start	end	text
4730	9210	Welcome back to the Career Hacking Village here at DEF CON Safe Mode.
9310	14930	Many times when we're talking on social media or on Discord, we're always asking,
14930	20350	what is the best career path? And several times people will say, no, this is the way,
20350	25070	no, this is the way, no, this is the way. What we can tell you is that there are many
25070	31750	different ways. And I'm really excited to have my friend Pablo explain how he sees it
31750	36410	and his recommendations on your career path. Take it away, Pablo.
36830	42430	Thanks, Kathleen. So this talk is titled, In Theory, There's No Difference Between Theory
42430	48490	and Practice. And so where did this come from? First of all, it's normally attributed to Yogi
48490	53690	Berra, who dropped other pearls, like when you come to a fork in the road, take it. But this
53690	60990	was actually not one of his. So the difference between theory and practice actually, according
60990	66070	to Snopes, appeared first in the 1986 book about programming, The Art and Science of Programming.
66070	71630	So I thought it was apropos. A lot of times when we talk about how to get into InfoSec,
71630	77310	we devolve into this discussion about going to college and learning theory or the school of
77310	81890	hard knocks, the learning practice. And so there's always this push and pull between theory and
81890	89530	practice. So why are we here? As Kathleen mentioned, about every six months or so,
89530	96050	we see these kind of flame wars and discussions pop up on Twitter about how do you get into InfoSec.
96170	103210	And it comes from all sides. So you have some people that believe that security is a prestige
103210	110750	class and that you have to spend 10 or 15 years on a watch floor or on a call desk before you can
110750	115790	join security. And you have some people saying, look, I didn't go to college. I've got a fantastic
115790	120590	InfoSec career and I make a ton of money and the college kids seem really upset by that.
121050	125710	And the truth is there are many paths and they're all valuable. It's a matter of what you want to
125710	131510	get into it and who you are as a person. So I thought it would be best to have a nice balanced
132070	138590	discussion on that. So why do we even have these discussions? Why does it matter? Well, we all go
138590	144490	through these little life transitions, right? We finish a school, be it high school or college
144490	150210	or a trade school, that we have to go out and find work. Many of us serve some time in the
150210	155110	military and we have to figure out what we're going to do once we take the uniform off.
155390	161550	Some of us have life changes. We get married or we have kids or something in our life changes
161550	166910	and we decide that we want to do something else. Or sometimes our careers just go away or we decide
166910	172050	we're just dissatisfied with our careers and we want to get into this thing called InfoSec. And
172050	179710	how do we really do that? So some disclaimers. First of all, these views are mine and mine
179710	186570	alone. They don't belong to my employer. There's an exception to be found for absolutely everything
186570	190890	I'm going to say. So if you try to find fault with this talk, congratulations, you will.
190890	196610	Again, these are my opinions and what I've experienced. And those opinions are based
196610	202670	upon my observations. But I'm also going to freely admit that I have biases. I took a very
202670	207130	particular path and I've seen what I've seen and I haven't seen what I haven't seen. And so
207130	214610	your mileage may vary. So a little bit about how my path came into InfoSec so that you understand
214610	219850	kind of my latent biases. I've been doing this for a little bit. I got access to my first
221830	229710	8088 class computer in 1981 and then played with modems and BBSs. In the early 90s,
229710	234470	I was a developer for Expert Systems. Those of you that are in AI may know what that is.
234470	238890	In 1993, I went through a life change and I decided to join the United States Navy.
238890	246070	Got a degree in computer science in 1998. Spent some time at NSA. Got a master's degree in
246070	251770	computer science 10 years after my bachelor's. Went back to Cyber Command. Then was faculty at
251770	257630	the Navy's postgraduate school teaching master's level computer science and information sciences.
257950	263370	Then I went to US Special Operations Command Hacker Makerspace called SoftWorks. And I just
263370	270210	finished a PhD in information sciences. Now that said, the picture is a little dated,
270210	275570	you might be able to make out that that's actually me with the rest of the school of
275570	282570	root. So I have been in the community for quite a while. So with that all being said,
283090	287870	we're going to have this discussion. Let's try not to turn it into a flame war.
288010	292550	We can disagree, but we should be respectful about how we disagree with each other.
294990	299190	So those of us that have been around for a really long time remember the quote-unquote
299190	305490	traditional path to an infosec job. There was no cybersecurity degree when I came up and went
305490	312930	through college. And so the running joke was that if you wanted to be a computer security expert,
312930	319930	and you could either go out and work at a SOC watch floor, become a forensic analyst,
319930	324490	and then a lab director, and a chief security officer, and 20 years later, you would be highly
324490	331410	paid consultants. Or the hacker method, where you became a hacker, you became a criminal,
331410	335870	you got convicted of a crime, and two years later, you were a highly paid consultant,
335870	341110	maybe 14 months with good behavior. Those days, unfortunately, or fortunately,
341110	347770	depending on your standpoint, may have gone by the wayside. So what are the contemporary paths?
