From Programming Job to Computer Security Specialist

[souleman]

But in my post I did say creat a super-user account so that you could get back in no matter if you were outside the network, or in the companies main office with the network admin beside you. Show me a script kiddie that can accomplish that???

Do they have the ability to run gcc and compile a program?
http://www.securiteam.com/exploits/6N00L1F95S.html
oh look, now any computer running Cyrus IMSP 1.4, 1.5a6, 1.6a3, and 1.7 are 0wnd.

http://packetstormsecurity.nl/0401-e...phpgedview.txt
oops, there goes any system with phpgedview.. and only need a web browser...

There are plenty more with a simple search engine. Not many companys keep all their software up to date. Not to mention how easy it would be to send a acopy of sub7 or backorafice to one of the employees and get them to install it at which point you could start learning passwords. If the endusers new enough to NOT open attachments, we wouldn't see the problems with viruses that we see now.

[cartools]

I clearly understand that it's not easy to become a security specialist. It'll take time and effort, regardless of what to become, in mastering all the concepts. I'm pretty sure that all those who contributed in these thread, did their best in the field of what they have become. The only thing that comes into my mind right now is to enjoy the technology we've achieve. It's what we do best.

[the_JinX]

the question is not how, but why..

If you want to become a security specialist becouse it makes more then an oracle expert..
then don't.. you'll never be a good security specialist..

If you want to become a security specialist becouse you have a desire to know all there is about the subject.. then you'll become one no matter wich road you take..

[cartools]

I'll take your advise jinx, thanks

[uno_digerati]

Jinx does make an excellent point Cartools and that is that the path followed is not as important as deciding to do it. If you decide to be a security expert then you will have to have a broad knowledge base, not limiting yourself to one Operating system. I started with the GIAC certification (GSEC), however I had already been Microsoft certified for several years. I am intrigued by the idea of security, not the platform it sits on, so the GSEC cert helped open that door from me to look outside the Microsoft box.

I also wanted to be in a management position, so I pursued the CISSP and I learned a great deal after I self studied for that for three months. The certification does not guarentee the job or that you are "qualified" however, given the diversity of the networks and platforms, I really doubt anyone is an "expert" until they get into the job, identify the issues, and get thier hands dirty. Pursue the knowledge and the certifications come easily.

ISC2 offers other certifications for practicing security personnel, that I have heard good things about, however, I have not personally pursued. GIAC has the best on-line programs I have seen and there are times that you can pick up used manuals from E-bay to save on the overall cost.

Look at it this way you are off to a good start, you have found a great resource to point you in the right direction. Good Luck!!!