Career Hacking Village - In Theory There Is No Difference Between Theory and Practice
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Breuer, Pablo
There are three general paths to an INFOSEC career: the school of hard knocks, certificates, and college. Every few months a flame war erupts out arguing which is the "right" path. What are the pros and cons of each of these paths? Come have a balanced conversation about the three paths and learn which is the best one for you depending upon your unique needs
 Welcome back to the career hacking village here at Defcon Safe Mode. Many times when we're talking on social media or on Discord, we're always asking what is the best career path. And several times people will say, no, this is the way, no, this is the way, no, this is the way. What we can tell you is that there are many different ways and I'm really excited to have my friend Pablo explain how he sees it and his recommendations on your career path. Take it away, Pablo. Thanks, Kathleen. So this talk is titled In Theory, There's No Difference Between Theory and Practice. And so where did this come from? First of all, it's normally attributed to Yogi Berra who dropped other pearls, like when you come to a fork and a road, take it, but this was actually not one of his. So the difference between theory and practice actually, according to Snopes, appeared first in a 1986 book about programming, the art and science of programming. So I thought it was apropos. A lot of times when we talk about how to get into infosec, we devolve into this discussion about going to college and learning theory or the school of hard knocks, learning practice. And so there's always this push and pull between theory and practice. So why are we here? As Kathleen mentioned, about every six months or so we see these kind of flame wars and discussions pop up on Twitter about how do you get into infosec? And it comes from all sides. So you have some people that believe that security is a prestige class and that you have to spend 10 or 15 years on a watch floor or on a call desk before you can join security. And you have some people saying, look, I didn't go to college. I've got a fantastic infosec career and I make a ton of money and the college kids seem really upset by that. And the truth is, there are many paths and they're all valuable. It's a matter of what you want to get into it and who you are as a person. So I thought it would be best to have a nice balanced discussion on that. So why do we even have this discussion? Why does it matter? Well, we all go through these little life transitions, right? We finish a school, be it high school or college or a trade school that we have to go out and find work. Many of us serve some time in the military and we have to figure out what we're going to do once we take the uniform off. Some of us have life changes. We get married or we have kids or something in our life changes and we decide that we want to do something else. Or sometimes our careers just go away or we decide we're just dissatisfied with our careers and we want to get into this thing called infosec. And so how do we really do that? So some disclaimers. First of all, these views are mine and mine alone. They don't belong to my employer. There's an exception to be found for absolutely everything I'm going to say. So if you try to find fault with this talk, congratulations, you will. Again, these are my opinions and what I've experienced. And those opinions are based upon my observations. But I'm also going to freely admit that I have biases, right? I took a very particular path and I've seen what I've seen and I haven't seen what I haven't seen. And so your mileage may vary. So a little bit about how my path came into infosec so that you understand kind of my latent biases. I've been doing this for a little bit. I got access to my first 8088 class computer in 1981 and then played with modems and BBSs. In the early 90s, I was a developer for expert systems. Those of you that are in AI may know what that is. In 1993, I went through a life change and I decided to join the United States Navy. Got a degree in computer science in 1998, spent some time at NSA. Got a master's degree in computer science 10 years after my bachelor's. Went back to cyber command. Then was faculty at the Navy's postgraduate school teaching master's level computer science and information sciences. Then I went to US special operations command hacker maker space called softworks. And I just finished a PhD in information sciences. Now that said, the picture is a little dated, but you might be able to make out that that's actually me with the rest of the school of root. So I have been in the community for quite a while. So with that all being said, we're going to have this discussion. Let's try not to turn it into a flame war. We can disagree, but we should be respectful about how we disagree with each other. So those of us that have been around for a really long time remember the quote unquote traditional path and infosec job. There was no cybersecurity degree when I came up and went through college. And so the running joke was that if you wanted to be a computer security expert and you could either, you know, go out and work at a soft watch floor become a forensic analyst and then the lab director and a chief security officer and 20 years later, you would be highly paid consultants or the hacker method where you became a hacker, you became a criminal, you got convicted of a crime. And two years later you were highly paid consultants, maybe 14 months with good behavior. Those days, unfortunately, or fortunately, depending on your standpoint may have gone by the wayside. So what are the contemporary paths? How do most of us get into infosec careers this year? Well, there's there's typically three paths. There's the School of Hard Knocks, there's the certification path, and then there's the college education path. And each of those come with their own pros and cons. And so we should we should discuss those a little bit. So the first one is the School of Hard Knocks. This is where you kind of teach everything to yourself. It's a very traditional path for hackers because there used to not be college classes, there used to not be a CEH or a CISSP. You had to go out and read Frack Magazine and read 2600 or go to hacker boards and teach this stuff for yourself to yourself. One of the pros is the cost. The cost is essentially free. You only learn the things that you're interested in learning, you don't have to bother with any baseline things you don't care about. It takes the least amount of time before you get to the amount of stuff before you get to the subjects that you care about. We'll come back to that least amount of time. And you get practical skills now you learn