347770	354010	How do most of us get into infosec careers this year? Well, there's typically three paths. There's
354010	358030	the School of Hard Knocks, there's the certification path, and then there's the
358030	364210	college education path. And each of those come with their own pros and cons. And so we should
364210	370730	discuss those a little bit. So the first one is the School of Hard Knocks. This is where you kind
370730	377290	of teach everything to yourself. It's a very traditional path for hackers, because there used
377290	385410	to not be college classes. There used to not be a CEH or a CISSP. You had to go out and read
385410	392170	Frack Magazine and read 2600, or go to hacker boards and teach this stuff to yourself.
393910	399470	One of the pros is the cost. The cost is essentially free. You only learn the things
399470	403330	that you're interested in learning. You don't have to bother with any baseline things you don't care
403330	408890	about. It takes the least amount of time before you get to the amount of stuff, before you get to
408890	414030	the subjects that you care about. We'll come back to that least amount of time. And you get practical
414030	419170	skills now. You learn what you need to solve your problems. And so you become a practitioner
419170	423530	immediately. And really, you're only limited by your personal drive and talent. Nobody's going
423530	427510	to tell you that you've got to learn about X before you learn about Y. Nobody's going to tell
427510	432970	you that you have to spend two years doing this before you go do that. You can just hop right in
432970	439950	and do the things that you're interested in doing. So what are the cons? Well, I mentioned time.
440150	445210	Least amount of time are the three paths. Well, that depends on how you cut it. Generally speaking,
445210	450350	there was a paper called Outliers by Malcolm Gladwell that says, in order to become an expert
450350	455890	in any one thing, you have to spend 10,000 hours doing it. So 10,000 hours, if you break it out
455890	462130	into eight-hour work days, means 3.42 years, which sounds remarkably like a bachelor's degree,
462130	466510	which takes about four years. And when you add summer vacation, and when you add spring break,
466510	473230	you're at four years. You can do it faster. And again, your mileage may vary. If you're a very
473230	478450	talented, very driven person, you might be able to do it in less time. But it is still a substantial
478450	484210	amount of time if you want to become an expert. Typically speaking, when you go through the
484210	489510	School of Hardenomics, you're all practice and very little to no theory. And the problem with
489510	495350	all practice is that the tools change, and the tactics, techniques, and procedures change,
495350	499470	and the approaches change. And if you're not based in a theoretical background,
500150	504430	and you're not actively using it, those skills become very perishable.
504850	509130	And so if you're not actively using it, you're going to lose it very quickly, and you're going
509130	514170	to have to come back and reteach yourself. Employment opportunities. Boutique shops
514170	519570	are a good opportunity for you because they're smaller, and they're willing to take a chance.
519570	526910	A lot of the boutique shops are started by rock stars in this community, and they didn't take a
526910	531690	college education in many cases. They learned through the School of Hardenomics, and so they
531690	536790	understand it. Independent consultant is another one. You have to do your own business development,
536790	541310	but you can certainly do that. You certainly can get hired by a corporation. The challenge
541310	545910	with getting hired with a corporation without a degree is you have to pass the HR check,
545910	552250	the human resources check. And the problem with that is the way that the industry has moved is a
552250	556410	lot of times, unless you get a personal introduction, you have to go through an automated
556410	560770	resume system, and it's looking for certain ticks. And if you don't check one of those ticks,
560770	566810	like maybe they require a bachelor's degree, your resume may never get seen by an actual human being.
567510	572610	The other issue with the School of Hardenomics is survivability. So when we go through hard
572610	577510	economic times, what happens is usually there's an accountant somewhere, an executive somewhere,
577510	585830	that wants to cut cost. And the first thing they cut is high cost assets, which don't have a whole
585830	591630	lot of background. So it's easy to justify in a business sense, paying somebody with an advanced
591630	599070	degree, a large sum of money, because they've got a demonstrated record that the school vouches for
599070	604190	it. That may be harder if you learn through the School of Hardenomics, unless you're a name brand.
604190	609370	If you're a name brand, then that may be different, but it is something to consider.
610430	615970	So here's a fantastic example of an absolute rock star who came up through the School of
615970	621610	Hardenomics, Frank Height. So, you know, Frank got started in this earlier than I did. He started
621610	630670	with a PDP in 1979 at his home. In 1981, he emancipated and went to go work for Chase Manhattan.
630750	634950	Never finished 10th grade. So not only does he not have a college degree, he doesn't have
635370	640550	a high school diploma. He's one of the best-read, most educated people I know without any formal
640550	646870	education, because he's just a tremendously driven and intelligent individual. In 88,
646870	653170	he went to work for the New York Transit Authority, created the emergency 911 system for
653170	662710	MCI, went to go work for NAVSEA and SWFPAC, which are Navy entities, found a NSA penetration
662710	670130	testing operation in 1997, and became the 10th employee at at stake in 99. And since then, he's
670130	674950	founded Leviathan Security, which has a tremendous name in the industry, and he's been a TED speaker
674950	682070	times three. So again, no formal education, just a tremendously talented, driven individual
682070	688530	with a curious mind. So absolutely, you can do this without certifications, and you can
688530	693030	absolutely do this without education, and here's a fine success example.
