certification for a school as worthwhile.

356
00:30:27,580 --> 00:30:29,040
Don't buy that.

357
00:30:31,240 --> 00:30:33,480
So, another con is the applicability.

358
00:30:34,300 --> 00:30:44,480
I used to teach not just at the graduate level, but at the undergraduate level, and I happened to teach one of the last classes that my undergraduates took before they graduated.

359
00:30:44,620 --> 00:30:51,020
And many, many, many of my students would come to me and go, hey, listen, you know, Professor Brewer, loved your class.

360
00:30:51,020 --> 00:30:51,900
It was great.

361
00:30:51,900 --> 00:30:55,560
I'm about to graduate with a degree, a bachelor's degree in computer science.

362
00:30:55,560 --> 00:30:57,700
I don't feel qualified to do anything.

363
00:30:58,380 --> 00:30:59,900
Congratulations, you're not alone.

364
00:30:59,900 --> 00:31:01,200
We all feel that way.

365
00:31:01,260 --> 00:31:06,460
If you spend any time in InfoSec, you're just going to get used to the imposter syndrome.

366
00:31:06,480 --> 00:31:07,660
I still have it.

367
00:31:07,660 --> 00:31:10,760
Many of the people up on stage today are still going to have it.

368
00:31:11,600 --> 00:31:17,000
But what you need to realize is that having a bachelor's degree doesn't demonstrate that you're an expert in something.

369
00:31:17,000 --> 00:31:22,060
A bachelor's degree demonstrates that you're capable of being taught and learning new things.

370
00:31:22,280 --> 00:31:23,620
And so your employers know that.

371
00:31:23,620 --> 00:31:28,220
Because you've got a bachelor's degree in computer science, they don't expect you to hop in and be an expert programmer.

372
00:31:28,220 --> 00:31:36,420
They expect that when they stick you with a more seasoned senior programmer, that they're going to be able to teach you the things that you need to do to accomplish your job there.

373
00:31:36,560 --> 00:31:40,360
A master's degree doesn't mean that you're a master of your trade.

374
00:31:40,360 --> 00:31:41,480
It absolutely does not.

375
00:31:41,480 --> 00:31:44,280
What it means is that you're capable of teaching yourself.

376
00:31:45,160 --> 00:31:51,640
If you don't know something and you're asked to do it, you're capable of going out and finding resources and teaching yourself.

377
00:31:51,940 --> 00:31:56,200
And a PhD absolutely doesn't mean that you're an expert in anything.

378
00:31:56,320 --> 00:32:00,640
What it means is that you're capable of conducting independent scientific research.

379
00:32:01,240 --> 00:32:06,060
So a lot of people do ask me, because I've just gotten one, should I get a PhD?

380
00:32:06,060 --> 00:32:12,100
And my answer to this is, you should only get a PhD for three reasons.

381
00:32:12,100 --> 00:32:18,180
The first one is, if you want to work in academia, if you want to be a university professor, absolutely go get a PhD.

382
00:32:18,180 --> 00:32:24,620
There's a hardcast system in there about tenure-track PhDs and non-tenure-track PhDs and then lecturers.

383
00:32:25,060 --> 00:32:32,820
The other reason is, if you want to do research, professional research, for your career, go get a PhD.

384
00:32:33,500 --> 00:32:39,740
And the last reason to get a PhD, which was my reason, was I just wanted one.

385
00:32:40,500 --> 00:32:42,100
Does it really help your career?

386
00:32:42,100 --> 00:32:42,960
It's arguable.

387
00:32:42,960 --> 00:32:46,800
I would say most cases the juice is probably not worth the squeeze on that one.

388
00:32:47,460 --> 00:32:52,880
It was just a personal goal I'd set for myself for reasons that, well, I'm just not going to get into.

389
00:32:52,880 --> 00:32:56,600
But just be aware of what those degrees are supposed to demonstrate.

390
00:32:56,600 --> 00:32:59,140
None of these demonstrate that you're an expert.

391
00:33:01,700 --> 00:33:05,620
So unrelated degrees, everybody needs InfoSec, right?

392
00:33:05,620 --> 00:33:13,560
It doesn't matter if you're a book publisher, if you're a bank, if you're a manufacturer, if you run industrial plants.

393
00:33:13,560 --> 00:33:21,280
All these things right now run on IoT and computers, and so they all need InfoSec.