what you need to solve your problems. And so you become a practitioner immediately. And really, you're only limited by your personal drive and talent. Nobody's going to tell you that you've got to learn about X before you learn about Y. Nobody's going to tell you that you have to spend two years doing this before you go do that. You can just hop right in and do the things that you're interested in doing. So what are the cons? Well, I mentioned time, least amount of time of the three paths. Well, that depends on how you cut it. Generally speaking, there was a paper called Outliers by Malcolm Gladwell that says, in order to become an expert in any one thing, you have to spend 10,000 hours doing it. So 10,000 hours, if you break it out into eight hour workdays means 3.42 years, which sounds remarkably like a bachelor's degree, which takes about four years. And when you add summer vacation and when you add spring break, you're at four years. You can do it faster. And again, your mileage may vary. If you're a very talented, very driven person, you might be able to do it in less time. But it is still a substantial amount of time if you want to become an expert. Typically speaking, when you go through the School of Hardenomics, you're all practice and very little to no theory. And the problem with all practice is that the tools change and the tactics techniques and procedures change and the approaches change. And if you're not based in a theoretical background and you're not actively using it, those skills become very perishable. And so if you're not actively using it, you're going to lose it very quickly and you're going to have to come back and reteach yourself. Employment opportunities, boutique shops are a good opportunity for you because they're smaller and they're willing to take a chance. A lot of the boutique shops are started by rock stars in this community and they didn't take a college education in many cases. They learned through the School of Hardenox and so they understand it. Independent consultant is another one. You have to do your own business development, but you can certainly do that. You certainly can't get hired by a corporation. The challenge with getting hired with a corporation without a degree is you have to pass the HR check, the human resources check. And the problem with that is the way that the industry has moved is a lot of times, unless you get a personal introduction, you have to go through an automated resume system and it's looking for certain ticks. And if you don't check one of those ticks like maybe they require a bachelor's degree, your resume may never get seen by an actual human being. The other issue with the School of Hardenox is survivability. So when we go through hard economic times, what happens is usually there's an accountant somewhere, an executive somewhere that wants to cut cost. And the first thing they cost is they cut is high cost assets which don't have a whole lot of background. So it's easy to justify in a business sense paying somebody with an advanced degree a large sum of money because they've got a demonstrated record that the school vouches for it. That may be harder if you learn through the School of Hardenox, unless you're a name brand. If you're a name brand then that may be different. But it is something to consider. So here's a fantastic example of an absolute rock star who came up through the School of Hardenox, Frank Hyde. So Frank had started in this earlier than I did. He started with a PDP in 1979 at his home. In 1981 he emancipated and went to go work for Chase Manhattan. Never finished 10th grade. So not only does he not have a college degree, he doesn't have a high school diploma. He's one of the best read most educated people I know without any formal education because he's just a tremendously driven and intelligent individual. In 88 he went to work for the New York Transit Authority, created the emergency 911 system for MCI, went to go work for NAFSE and SWIFT PAC which are Navy entities, found a NSA penetration testing operation in 1997 and became the 10th employee at Atstake in 1999. And since then he's founded Leviathan Security which has a tremendous name in the industry and he's been a 10th speaker times three. So again no formal education, just a tremendously talented, driven individual with a curious mind. So absolutely you can do this without, without certifications and you can absolutely do this without education and here's a fine success example. So the other way is certifications. Those have come into vogue of late and we've all kind of heard the names there's your CEH and OSCP and OSCE and CISSP and what are all these things. Well the first thing to be aware of is not all these certifications are created equal and they're intended for different audiences. For better or worse if you want to work for the US government you're probably going to do much better if you have a CISSP and that's that's actually true in industry. I've got one, I've got my own thoughts on that certification as compared to other certifications but it's important for you to weigh what it is that you want to do for a living, what kind of career you want to have and see if that certification is going to help you get that job or help you become more proficient in what you want to do. Many of the certifications focus on practice with little to no theory but there's some exemptions. They're vendor motivated. Those certifications are there to make money. They want to sell you a boot camp, they want you to pay for the class, they want you to pay to take the certification and then they want you to pay fees to maintain that certification. There are lots of paths to getting these but primarily you can take a class, a boot camp or you can do online and self teaching by picking up a book. Most of these certifications have books where you can teach yourself the same things and then your certification exams are tends to be to either proctored exams which means that you go to a testing facility and they verify you are who you say you are before you take the exam and then there are online exams. One of the things that does come up and it was a problem in the past with some of the certifications is that the online exams you could actually go out and pay somebody to take the exam in your stead and get the certification. Once that's out, those certifications become less valuable in the eyes of industry. Just be aware of that. What are the pros of certifications? It's a great boot camp. If you are starting at zero and you don't know how to get going, you are going to get lots of practice in a very short amount of time. Most of these boot camps are a couple of days or maybe a week long. Some of them are a little bit longer if it's a program. You are going to go from nothing to