694110	702170	So the other way is certifications. Those have come into vogue of late, and we've all kind of
702170	709290	heard the names. There's CEH and OSCP and OSCE and CISSP. And what are all these things? Well,
709290	712830	the first thing to be aware of is not all these certifications are created equal,
712830	719590	and they're intended for different audiences. For better or worse, if you want to work for the
719590	724410	U.S. government, you're probably going to do much better if you have a CISSP, and that's actually
724410	729610	true in industry. I've got one. I've got my own thoughts on that certification as compared to
729610	736330	other certifications, but it's important for you to weigh what it is that you want to do for a living,
736330	739990	what kind of career you want to have, and see if that certification is going to help you get that
739990	746130	job or help you become more proficient in what you want to do. Many of the certifications focus on
746570	751650	practice with little to no theory, but there's some exemptions. They're vendor motivated. Those
751650	755870	certifications are there to make money, right? They want to sell you a boot camp. They want you to pay
755870	760970	for the class. They want you to pay to take the certification, and then they want you to pay fees
760970	769030	to maintain that certification. There are lots of paths to getting these, but primarily
769850	776210	you can take a class, a boot camp, or you can do online and self-teaching by picking up a book.
776210	780790	Most of these certifications have books where you can teach yourself the same things, and then
780790	785170	your certification exams are tends to be to either proctored exams, which means that you go to a
785170	789290	testing facility and they verify you are who you say you are before you take the exam, and then
789290	794630	there are online exams. One of the things that does come up, and it was a problem in the past with
794630	800650	some of the certifications, is that the online exams, you could actually go out and pay somebody
800650	805530	to take the exam in your stead and get the certification. So once that's out, those
805530	811170	certifications become less valuable in the eyes of industry, and so just be aware of that.
813010	818250	So what, you know, what are the pros of certifications? It's a great boot camp, right? If you're starting
818250	822310	at zero and you don't know how to get going, you're going to get lots of practice in a very
822310	827930	short amount of time. Most of these boot camps are a couple of days or maybe a week long. Some
827930	833610	of them are a little bit longer if it's a program. You're going to go from nothing to functional a
833610	840690	very short time. Theory may vary, but typically very little theory in these. If you do a boot
840690	843790	camp, you're going to get some lead learning, which means that you're going to have somebody
843790	848690	that's ostensibly a subject matter expert to answer your questions. There's going to be defined
849050	853750	a progression of knowledge, so if you don't know where to start or where to go next, typically these
853750	858130	boot camps will help you out with that. In the certifications, many of them will help you pass
858130	862370	an HR check because they're familiar with the vendors, they're familiar with the certifications,
862370	869130	and they're familiar with the knowledge you have to demonstrate in order to achieve those
869130	874630	certifications. And so in many cases, those automated resume checkers will actually tick
874630	882730	the box if you've got the right certifications that they're looking for. So what you're looking
882730	888350	at on the screen now is two courses. In the red box is one course, and in the blue box is the other
888350	893010	course. And my question for you is, what is the difference? And I'll give you a few seconds here
893010	906900	to read it. Good. So both of these are actually courses in exploitation development. One of them
906900	912260	is a master's level course, the other one is a course from a vendor that you take in one week.
912260	918140	So the master's level course takes 12 weeks, the vendor course takes one week. You're covering the
918140	924320	same information. But what you should think about is, if you take it in 12 weeks, are you going to
924320	929880	get a much deeper understanding and much more practice than if you take it one week? And I would
929880	934880	suggest that, yeah, you will. You know, if you're spending 12 weeks with the material, you're going
934880	939060	to spend more time exploring that material and going deeper on it than if you spend one week.
939060	943680	That doesn't mean that you're missing out on a whole lot of stuff, you're taking the one week,
943680	947660	but just be aware that a one-week boot camp is just going to give you an introduction to all
947660	951440	of these subjects. And so you're going to have to go through and spend some of your own time
951440	958840	really studying it. So what are some of the cons of certification? So I went out to a well-known
958840	964300	vendor, who will remain nameless, and I pulled up the cost for achieving their certification.
964480	971720	So their one-week class is $6,200. And then you have to wait a certain amount of time before you
971720	977340	can take the certification. And so if you want access to their online labs after the course,
977340	985760	it's another $729. So we're up at $7,000. And then each certification attempt is $729. So
985760	992480	you're up close to $8,000, and that's if you pass it the first time. If for whatever reason you fail
992480	995940	it and you have to go back and take it, well, you're probably going to need access to the labs,
995940	1000160	and you're probably going to need to pay for another certification event. So that's another
1000160	1006640	$1,500 every time that you fail to pass. And then on top of that, you're going to have to pay to
1006640	1012600	renew this every three to four years. So at $8,000, and we'll talk about the cost of college
1012600	1018820	later, but $8,000 is a substantial amount of money. Not just compared to college, but compared to
1018820	1024080	anything, $8,000 is a substantial amount of money. The other part is, as I mentioned, the certifications
1024080	1030020	tend to be tools-focused. Not always, not all certifications, but they tend to be tool-focused.