394
00:33:21,280 --> 00:33:26,440
And taking these unrelated courses helps you learn the language of non-InfoSec people.

395
00:33:26,760 --> 00:33:36,820
If you're an InfoSec person and you go talk to your boss at a bank about IP addresses and ROP, and they're just going to run you out of the room.

396
00:33:36,820 --> 00:33:39,440
They pay you good money so they don't have to hear that language.

397
00:33:39,440 --> 00:33:44,540
They want to know, you know, what do I gain, what do I lose, what does it cost, and why do I care?

398
00:33:44,540 --> 00:33:52,420
So you're going to have to translate the geek speak and the InfoSec to business processes and thought processes of executives.

399
00:33:53,120 --> 00:33:55,560
Baseline courses, regardless of degree, are going to be the same.

400
00:33:55,560 --> 00:34:05,360
It doesn't matter if you're going to get a bachelor's in history, a bachelor's in women's studies, a bachelor's in computer science, or a bachelor's in electrical engineering.

401
00:34:05,460 --> 00:34:07,940
You're all going to have to take college math.

402
00:34:07,940 --> 00:34:10,140
You're all going to have to take English composition.

403
00:34:10,400 --> 00:34:15,280
Those baseline courses are the same, and they're meant to be a good foundation for the rest of your learning.

404
00:34:15,380 --> 00:34:17,380
I mentioned writing practice.

405
00:34:17,380 --> 00:34:20,380
You're going to get a lot of writing practice, regardless of your degree.

406
00:34:20,440 --> 00:34:21,920
That writing is important.

407
00:34:21,920 --> 00:34:22,960
It's actually critical.

408
00:34:22,960 --> 00:34:29,180
I would say in many cases, it's at least as critical, if not more critical, than your technical knowledge.

409
00:34:30,040 --> 00:34:39,000
But if you're going to get an unrelated degree and you want to work at InfoSec, at some point you're going to have to come back and either get some training or some education on the tech side.

410
00:34:39,400 --> 00:34:52,320
You can't just hop in from a history degree and decide that you're going to be an InfoSec analyst without going back and actually understanding what some of the InfoSec language means and understanding something about how computers and networks work.

411
00:34:53,300 --> 00:35:00,200
So, you know, here's a fantastic example of somebody that's successful with an unrelated degree.

412
00:35:00,200 --> 00:35:02,820
Tracy Malief, many of you know her, InfoSec Sherpa.

413
00:35:02,820 --> 00:35:06,960
She's got a bachelor's in history and she's got a master's in library sciences.

414
00:35:07,160 --> 00:35:22,560
She spent 10 years working as a librarian, then was a cyber analyst at Glasgow SmithKline, got her first InfoSec certification in 2017, and in 2019 she became an InfoSec analyst for New York Times.

415
00:35:22,560 --> 00:35:26,620
So library sciences doesn't seem like it's a related degree.

416
00:35:26,620 --> 00:35:31,360
However, what it taught her to do was how to do research very, very well.

417
00:35:31,360 --> 00:35:37,400
She's certainly a much better researcher than I am, and it taught her how to write exceedingly well.

418
00:35:37,400 --> 00:35:45,800
And because of that, she's been tremendously successful, not only in the hacker community, but as a professional InfoSec analyst.

419
00:35:45,800 --> 00:35:53,520
So absolutely, all degrees are valuable, and you certainly can work in InfoSec if you have an unrelated degree.

420
00:35:55,780 --> 00:36:02,580
So Immanuel Kant said that experience without theory is blind, but theory without experience is mere intellectual play.

421
00:36:02,580 --> 00:36:03,680
And it's true.

422
00:36:03,680 --> 00:36:04,640
You need both.

423
00:36:04,640 --> 00:36:10,340
You need a little bit of theory, and you need a little bit of experience and practical knowledge if you want to be successful.

424
00:36:10,340 --> 00:36:12,760
Otherwise, you're really just a one-sided professional.

425
00:36:12,860 --> 00:36:14,860
So you need a bit of both.

426
00:36:16,680 --> 00:36:17,880
So great.

427
00:36:18,020 --> 00:36:19,920
I've got more questions about this.

428
00:36:19,920 --> 00:36:22,880
Where can I go for learning and networking resources?

429
00:36:22,880 --> 00:36:23,880
Well, congratulations.

430
00:36:23,880 --> 00:36:26,080
If you're listening to this, you're already doing that.