functional a very short time. Theory may vary but typically very little theory in these. If you do a boot camp you are going to get some lead learning which means that you are going to have somebody that is a subject better expert to answer your questions. There is going to be defined progression of knowledge. If you don't know where to start or where to go next, typically these boot camps will help you out with that. The certifications, many of them will help you pass an HR check because they are familiar with the vendors, the familiar with the certifications and they are familiar with the knowledge you have to demonstrate in order to achieve those certifications. In many cases those automated resume checkers will actually tick the box if you have the right certifications that they are looking for. What you are looking out of the screen now is two courses. In the red box is one course and in the blue box is the other course. My question for you is what is the difference? I will give you a few seconds here to read it. Good. Both of these are actually courses in exploitation development. One of them is a masters level course. The other one is a course from a vendor that you take in one week. The masters level course takes 12 weeks. The vendor course takes one week. You are covering the same information. What you should think about is if you take it in 12 weeks, are you going to get a much deeper understanding and much more practice than if you take it in one week? I would suggest that, yeah, you will. If you are spending 12 weeks with the material, you are going to spend more time exploring that material and going deeper on it than if you spend one week. That doesn't mean that you are missing out on a whole lot of stuff. You have taken the one week. Just be aware that a one week boot camp is going to give you an introduction to all of these subjects. You will have to go through and spend some of your own time really studying it. What are some of the cons of certification? I went out to a well-known vendor who will remain nameless. I pulled up the cost for achieving their certification. Their one week class is $6,200. Then you have to wait a certain amount of time before you can take the certification. If you want access to their online labs after the course, it is another $729. We are up at $7,000. Then each certification attempt is $729. You are up close to $8,000. That is if you pass it the first time. For whatever reason you fail it and you have to go back and take it, you will probably need access to the labs and you will probably need to pay for another certification event. That is another $1,500 every time you fail to pass. On top of that, you will have to pay to renew this every three to four years. At $8,000, we will talk about the cost of college later, but $8,000 is a substantial amount of money. Not just compared to college, but compared to anything. $8,000 is a substantial amount of money. The other part is, as I mentioned, certification tends to be tools focused. Not always, not all certifications, but they tend to be tool focused. They are perishable. If you take a certification and you don't do that on a daily basis for your job, your skill in that set is going to deprecate. The other thing is, what do they demonstrate? There is this ongoing discussion that always happens about does that demonstrate knowledge or does that demonstrate your ability to take an exam? Other people have their own biases on this. I absolutely know people that could not pass a certification exam that absolutely had mastery of the material. They just couldn't take a test. I have also seen it the other way, where somebody passes the test and they clearly knew nothing about the material. There is really a discussion there that happens and hiring managers will think about this, about does the certification really demonstrate that you know what I need you to know? Let's talk about college. I know that this is a very personal subject for a lot of people. Not all schools and all programs are created equally. If you go and get a computer science from a degree from MIT, it's going to be very different than if you go to a computer science from maybe a community college or from University of Phoenix or some other schools. Take a look at what the reputation is not just of the school but of that particular program in that school. Most of you have never probably heard of University of Texas Dallas. They happen to have one of the top ranked schools for computer science in the country. University of California, Santa Barbara has one of the top ranked schools for cybersecurity based computer science. Really take a look at the programs, take a look at the schools and realize that they're not all created equal. Most of the colleges will focus on theory with varying levels of practice. Again, that is a question that you should ask when you're considering a school and a program. How much is this theory and how much of this is practice? Then the other question you want to ask is do I want to just study? Do I want to become a full-time college student or do I want to work and study? Some of us, we're not going to have that option. Our life situations are such that we've got people that depend on us, we've got dependents, and so we're going to have to work and study. That's okay, but for those of us that have the choice, we've got to balance possibly taking larger loans out to concentrate on our studies, vice taking smaller loans out and working and studying, and that's very much a personal choice. Job placement. If you're going to go to a college, you should find out if they're going to help you get a job afterwards. College degrees are not cheap. They're very expensive, and so getting the degree shouldn't be where your college stops. If your college or university should help you with job placement afterwards. Then there's a value proposition versus cost. Getting a college degree in something that is not marketable is a personal choice. Really, if you want to work in Infosec, that history degree may or may not help you, and we'll talk more about unrelated degrees either, but if you know you want to work in Infosec, perhaps you want to consider cybersecurity or an IT or a computer science degree. But there are other degree paths. You can either get an unrelated degree and get into Infosec, or you can get a related degree and get into Infosec, and those have their own pros and cons. I'll show you an example of somebody that has an unrelated degree and has a fantastic Infosec career. The pros of colleges is that all industries and all companies recognize bachelor's degrees and master's degrees and PhDs. They're resilient. They tend to be theory focused, which moves at a much slower pace than practice. The tools change the theory very rarely does, but