1030140	1034680	And so they're perishable, right? If you take a certification and then you don't do that
1034680	1042060	on a daily basis for your job, your skill in that set is going to deprecate. The other thing is,
1042060	1046120	what do they demonstrate? And so there's this ongoing discussion that always happens about,
1046120	1051460	does that demonstrate knowledge or does that demonstrate your ability to take an exam? And
1051460	1056980	different people have their own biases on this. I absolutely know people that could not pass a
1056980	1061020	certification exam that absolutely had mastery of the material. They just couldn't take a test.
1061020	1065860	I've also seen it the other way, where somebody passes the test and they clearly knew nothing
1065860	1070720	about the material. And so there's really a discussion there that happens, and hiring
1070720	1076100	managers will think about this, about does the certification really demonstrate that you know
1076100	1083640	what I need you to know? So let's talk about college. I know that this is a very personal
1083640	1090560	subject for a lot of people. Not all schools and all programs are created equally. If you go and
1090560	1096060	get a computer science degree from MIT, it's going to be very different than if you get a
1096060	1101860	computer science from, you know, maybe a community college or from University of Phoenix or some
1101860	1108760	other schools. Take a look at what the reputation is, not just of the school, but of that particular
1108760	1114240	program in that school. Most of you have never probably heard of University of Texas Dallas.
1114240	1118620	They happen to have one of the top-ranked schools for computer science in the country.
1118620	1124200	University of California Santa Barbara has one of the top-ranked schools for cyber security-based
1124200	1128980	computer science. So really take a look at the programs, take a look at the schools,
1128980	1136120	and realize that they're not all created equal. Most of the colleges will focus on theory with
1136120	1140540	varying levels of practice. And again, that is a question that you should ask when you're
1140540	1145020	considering a school in a program. How much is this theory and how much of this is practice?
1146000	1149940	Then the other question you want to ask is, do I want to just study? Do I want to become a
1149940	1154080	full-time college student or do I want to work and study? Now some of us, we're not going to have
1154080	1158900	that option. Our life situations are such that we've got people that depend on us, we've got
1158900	1165280	dependents, and so we're going to have to work and study. And that's okay, but for those of us
1165280	1170440	that have the choice, we've got to balance possibly taking larger loans out to concentrate on our
1170440	1175680	studies, vice taking smaller loans out, and working and studying. And that's very much a
1175680	1180900	personal choice. Job placement. If you're going to go to a college, you should find out if they're
1180900	1186480	going to help you get a job afterwards. College degrees are not cheap, they're very expensive,
1186480	1192960	and so getting the degree shouldn't be where your college stops. Your college or university
1192960	1199620	should help you with job placement afterwards. And then there's a value proposition versus cost.
1200180	1208140	If you... getting a college degree in something that is not marketable is a personal choice. So
1208140	1213800	really, if you want to work in InfoSec, you know, that history degree may or may not help you. And
1213800	1217920	we'll talk more about unrelated degrees either. But if you know you want to work in InfoSec,
1217920	1224680	perhaps you want to consider cybersecurity or an IT or a computer science degree.
1225170	1230940	But there are other degree paths. You can either get an unrelated degree and get into InfoSec,
1230940	1236880	or you can get a related degree and get into InfoSec. And those have their own pros and cons.
1236980	1242140	And I'll show you an example of somebody that has an unrelated degree and has a fantastic InfoSec
1242140	1249860	career. So the pros of colleges is that all industries and all companies recognize bachelor's
1249860	1255480	degrees and master's degrees and PhDs. They're resilient, they tend to be theory focused,
1255480	1262060	which moves at a much slower pace than practice. And so the tools change, the theory very rarely
1262060	1267000	does. But if you've got a degree in that field, you're going to get that HR pass. If they're
1267000	1271420	looking for a bachelor's degree, I'm not aware of someone that says, well, you've got a bachelor's
1271420	1275220	degree, but it's not the right bachelor's degree, and therefore we're not going to take you.
1275220	1279460	Job survivability, I talked about when we hit hard economic times,
1279460	1285320	the people with degrees that are working in a field with their degree tend to be more survivable
1285320	1289640	than the people that don't have degrees that are working in a field. Right, wrong, or otherwise,
1289640	1295480	that's just kind of how it happens. It's a non-perishable skill, right? Again, I talked
1295480	1300560	about the 10,000 hours to become an expert, 3.42 years, that's roughly the amount of class time
1300560	1306780	that you're going to spend getting a bachelor's degree. Writing, writing is absolutely critical.
1306780	1310200	I'll talk more about that. You're going to spend a lot of time writing in college.