431
00:36:26,240 --> 00:36:30,520
DEF CON and hacker conferences and hacker collectives are great insight.

432
00:36:30,520 --> 00:36:40,160
It's a great place to meet people that may be doing things that you're interested in, or that have good and bad experiences to share with you on their path.

433
00:36:40,440 --> 00:36:45,380
Makerspaces, there are makerspaces throughout the country and throughout the world.

434
00:36:45,380 --> 00:36:55,200
Lots of professionals have a passion for InfoSec and what they do that are willing to share their experiences and share their knowledge for little or no cost.

435
00:36:55,200 --> 00:36:57,880
Capture the flag exercises are great.

436
00:36:57,980 --> 00:37:02,960
One of the things I often hear is, I don't feel like I know enough to do capture the flag exercises.

437
00:37:03,040 --> 00:37:03,700
That's great.

438
00:37:03,700 --> 00:37:07,140
If you knew how to do the capture the flag exercise, it wouldn't be fun.

439
00:37:07,140 --> 00:37:12,080
So what I would say is go out there and try it and figure out what you can figure out.

440
00:37:12,080 --> 00:37:14,680
And what you can't figure out, go back a week later.

441
00:37:14,680 --> 00:37:19,080
What you're going to see is that the teams that did well did write-ups on how to solve the challenges.

442
00:37:19,080 --> 00:37:25,620
And that's going to give you insight into not only how to solve the challenges, but subjects that you may want to go back and learn more on.

443
00:37:26,320 --> 00:37:29,280
Mentors and mentees, everybody needs a mentor.

444
00:37:29,280 --> 00:37:30,240
I've got several.

445
00:37:31,160 --> 00:37:33,260
And I learned a lot from my mentors.

446
00:37:33,300 --> 00:37:34,920
Here's a hidden trick, though.

447
00:37:34,920 --> 00:37:37,800
I learned far more from my mentees than I learned from my mentors.

448
00:37:37,880 --> 00:37:43,780
They often ask me questions that I go, you know what, I actually have no idea, and I have to go back and research it.

449
00:37:43,780 --> 00:37:46,580
And I have to learn it well enough to explain it to my mentee.

450
00:37:46,720 --> 00:37:51,040
So both being a mentor and a mentee is a great way to learn things.

451
00:37:51,040 --> 00:37:57,560
There are lots of free online training, everything from YouTube to online classes to Khan Academy.

452
00:37:57,800 --> 00:38:01,640
Hacker cons, you can attend or you can volunteer.

453
00:38:02,980 --> 00:38:06,900
Attending is always great because you get to go to ideally all the talks that you want to do.

454
00:38:07,120 --> 00:38:09,860
Hidden trick of mine is to volunteer at the cons.

455
00:38:09,860 --> 00:38:11,400
I've been doing it for a long time.

456
00:38:11,520 --> 00:38:16,400
Particularly if you volunteer for speaker operations, you get a lot of one-on-one time with the speakers.

457
00:38:16,500 --> 00:38:19,080
You get to ask questions without anybody else in the room.

458
00:38:19,080 --> 00:38:20,940
So that's really, really great.

459
00:38:21,440 --> 00:38:30,580
For military members that are leaving, there's a program called Skill Bridge where you can go get an internship for six months at a company.

460
00:38:30,580 --> 00:38:33,000
That company doesn't pay your salary.

461
00:38:33,080 --> 00:38:34,400
The DOD pays your salary.

462
00:38:34,400 --> 00:38:35,860
So they get a free intern.

463
00:38:35,860 --> 00:38:37,100
You get free job experience.

464
00:38:37,100 --> 00:38:40,480
You get to try out that company and decide if you really want to get hired there.

465
00:38:40,480 --> 00:38:41,840
So that's a great deal.

466
00:38:41,840 --> 00:38:52,280
For college students and for people taking either the School of Hard Knocks or the certification path, go get an internship, either paid or unpaid.

467
00:38:52,440 --> 00:38:53,700
Internships are great.

468
00:38:53,700 --> 00:38:58,620
Not only do they let you gain some skills, they let you learn about the company.

469
00:38:58,700 --> 00:39:01,000
That lets the company learn about you.

470
00:39:01,000 --> 00:39:07,360
And oftentimes you get a job, not because you submitted a resume, but because you have a personal relationship with somebody in a company.

471
00:39:08,080 --> 00:39:13,080
Professional organizations, ISC Squared, ISACA, all of those tend to have monthly meetings.