if you've got a degree in that field, you're going to get that HR pass. If they're looking for a bachelor's degree, I'm not aware of somebody that says, well, you've got a bachelor's degree, but it's not the right bachelor's degree and therefore we're not going to take you. Job survivability, I talked about when we hit hard economic times. The people with degrees that are working in a field with their degree tend to be more survivable than the people that don't have degrees that are working in a field. Right, wrong, or otherwise, it's just kind of how it happens. It's a non-perishable skill. Right, again, I talked about the 10,000 hours become an expert, 3.42 years. That's roughly the amount of class time that you're going to spend getting a bachelor's degree. Writing. Writing is absolutely critical. I'll talk more about that. You're going to spend a lot of time writing in college. You can be the best penetration tester in the world, but you have to be able to communicate your findings and writing. And if you can't do that, you're probably not going to be hired back. Non-related courses. Is that actually a benefit? I actually believe it is. It's easy for us to learn things that we're interested in within our chosen major. It is much harder to pay attention, learn things that we're not familiar with and we're not good at. But learning is like anything else. The more you practice at learning, the better you become at learning. And so as you're asked to learn new things throughout your career, it actually becomes easier to learn things if the more you've practiced it. And then cost. It may or may not be a pro. Again, that depends on how you choose to fund your college education. If you use grants and scholarships, then cost is probably not prohibitive. But you also have to make some lifestyle choices about how you want to live while you're going through college. Otherwise, you're going to end up racking up a lot of debt. That may or may not be a good value proposition. So writing in unrelated courses. Writing is absolutely critical for success. That's not just me saying that's Lenny's ulcer. Lenny's ulcer among various and sundry other things is a fantastic Sands instructor. And he teaches the reverse engineer malware. And he says, listen, if you want to excel in information security, you've got to have strong writing skills. Often these things are ignored. Many of us don't like to write. I am not a fan of writing. I'm not going to sit there and practice writing. I don't do short stories or any of those things. Lots of people do and I envy them. It is something that I've had to work very hard at. Most of us in this field tend to ignore writing because we're more interested in the technical skills. But just like technical skills, writing requires practice. And so if you go to college and you're forced to take unrelated classes, you're going to be forced to practice writing. And it's one of those things that if you're not going to do it on your own, you need to find somebody that's going to force you to do it. This may help you do it. The other thing is that understanding other fields helps you explain things. Very rarely are we going to do info sec for the sake of info sec. Normally we're going to do info sec for the sake of a company that company's mission may not be info sec. It may be a bank. It may be an educational institution. It may be an engineering institution. And if you can't understand what it is that that company does, you're probably not going to be able to communicate very well why they should be concerned about info sec. So what are the cons? Well, cost, right? You have to be cognizant of the financial cost of college. College is definitely not cheap. You have to think, make some choices about how you're going to live. You have to discuss, think about the applicability. Unrelated courses are going to be required. Listen, any degree that you get, you're going to have to take English composition and you're probably going to have to take history and you're probably going to have to take college math. It's something we all kind of suffer through. But you're just going to have to do that. The baseline related courses are good because that's where you get your introduction to theory. But they tend to be not very exciting. For those of us that love this stuff, we already kind of know how to program in Python, right? We don't really need an intro to Python class, but the college is going to probably require that if you're taking computer science. And so you're just going to have to suffer through it. One of the criticisms is that college is not practical. They tend to be a little bit behind. And that's true in many programs. They're not keeping up with the latest and greatest because they're not trying to teach you practice. In many cases, they're trying to teach you theory, which moves at a much lower pace. The other problem is time. College requires a significant time investment. Even if you're a full-time student, it's probably going to take you three or four years to finish a bachelor's. A master's is going to take you even if you're a full-time student, probably two years. So let's talk a little bit about the cost. This is the average cost as pulled from an independent journalist for a university. So a public two-year in-district is $3,400. A public four-year is $9,000. Now, if you remember a few slides ago, we talked about certifications. And a one-week class in a certification attempt was $8,000. So for $1,000 more, you get to spend an entire year at a university becoming a dedicated learner. So what's the value proposition there? If you're going to go to an out-of-state school, yeah, it's going to be a lot more expensive, right? You're looking at on average $24,000. And if you go to a private university, you're looking at $32,000. So these are all things to keep in mind. Maybe the best option is not to move far away from home unless you're chasing a particular school in a particular program because they really teach the things exactly that you want to learn or they have good insight in the industry that you want to go. If you want to work in Silicon Valley, absolutely go to a University of California school, right? Because they're there and they have established relationships. But these are just the cost for tuition and fees. These don't include things like your living expenses. They don't include things like your meal plans. And they don't include things like your books. Let's have a little bit of a discussion about reducing cost. This is a mock-up of my dorm room. Actually, that's not quite true. This is a mock-up of the dorm room after they remodeled it after I graduated. It looks pretty much like a prison. I lived a very smart lifestyle, but because I did that, I incurred very little. Actually, in