Dive into Field of Information Security?

Question

For a fresh graduate with quite a bit of development (mainly web) background - what is the easiest way to break into the security field?

Are certifications a necessity? Is it possible to get intern jobs doing this kind of stuff?

Thanks

Answer 1

When I did this, I did it by developing a web-based security related product. In my case, a CA (Certification Authority), but there's plenty of other options out there in security topics - web interfaces are used all over the place in device management, access control, log management, intrusion detection.

As a new grad, your best bet is likely to get hands on with the code, staring with technologies you already know and gradually learning areas of the system security stuff. If you want to bone up a little, look into security aspects of web development:

• OWASP - has a great website
• SSL understand the options for setting up SSL sessions
• PKI - learn at least the basics, since this is a common mechanism for the higher end of SSL authentication
• get familiar with some of the coding libraries that support this. They vary from language to language - for Java/JEE, I mean stuff like bouncy castle, NSS, the Java security packages. Also - not related strictly to Java - Open SSL.

I wouldn't recommend certifications right after getting your degree. Your skills are up to date, and as a new grad, you are (hopefully) the cheapest in salary that you will ever be -- which makes you seductive to companies with a lot of long term, expensive security engineers.

The certifications I know of in the industry are usually targeted to having a broad systems level knowledge and are based on the concept that the certificate holder already has a number of years of experience in the field. This is hard (if not impossible) to have going right after you graduate. The people I know pursuing certifications are all in the 5+ year range.