1310440	1314980	You can be the best penetration tester in the world, but you have to be able to communicate
1314980	1320220	your findings in writing. And if you can't do that, you're probably not going to be hired back.
1320980	1325940	Non-related courses, is that actually a benefit? I actually believe it is.
1326580	1330820	It's easy for us to learn things that we're interested in within our chosen major. It is
1330820	1335120	much harder to pay attention, learn things that we're not familiar with and we're not good at.
1335380	1339360	But learning is like anything else. The more you practice at learning, the better you become at
1339360	1344800	learning. And so as you're asked to learn new things throughout your career, it actually becomes
1344800	1351900	easier to learn things the more you've practiced it. And then cost, it may or may not be a pro.
1351900	1356380	Again, that depends on how you choose to fund your college education. If you use
1357560	1362500	grants and scholarships, then cost is probably not prohibitive. But you also have to make some
1362500	1367340	lifestyle choices about how you want to live while you're going through college. Otherwise,
1367340	1372440	you're going to end up racking up a lot of debt that may or may not be a good value proposition.
1376260	1380620	So writing and unrelated courses. Writing is absolutely critical for success. That's
1380620	1386440	not just me saying that's Lenny's ulcer. Lenny's ulcer, among various and sundry other things,
1386440	1392800	is a fantastic SANS instructor. And he teaches the reverse engineering of malware. And he says,
1392800	1396360	listen, if you want to excel in information security, you've got to have strong writing skills.
1397480	1404840	Often these things are ignored. Many of us don't like to write. I am not a fan of writing. I'm not
1404840	1408860	going to sit there and practice writing. I don't do short stories or any of those things. I know
1408860	1413320	lots of people do and I envy them. It is something that I've had to work very hard at.
1413600	1417720	Most of us in this field tend to ignore writing because we're more interested in the technical
1417720	1423600	skills. But just like technical skills, writing requires practice. And so if you go to college
1423600	1427700	and you're forced to take unrelated classes, you're going to be forced to practice writing.
1428240	1432600	And it's one of those things that if you're not going to do it on your own, you need to find
1432600	1436640	somebody that's going to force you to do it. This may help you do it. The other thing is that
1437300	1443120	understanding other fields helps you explain things. Very rarely are we going to do InfoSec
1443120	1448560	for the sake of InfoSec. Normally we're going to do InfoSec for the sake of a company. That company's
1450280	1455120	mission may not be InfoSec. It may be a bank. It may be an educational institution. It may be
1455120	1459680	an engineering institution. And if you can't understand what it is that that company does,
1459680	1463280	you're probably not going to be able to communicate very well why they should be
1463280	1470990	concerned about InfoSec. So what are the cons? Well, cost, right? You have to be cognizant of
1470990	1477670	the financial cost of college. College is definitely not cheap. You have to think,
1477670	1483150	make some choices about how you're going to live. You have to discuss, think about the applicability.
1483690	1487270	Unrelated courses are going to be required. Listen, any degree that you get, you're going to
1487270	1490950	have to take English Composition, and you're probably going to have to take History, and
1490950	1495870	you're probably going to have to take College Math. It's something we all kind of suffer through,
1495870	1503510	but you're just going to have to do that. The baseline related courses are good because that's
1503510	1507750	where you get your introduction to theory, but they tend to be not very exciting. For those of
1507750	1512550	us that love this stuff, we already kind of know how to program in Python, right? We don't really
1512550	1517230	need an Intro to Python class, but the college is going to probably require that if you're taking
1517230	1522610	Computer Science, and so you're just going to have to suffer through it. One of the criticisms
1522610	1527850	is that college is not practical. They tend to be a little bit behind, and that's true in many
1527850	1531470	programs. They're not keeping up with the latest and greatest because they're not trying to teach
1531470	1536150	you practice. In many cases, they're trying to teach you theory, which moves at a much slower pace.
1536330	1542570	The other problem is time. College requires a significant time investment. Even if you're a
1542570	1546170	full-time student, it's probably going to take you three or four years to finish a bachelor's.
1546170	1550570	A master's is going to take you, even if you're a full-time student, probably two years.
1551930	1557910	So, let's talk a little bit about the cost. This is the average cost as pulled from an
1557910	1564810	independent journalist for a university. So, a public two-year in-district is $3,400.
1566830	1572590	A public four-year is $9,000. Now, if you remember a few slides ago, we talked about certifications,
1572970	1580950	and a one-week class in a certification tent was $8,000. So, for $1,000 more, you get to spend
1581750	1589810	an entire year at a university becoming a dedicated learner. So, what's the value proposition there?
1589870	1592790	If you're going to go to an out-of-state school, yeah, it's going to be a lot more expensive,
1592790	1597730	right? You're looking at, on average, $24,000. And if you go to a private university, you're
1597730	1603890	looking at $32,000. So, these are all things to keep in mind. Maybe the best option is not to move
1603890	1609090	far away from home, unless you're chasing a particular school and a particular program,
1609090	1614990	because they really teach the things exactly that you want to learn, or they have good insight in
1614990	1620330	the industry that you want to go. If you want to work in Silicon Valley, absolutely go to a
1620330	1624150	University of California school, right? Because they're there, and they have established relationships.