my case, I incurred no cost. But if you want to have a really nice apartment and you're a full-time student and you're not working, recognize that your lifestyle is going to go on your student goals. And so that's going to drive up your cost. And so while I fully recognize that college is expensive, I often question when people say, well, I've got $100,000 of debt for going to school. And I ask if they lived in a dorm and they show me pictures of this fully laid out apartment with giant screen TVs. Delayed gratification is a thing. If you don't want to incur a lot of cost while you're in college, you may want to cut back your living expenses a little bit. So, comments of college, the applicability, you're going to be taking a lot of unrelated courses. You're still going to have to pay for those courses. Again, they're tangentially related. Practice varies. Not all programs provide you the same amount of practice. And not all schools are the same. Contact hours with your professors and your instructors matter. Faculty that have been in the real world and really are subject matter experts matter. One of the things I will tell you is you are going to meet a lot of faculty members at some schools that have never been in the real world. They've spent their entire life in academia. And so their view of industry and what's needed to succeed in the industry is going to be very different than someone who has spent some time in the industry doing it. Usually you get good, faster, cheap choose two with universities and college education. It's normally choose one. There are some that are good and cheap. That's rare. You really have to be lucky enough to be living close to a school that has a good program. But they're definitely not fast. If it's fast, there are some schools out there that are online and they will tell you that you can get a master's degree in one year. It's probably not going to be cheap and it's probably not going to be good. Let's be honest about that. So go into it with your eyes open. The other thing that you see is a lot of schools are going to advertise that they're NSA academic centers of excellence. I will tell you having taken two schools through that certification program that that certification is absolutely worthless. It is not that hard to get accredited as an NSA academic center of excellence. And it's a paperwork drill. They will the NSA ask schools to make sure that they teach certain things. And if they have one slide on one course that mentions that subject, then they get to claim that they taught it. That is really not what what NSA and cyber command were after. So I would not really consider that academic center of excellence certification for a school is worthwhile. Don't don't buy that. So another cons the applicability. I used to teach not just at the graduate level but at the undergraduate level and I happen to teach one of the last classes that my undergraduates took before they graduated. And many, many, many of my students would come to me and go, hey, listen, you know, Professor Brewer loved your class. It was great. I'm about to graduate with a degree bachelor's degree in computer science. I don't feel qualified to do anything. Congratulations. You're not alone. We all feel that way. If you spend any time in info sec, you're just going to get used to the imposter syndrome. I still have it. Many of the people up on stage today are still going to have it. But what you need to realize is that having a degree doesn't demonstrate that you're an expert in something. A bachelor's degree demonstrates that you're capable of being taught and learning new things. And so your employers know that because you've got a bachelor's degree in computer science, they don't expect you to hop in and be an expert program. They expect that when they stick you with a more seasoned senior programmer that they're going to be able to teach you the things that you need to do to accomplish your job there. A master's degree doesn't mean that you're a master of your trade. It absolutely does not. What it means is that you're capable of teaching yourself. If you don't know something and you're asked to do it, you're capable of going out and finding resources and teaching yourself. And a PhD absolutely doesn't mean that you're an expert in anything. What it means is that you're capable of conducting independent scientific research. So a lot of people do ask me because I've just got one, should I get a PhD? And my answer to this is you should only get a PhD for three reasons. The first one is if you want to work in academia, if you want to be a university professor, absolutely go get a PhD. There's a hard cast system in there about tenure track PhDs and non-tenure track PhDs and then lectures. The other reason is if you want to do research, professional research for your career, go get a PhD. And the last reason to get a PhD, which was my reason was I just wanted one. Does it really help your career? It's arguable, I would say most cases the juice is probably not worth the squeeze on that one. It was just a personal goal I'd set for myself for reasons that, well, I'm just not going to get into, but just be aware of what those degrees are supposed to demonstrate. None of these demonstrate that you're an expert. So unrelated degrees, everybody needs InfoSec, right? It doesn't matter if you're a book publisher, if you're a bank, if you're a manufacturer, if you run industrial plants, all these things right now run on IoT and computers. And so they all need InfoSec. And taking these unrelated courses helps you learn the language of non- InfoSec people. If you're an InfoSec person and you go talk to your boss at a bank about IP addresses and ROP, and they're just going to run you out of the room, they pay you good money so they don't have to hear that language. They want to know, you know, what do I gain? What do I lose? What does it cost? And why do I care? So you're going to have to translate the geek speak and the InfoSec to business processes and thought processes of executives. Baseline courses, regardless of degree, are going to be the same. It doesn't matter if you're going to get a bachelor's in history, a bachelor's in women's studies, a bachelor's in computer science, or a bachelor's in electrical engineering, you're all going to have to take college math, you're all going to have to take English composition. Those baseline courses are the same and they're meant to be a good foundation for the rest of your learning. I mentioned writing practice. You're going to need a lot of writing practice regardless of your degree. That writing is important. It's actually critical, I would say, in many cases, it's at least as critical, if not more critical than your technical knowledge. But if you're going to get an