472
00:39:13,080 --> 00:39:13,860
Those are great.

473
00:39:13,860 --> 00:39:15,080
Go network.

474
00:39:15,080 --> 00:39:16,640
Go talk to people.

475
00:39:16,640 --> 00:39:18,600
They will give presentations.

476
00:39:18,600 --> 00:39:22,280
If you want to know how they got to learn about what they learned, they will tell you.

477
00:39:22,280 --> 00:39:24,200
Oftentimes they're happy to do that.

478
00:39:24,960 --> 00:39:33,040
Boot camps and lunch and learns, a lot of organizations will offer boot camps and lunch and learns for free in some cases because they want you to sign up for their paid classes later.

479
00:39:33,040 --> 00:39:33,920
But you don't have to.

480
00:39:33,920 --> 00:39:40,780
You can go for an hour and learn about Network Recon or OSINT or whatever it is that they're talking about.

481
00:39:40,780 --> 00:39:44,440
So lots of free resources out there.

482
00:39:44,780 --> 00:39:47,240
So at the end of this, what's the best solution?

483
00:39:47,400 --> 00:39:48,920
It's a choose your own adventure.

484
00:39:48,920 --> 00:39:52,360
If you want to be a ninja, do all three paths.

485
00:39:52,360 --> 00:39:54,720
Do some experimentation on your own.

486
00:39:54,720 --> 00:40:04,500
Go through the school of hard knocks, get some certifications, take some college classes, get a degree, but choose a path and start on it.

487
00:40:04,500 --> 00:40:06,040
Journey of a thousand steps.

488
00:40:06,580 --> 00:40:08,700
You have to take that first step.

489
00:40:09,040 --> 00:40:12,120
What you should consider is what are your goals when you start on this journey?

490
00:40:12,120 --> 00:40:14,020
What is your next goal that you want to achieve?

491
00:40:14,060 --> 00:40:19,780
And how can you best get there given your timeline, your finances and your goals?

492
00:40:19,860 --> 00:40:21,420
So there is no wrong path.

493
00:40:21,420 --> 00:40:23,240
There are pros and cons to all of them.

494
00:40:23,580 --> 00:40:26,820
Eventually, if you want to be professional, you're going to find out that you've done all three.

495
00:40:27,360 --> 00:40:30,920
And so it's really just a matter of which path do you want to start on first?

496
00:40:30,920 --> 00:40:32,620
There is no wrong path.

497
00:40:33,900 --> 00:40:39,140
So with that, thanks so much for your time and I will be on the discord if you have questions.

498
00:40:39,140 --> 00:40:40,380
Have a great day.

499
00:40:40,960 --> 00:40:44,040
Pablo, thank you so much for all of that.

500
00:40:44,040 --> 00:40:53,420
Just sort of great overview because as you said, we tend to have this discussion and everyone camps in my way is right or my way is right.

501
00:40:53,420 --> 00:40:54,760
And it really is.

502
00:40:54,760 --> 00:41:01,980
Everyone needs to customize their own career path and take bits and pieces.

503
00:41:01,980 --> 00:41:06,480
And depending on your finances, where you are in life, all of it.

504
00:41:06,480 --> 00:41:11,320
And that's what's so great about the industry is that we have so many resources.

505
00:41:11,320 --> 00:41:13,900
We have so many role models.

506
00:41:14,040 --> 00:41:16,620
We can craft our own path.

507
00:41:16,620 --> 00:41:22,620
And employers are also starting to really realize that experience over certifications.

508
00:41:22,620 --> 00:41:26,220
But it's going to change depending on the employer.

509
00:41:26,220 --> 00:41:34,800
I really appreciate you pulling this presentation together and also all your great comments to people's questions in discord.

510
00:41:34,800 --> 00:41:43,660
I want to remind everyone that we're doing resume review and career coaching all day Friday and all Saturday afternoon.

511
00:41:43,660 --> 00:41:46,900
You need to sign up in the discord channel.

512
00:41:46,920 --> 00:41:48,060
Pablo, thank you so much.

513
00:41:48,060 --> 00:41:50,320
I can't wait to be able to hug you in person.

514
00:41:50,420 --> 00:41:51,240
Thanks, Kathleen.

515
00:41:51,240 --> 00:41:52,640
Looking forward to seeing you.

516
00:41:52,640 --> 00:41:53,320
Take care.