1625850	1630570	But these are just the costs for tuitions and fees. These don't include things like
1631070	1634870	your living expenses. They don't include things like your meal plans, and they don't include
1634870	1639450	things like your books. Let's have a little bit of a discussion about reducing cost.
1639950	1646110	This is a mock-up of my dorm room. Actually, that's not quite true. This is a mock-up of
1646110	1652930	the dorm room after they remodeled it after I graduated. It looks pretty much like a prison.
1652930	1657870	I lived a very spartan lifestyle, but because I did that, I incurred very little... actually,
1657870	1662870	in my case, I incurred no cost. But if you want to have a really nice apartment, and you're a
1662870	1667630	full-time student, and you're not working, recognize that your lifestyle is going to go on
1667630	1673670	your student goals, and so that's going to drive up your cost. And so, while I fully recognize that
1673670	1679870	college is expensive, I often question when people say, well, I've got a hundred and some odd
1679870	1684630	thousand dollars of debt for going to school, and I ask if they lived in a dorm, and they show me
1684630	1690590	pictures of this fully laid out apartment with giant screen TVs. Delayed gratification is a
1690590	1695150	thing. If you don't want to incur a lot of cost while you're in college, you may want to cut back
1695150	1704020	your living expenses a little bit. So, commons of college, you know, the applicability, you're
1704020	1707300	going to be taking a lot of unrelated courses. You're still going to have to pay for those
1707300	1714780	courses. Again, they're tangentially related. Practice varies. Not all programs provide you the
1714780	1719840	same amount of practice, and not all schools are the same, right? Contact hours with your professors
1719840	1726920	and your instructors matter. Faculty that have been in the real world and really are subject
1726920	1731760	matter experts matter. One of the things I will tell you is you are going to meet a lot of faculty
1731760	1736140	members at some schools that have never been in the real world. They've spent their entire life
1736140	1742940	in academia, and so their view of industry and what's needed to succeed in industry is going to
1742940	1748840	be very different than someone who has spent some time in industry doing it. Usually, you get
1748840	1755320	good, fast, or cheap. Choose two. With universities and college education, it's normally choose one.
1755680	1761720	There are some that are good and cheap, but that's rare. You really have to be lucky
1761720	1768060	enough to be living close to a school that has a good program, but they're definitely not fast.
1768060	1771500	If it's fast, there are some schools out there that are online, and they will tell you that you
1771500	1775900	can get a master's degree in one year. It's probably not going to be cheap, and it's probably
1775900	1780520	not going to be good. Let's be honest about that. So, go into it with your eyes open. The other
1780520	1785380	thing that you see is a lot of schools are going to advertise that they're NSA
1785380	1790980	Academic Centers of Excellence. I will tell you, having taken two schools through that certification
1790980	1797800	program, that that certification is absolutely worthless. It is not that hard to get accredited
1797800	1805720	as an NSA Academic Center of Excellence, and it's a paperwork drill. The NSA asks schools
1805720	1812280	to make sure that they teach certain things, and if they have one slide on one course that mentions
1812280	1818800	that subject, then they get to claim that they taught it. That is really not what NSA and
1818800	1825120	Cyber Command were after. So, I would not really consider that Academic Center of Excellence
1825120	1829040	certification for a school as worthwhile. Don't buy that.
1831240	1837360	So, another con is the applicability. I used to teach not just at the graduate level, but at the
1837360	1842480	undergraduate level, and I happened to teach one of the last classes that my undergraduates took
1842480	1848300	before they graduated. And many, many, many of my students would come to me and go,
1848300	1852700	hey, listen, you know, Professor Brewer, loved your class. It was great. I'm about to graduate
1852700	1857700	with a degree, a bachelor's degree in computer science. I don't feel qualified to do anything.
1858380	1863920	Congratulations, you're not alone. We all feel that way. If you spend any time in InfoSec,
1863920	1868280	you're just going to get used to the imposter syndrome. I still have it. Many of the people
1868280	1873940	up on stage today are still going to have it. But what you need to realize is that having a
1873940	1877000	bachelor's degree doesn't demonstrate that you're an expert in something.
1877000	1882060	A bachelor's degree demonstrates that you're capable of being taught and learning new things.