unrelated degree and you want to work at InfoSec, at some point you're going to have to come back and either get some training or some education on the tech side. You can't just hop in from a history degree and decide that you're going to be an InfoSec analyst without going back and actually understanding what some of the InfoSec language means and understanding something about how computers and networks work. Here's a fantastic example of somebody that's successful with an unrelated degree. Tracy Malief, many of you know her, InfoSec Sherpa. She's got a bachelor's in history and she's got a master's in library sciences. She spent 10 years working as a librarian, then was a cyber analyst at Glasgow Smith Klein, got her first InfoSec certification in 2017 and in 2019 she became an InfoSec analyst for New York Times. So library sciences doesn't seem like it's a related degree. However, what it taught her to do was how to do research very, very well. She's certainly a much better researcher than I am and it taught her how to write exceedingly well. And because of that she's been tremendously successful not only in the hacker community but as a professional InfoSec analyst. So absolutely, all degrees are valuable and you certainly can work in InfoSec if you have an unrelated degree. So Emanuel Kant said that experience without theory is blind but theory without experience is mere intellectual play and it's true. You need both. You need a little bit of theory and you need a little bit of experience and practical knowledge if you want to be successful. Otherwise you're really just a one-sided professional. So you need a bit of both. So great. I've got more questions about this. Where can I go for learning and networking resources? Well congratulations. If you're listening to this you're already doing that. DEF CON and hacker conferences and hacker collectives are great insight. It's a great place to meet people that may be doing things that you're interested in or that have good and bad experiences to share with you on their path. Maker spaces. There are maker spaces throughout the country and throughout the world. Lots of professionals have a passion for InfoSec and what they do that are willing to share their experiences and share their knowledge for little or no cost. Capture the flag exercises are great. One of the things I often hear is I don't feel like I know enough to do capture the flag exercises. That's great. If you knew how to do the capture the flag exercise it wouldn't be fun. So what I would say is go out there and try it and figure out what you can figure out and what you can't figure out. Go back a week later what you're going to see is that the teams that did well did write-ups on how to solve the challenges and that's going to give you insight into not only how to solve the challenges but subjects that you may want to go back and learn more on. Mentors and mentees. Everybody needs a mentor. I've got several and I learn a lot from my mentors. Here's a hidden trick though. I learned far more from my mentees than I learned from my mentors. They often ask me questions that I go, you know what I actually have no idea and I have to go back and research it and I have to learn it well enough to explain it to my mentee. So both being a mentor and a mentee is a great way to learn things. There are lots of free online training everything from YouTube to online classes to Khan Academy. Hacker cons, you can attend or you can volunteer. Attending is always great because you get to go to ideally all the talks that you want to do. Hidden trick of mine is to volunteer at the cons. I've been doing it for a long time, particularly if you volunteer for speaker operations. You get a lot of one-on-one time with the speakers. You get to ask questions without anybody else in the room so that's really really great. For military members that are leaving there's a program called Skill Bridge where you can go get an internship for six months at a company. That company doesn't pay your salary. The DOD pays your salary so they get a free intern. You get free job experience. You get to try out that company and decide if you really want to get hired there. So that's a great deal. For college students and for people taking either at the School of Hard Knocks or the certification path, go get an internship either paid or unpaid. Internships are great. Not only do they let you gain some skills, they get let you learn about the company that lets the company learn about you and oftentimes you get a job not because you submitted a resume but because you have a personal relationship with somebody in a company. Professional organizations, ISC Square, ISACA, all of those tend to have monthly meetings. Those are great. Go network, go talk to people. They will give presentations. If you want to know how they got to learn about what they learned, they will tell you. Oftentimes they're happy to do that. Boot camps and lunch and learns, a lot of organizations will offer boot camps and lunch and learns for free in some cases because they want you to sign up for their paid classes later but you don't have to. You can go for an hour and learn about Network Recon or OSINT or whatever it is that they're talking about. So lots of free resources out there. So at the end of this, what's the best solution? It's to choose your own adventure. If you want to be a ninja, do all three pass. Do some experimentation on your own. Go through the school of hard knocks, get some certifications, take some college classes, get a degree but choose a path and start on it. Journey to a thousand steps. You have to take that first step. What you should consider is what are your goals? When you start on this journey, what is your next goal that you want to achieve and how can you best get there given your timeline, your finances and your goals? So there is no wrong path. There are pros and cons to all of them. Eventually if you want to be professional, you're going to find out that you've done all three and so it's really just a matter of which path you want to start on first. There is no wrong path. So with that, thanks so much for your time and I will be on the Discord if you have questions. Have a great day. Pablo, thank you so much for all of that. Just sort of great overview because as you said, we tend to have this discussion and everyone camps in my way is right or my way is right and it really is. Everyone needs to customize their own career path and take bits and pieces and depending on your finances and where you are in life, all of it and that's what's so great about the industry is that we have so many resources. We have so many role models. We can craft our own path and employers are also starting to really realize that experience over certifications but it's going to change depending on the employer. I really appreciate you pulling this presentation together and also all your great comments to people's questions and Discord. I want to remind everyone that we're doing resume review and career coaching all day Friday and all Saturday afternoon. You need to sign up in the Discord channel. Pablo, thank you so much. I can't wait to be able to hug you in person. Thanks Kathleen. Looking forward to seeing you. Take care.
 Welcome back to the career hacking village here at Defcon Safe Mode. Many times when  we're talking on social media or on Discord, we're always asking what is the best career  path. And several times people will say, no, this is the way, no, this is the way, no,  this is the way. What we can tell you is that there are many different ways and I'm really  excited to have my friend Pablo explain how he sees it and his recommendations on your  career path. Take it away, Pablo.  Thanks, Kathleen. So this talk is titled In Theory, There's No Difference Between Theory  and Practice. And so where did this come from? First of all, it's normally attributed to  Yogi Berra who dropped other pearls, like when you come to a fork and a road, take it, but  this was actually not one of his. So the difference between theory and practice actually,  according to Snopes, appeared first in a 1986 book about programming, the art and science  of programming. So I thought it was apropos. A lot of times when we talk about how to get  into infosec, we devolve into this discussion about going to college and learning theory  or the school of hard knocks, learning practice. And so there's always this push and pull between  theory and practice. So why are we here? As Kathleen mentioned, about every six months  or so we see these kind of flame wars and discussions pop up on Twitter about how do  you get into infosec? And it comes from all sides. So you have some people that believe  that security is a prestige class and that you have to spend 10 or 15 years on a watch  floor or on a call desk before you can join security. And you have some people saying,  look, I didn't go to college. I've got a fantastic infosec career and I make a ton of money and  the college kids seem really upset by that. And the truth is, there are many paths and  they're all valuable. It's a matter of what you want to get into it and who you are as  a person. So I thought it would be best to have a nice balanced discussion on that.  So why do we even have this discussion? Why does it matter? Well, we all go through these  little life transitions, right? We finish a school, be it high school or college or  a trade school that we have to go out and find work. Many of us serve some time in the  military and we have to figure out what we're going to do once we take the uniform off.  Some of us have life changes. We get married or we have kids or something in our life changes  and we decide that we want to do something else. Or sometimes our careers just go away  or we decide we're just dissatisfied with our careers and we want to get into this thing  called infosec. And so how do we really do that?  So some disclaimers. First of all, these views are mine and mine alone. They don't belong  to my employer. There's an exception to be found for absolutely everything I'm going  to say. So if you try to find fault with this talk, congratulations, you will. Again, these  are my opinions and what I've experienced. And those opinions are based upon my observations.  But I'm also going to freely admit that I have biases, right? I took a very particular  path and I've seen what I've seen and I haven't seen what I haven't seen. And so your mileage  may vary. So a little bit about how my path came into  infosec so that you understand kind of my latent biases. I've been doing this for a  little bit. I got access to my first 8088 class computer in 1981 and then played with  modems and BBSs. In the early 90s, I was a developer for expert systems. Those of you  that are in AI may know what that is. In 1993, I went through a life change and I decided  to join the United States Navy. Got a degree in computer science in 1998, spent some time  at NSA. Got a master's degree in computer science 10 years after my bachelor's. Went  back to cyber command. Then was faculty at the Navy's postgraduate school teaching master's  level computer science and information sciences. Then I went to US special operations command  hacker maker space called softworks. And I just finished a PhD in information sciences.  Now that said, the picture is a little dated, but you might be able to make out that that's  actually me with the rest of the school of root. So I have been in the community for  quite a while. So with that all being said, we're going to have this discussion. Let's  try not to turn it into a flame war. We can disagree, but we should be respectful about  how we disagree with each other. So those of us that have been around for a really long  time remember the quote unquote traditional path and infosec job. There was no cybersecurity  degree when I came up and went through college. And so the running joke was that if you wanted  to be a computer security expert and you could either, you know, go out and work at a soft  watch floor become a forensic analyst and then the lab director and a chief security  officer and 20 years later, you would be highly paid consultants or the hacker method where  you became a hacker, you became a criminal, you got convicted of a crime. And two years  later you were highly paid consultants, maybe 14 months with good behavior. Those days,  unfortunately, or fortunately, depending on your standpoint may have gone by the wayside.  So what are the contemporary paths? How do most of us get into infosec careers this year?  Well, there's there's typically three paths. There's the School of Hard Knocks, there's  the certification path, and then there's the college education path. And each of those  come with their own pros and cons. And so we should we should discuss those a little  bit. So the first one is the School of Hard Knocks. This is where you kind of teach everything  to yourself. It's a very traditional path for hackers because there used to not be  college classes, there used to not be a CEH or a CISSP. You had to go out and read Frack  Magazine and read 2600 or go to hacker boards and teach this stuff for yourself to yourself.  One of the pros is the cost. The cost is essentially free. You only learn the things that you're  interested in learning, you don't have to bother with any baseline things you don't care about.  