1882280	1885640	And so your employers know that. Because you've got a bachelor's degree in computer science,
1885640	1889560	they don't expect you to hop in and be an expert programmer. They expect that when they stick you
1889560	1894040	with a more seasoned senior programmer, that they're going to be able to teach you the things
1894040	1898860	that you need to do to accomplish your job there. A master's degree doesn't mean that
1898860	1902680	you're a master of your trade. It absolutely does not. What it means is that you're capable
1902680	1908820	of teaching yourself. If you don't know something and you're asked to do it, you're capable of going
1908820	1914920	out and finding resources and teaching yourself. And a PhD absolutely doesn't mean that you're an
1914920	1919600	expert in anything. What it means is that you're capable of conducting independent scientific
1919600	1926700	research. So a lot of people do ask me, because I've just gotten one, should I get a PhD? And my
1926700	1933580	answer to this is, you should only get a PhD for three reasons. The first one is, if you want to
1933580	1938940	work in academia, if you want to be a university professor, absolutely go get a PhD. There's a
1938940	1945640	hardcast system in there about tenure-track PhDs and non-tenure-track PhDs and then lecturers.
1945640	1951320	The other reason is, if you want to do research, professional research, for your career,
1951320	1959740	go get a PhD. And the last reason to get a PhD, which was my reason, was I just wanted one.
1960500	1965360	Does it really help your career? It's arguable. I would say most cases the juice is probably not
1965360	1971020	worth the squeeze on that one. It was just a personal goal I'd set for myself for reasons
1971020	1975700	that, well, I'm just not going to get into. But just be aware of what those degrees are supposed
1975700	1983980	to demonstrate. None of these demonstrate that you're an expert. So unrelated degrees,
1983980	1988880	everybody needs InfoSec, right? It doesn't matter if you're a book publisher, if you're a bank,
1988880	1995780	if you're a manufacturer, if you run industrial plants. All these things right now run on IoT
1995780	2003700	and computers, and so they all need InfoSec. And taking these unrelated courses helps you
2003700	2009740	learn the language of non-InfoSec people. If you're an InfoSec person and you go talk to your
2009740	2016820	boss at a bank about IP addresses and ROP, and they're just going to run you out of the room.
2016820	2020600	They pay you good money so they don't have to hear that language. They want to know,
2020600	2024540	you know, what do I gain, what do I lose, what does it cost, and why do I care?
2024540	2029680	So you're going to have to translate the geek speak and the InfoSec to business processes
2029680	2035100	and thought processes of executives. Baseline courses, regardless of degree, are going to be
2035100	2040820	the same. It doesn't matter if you're going to get a bachelor's in history, a bachelor's in women's
2040820	2045360	studies, a bachelor's in computer science, or a bachelor's in electrical engineering.
2045460	2050140	You're all going to have to take college math. You're all going to have to take English composition.
2050400	2054560	Those baseline courses are the same, and they're meant to be a good foundation for the rest of your
2054560	2059120	learning. I mentioned writing practice. You're going to get a lot of writing practice, regardless
2059120	2064460	of your degree. That writing is important. It's actually critical. I would say in many cases,
2064460	2069180	it's at least as critical, if not more critical, than your technical knowledge.
2070040	2074400	But if you're going to get an unrelated degree and you want to work at InfoSec, at some point
2074400	2079000	you're going to have to come back and either get some training or some education on the tech side.
2079400	2083080	You can't just hop in from a history degree and decide that you're going to be
2083680	2088060	an InfoSec analyst without going back and actually understanding what some of the InfoSec
2088060	2092320	language means and understanding something about how computers and networks work.
2093300	2098980	So, you know, here's a fantastic example of somebody that's successful with an unrelated
2098980	2104400	degree. Tracy Malief, many of you know her, InfoSec Sherpa. She's got a bachelor's in history
2104400	2110320	and she's got a master's in library sciences. She spent 10 years working as a librarian,
2111100	2117780	then was a cyber analyst at Glasgow SmithKline, got her first InfoSec certification in 2017,
2117780	2124920	and in 2019 she became an InfoSec analyst for New York Times. So library sciences doesn't seem like
2124920	2131360	it's a related degree. However, what it taught her to do was how to do research very, very well.
2131360	2136700	She's certainly a much better researcher than I am, and it taught her how to write exceedingly
2136700	2143240	well. And because of that, she's been tremendously successful, not only in the hacker community,
2143240	2148340	but as a professional InfoSec analyst. So absolutely, all degrees are valuable,
2148340	2153520	and you certainly can work in InfoSec if you have an unrelated degree.
2155780	2161100	So Immanuel Kant said that experience without theory is blind, but theory without experience
2161100	2166140	is mere intellectual play. And it's true. You need both. You need a little bit of theory,
2166140	2170340	and you need a little bit of experience and practical knowledge if you want to be successful.
2170340	2174860	Otherwise, you're really just a one-sided professional. So you need a bit of both.
2176680	2181820	So great. I've got more questions about this. Where can I go for learning and networking
2181820	2186080	resources? Well, congratulations. If you're listening to this, you're already doing that.
2186240	2191000	DEF CON and hacker conferences and hacker collectives are great insight. It's a great
2191000	2196980	place to meet people that may be doing things that you're interested in, or that have good and
2196980	2204000	bad experiences to share with you on their path. Makerspaces, there are makerspaces throughout the
2204000	2208840	country and throughout the world. Lots of professionals have a passion for InfoSec and
2208840	2213400	what they do that are willing to share their experiences and share their knowledge for
2213400	2220080	little or no cost. Capture the flag exercises are great. One of the things I often hear is,
2220080	2224220	I don't feel like I know enough to do capture the flag exercises. That's great. If you knew how to
2224220	2229400	do the capture the flag exercise, it wouldn't be fun. So what I would say is go out there and try
2229400	2234680	it and figure out what you can figure out. And what you can't figure out, go back a week later.
2234680	2238380	What you're going to see is that the teams that did well did write-ups on how to solve the
2238380	2242740	challenges. And that's going to give you insight into not only how to solve the challenges,
2242740	2247700	but subjects that you may want to go back and learn more on. Mentors and mentees,
2247700	2254280	everybody needs a mentor. I've got several. And I learned a lot from my mentors. Here's a
2254280	2258280	hidden trick, though. I learned far more from my mentees than I learned from my mentors.
2258280	2262520	They often ask me questions that I go, you know what, I actually have no idea, and I have to go
2262520	2268100	back and research it. And I have to learn it well enough to explain it to my mentee. So both being
2268100	2273160	a mentor and a mentee is a great way to learn things. There are lots of free online training,
2273160	2280500	everything from YouTube to online classes to Khan Academy. Hacker cons, you can attend or
2280500	2285820	you can volunteer. Attending is always great because you get to go to ideally all the talks
2285820	2290680	that you want to do. Hidden trick of mine is to volunteer at the cons. I've been doing it for a
2290680	2295340	long time. Particularly if you volunteer for speaker operations, you get a lot of one-on-one
2295340	2299500	time with the speakers. You get to ask questions without anybody else in the room. So that's
2299500	2306800	really, really great. For military members that are leaving, there's a program called Skill Bridge
2306800	2313000	where you can go get an internship for six months at a company. That company doesn't pay your salary.
2313080	2317400	The DOD pays your salary. So they get a free intern. You get free job experience. You get to
2317400	2321840	try out that company and decide if you really want to get hired there. So that's a great deal.
2321840	2328440	For college students and for people taking either the School of Hard Knocks or the certification
2328440	2334860	path, go get an internship, either paid or unpaid. Internships are great. Not only do they let you
2334860	2341000	gain some skills, they let you learn about the company. That lets the company learn about you.
2341000	2344840	And oftentimes you get a job, not because you submitted a resume, but because you have a
2344840	2351180	personal relationship with somebody in a company. Professional organizations, ISC Squared, ISACA,
2351180	2356640	all of those tend to have monthly meetings. Those are great. Go network. Go talk to people.
2356640	2361500	They will give presentations. If you want to know how they got to learn about what they learned,
2361500	2366400	they will tell you. Oftentimes they're happy to do that. Boot camps and lunch and learns,
2366540	2370640	a lot of organizations will offer boot camps and lunch and learns for free in some cases because
2370640	2374580	they want you to sign up for their paid classes later. But you don't have to. You can go for an
2374580	2380780	hour and learn about Network Recon or OSINT or whatever it is that they're talking about.
2380780	2387240	So lots of free resources out there. So at the end of this, what's the best solution?
2387400	2393300	It's a choose your own adventure. If you want to be a ninja, do all three paths. Do some
2393300	2398600	experimentation on your own. Go through the school of hard knocks, get some certifications,
2398600	2404960	take some college classes, get a degree, but choose a path and start on it. Journey of a
2404960	2410800	thousand steps. You have to take that first step. What you should consider is what are your goals
2410800	2414600	when you start on this journey? What is your next goal that you want to achieve? And how can you
2414600	2421500	best get there given your timeline, your finances and your goals? So there is no wrong path. There
2421500	2425260	are pros and cons to all of them. Eventually, if you want to be professional, you're going to find
2425260	2430100	out that you've done all three. And so it's really just a matter of which path do you want to start
2430100	2437340	on first? There is no wrong path. So with that, thanks so much for your time and I will be on the
2437340	2444200	discord if you have questions. Have a great day. Pablo, thank you so much for all of that. Just
2444200	2450480	sort of great overview because as you said, we tend to have this discussion and everyone camps
2450480	2458460	in my way is right or my way is right. And it really is. Everyone needs to customize their own
2458460	2465460	career path and take bits and pieces. And depending on your finances, where you are in life,
2465460	2471320	all of it. And that's what's so great about the industry is that we have so many resources.
2471320	2478860	We have so many role models. We can craft our own path. And employers are also starting to
2478860	2484200	really realize that experience over certifications. But it's going to change
2484200	2490800	depending on the employer. I really appreciate you pulling this presentation together and also
2490800	2497080	all your great comments to people's questions in discord. I want to remind everyone that we're
2497080	2504120	doing resume review and career coaching all day Friday and all Saturday afternoon. You need to
2504120	2509460	sign up in the discord channel. Pablo, thank you so much. I can't wait to be able to hug you in
2509460	2513320	person. Thanks, Kathleen. Looking forward to seeing you. Take care.