It takes the least amount of time before you get to the amount of stuff before you get  to the subjects that you care about. We'll come back to that least amount of time. And  you get practical skills now you learn what you need to solve your problems. And so you  become a practitioner immediately. And really, you're only limited by your personal drive  and talent. Nobody's going to tell you that you've got to learn about X before you learn  about Y. Nobody's going to tell you that you have to spend two years doing this before  you go do that. You can just hop right in and do the things that you're interested in  doing. So what are the cons? Well, I mentioned time, least amount of time of the three paths.  Well, that depends on how you cut it. Generally speaking, there was a paper called Outliers  by Malcolm Gladwell that says, in order to become an expert in any one thing, you have  to spend 10,000 hours doing it. So 10,000 hours, if you break it out into eight hour  workdays means 3.42 years, which sounds remarkably like a bachelor's degree, which takes about  four years. And when you add summer vacation and when you add spring break, you're at four  years. You can do it faster. And again, your mileage may vary. If you're a very talented,  very driven person, you might be able to do it in less time. But it is still a substantial  amount of time if you want to become an expert. Typically speaking, when you go through the  School of Hardenomics, you're all practice and very little to no theory. And the problem  with all practice is that the tools change and the tactics techniques and procedures  change and the approaches change. And if you're not based in a theoretical background and  you're not actively using it, those skills become very perishable. And so if you're not  actively using it, you're going to lose it very quickly and you're going to have to come  back and reteach yourself. Employment opportunities, boutique shops are a good opportunity for  you because they're smaller and they're willing to take a chance. A lot of the boutique shops  are started by rock stars in this community and they didn't take a college education in  many cases. They learned through the School of Hardenox and so they understand it. Independent  consultant is another one. You have to do your own business development, but you can  certainly do that. You certainly can't get hired by a corporation. The challenge with  getting hired with a corporation without a degree is you have to pass the HR check, the  human resources check. And the problem with that is the way that the industry has moved  is a lot of times, unless you get a personal introduction, you have to go through an automated  resume system and it's looking for certain ticks. And if you don't check one of those  ticks like maybe they require a bachelor's degree, your resume may never get seen by an  actual human being. The other issue with the School of Hardenox is survivability. So when  we go through hard economic times, what happens is usually there's an accountant somewhere,  an executive somewhere that wants to cut cost. And the first thing they cost is they cut  is high cost assets which don't have a whole lot of background. So it's easy to justify  in a business sense paying somebody with an advanced degree a large sum of money because  they've got a demonstrated record that the school vouches for it. That may be harder  if you learn through the School of Hardenox, unless you're a name brand. If you're a name  brand then that may be different. But it is something to consider. So here's a fantastic  example of an absolute rock star who came up through the School of Hardenox, Frank Hyde.  So Frank had started in this earlier than I did. He started with a PDP in 1979 at his  home. In 1981 he emancipated and went to go work for Chase Manhattan. Never finished  10th grade. So not only does he not have a college degree, he doesn't have a high school  diploma. He's one of the best read most educated people I know without any formal education  because he's just a tremendously driven and intelligent individual. In 88 he went to work  for the New York Transit Authority, created the emergency 911 system for MCI, went to  go work for NAFSE and SWIFT PAC which are Navy entities, found a NSA penetration testing  operation in 1997 and became the 10th employee at Atstake in 1999. And since then he's founded  Leviathan Security which has a tremendous name in the industry and he's been a 10th  speaker times three. So again no formal education, just a tremendously talented, driven individual  with a curious mind. So absolutely you can do this without, without certifications and  you can absolutely do this without education and here's a fine success example.  So the other way is certifications. Those have come into vogue of late and we've all kind  of heard the names there's your CEH and OSCP and OSCE and CISSP and what are all these  things. Well the first thing to be aware of is not all these certifications are created  equal and they're intended for different audiences. For better or worse if you want to work for  the US government you're probably going to do much better if you have a CISSP and that's  that's actually true in industry. I've got one, I've got my own thoughts on that certification  as compared to other certifications but it's important for you to weigh what it is that  you want to do for a living, what kind of career you want to have and see if that certification  is going to help you get that job or help you become more proficient in what you want  to do. Many of the certifications focus on practice with little to no theory but there's  some exemptions. They're vendor motivated. Those certifications are there to make money.  They want to sell you a boot camp, they want you to pay for the class, they want you to  pay to take the certification and then they want you to pay fees to maintain that certification.  There are lots of paths to getting these but primarily you can take a class, a boot camp  or you can do online and self teaching by picking up a book. Most of these certifications  have books where you can teach yourself the same things and then your certification exams  are tends to be to either proctored exams which means that you go to a testing facility  and they verify you are who you say you are before you take the exam and then there are  online exams. One of the things that does come up and it was a problem in the past with  some of the certifications is that the online exams you could actually go out and pay somebody  to take the exam in your stead and get the certification. Once that's out, those certifications  become less valuable in the eyes of industry. Just be aware of that. What are the pros  of certifications? It's a great boot camp. If you are starting at zero and you don't  know how to get going, you are going to get lots of practice in a very short amount of  time. Most of these boot camps are a couple of days or maybe a week long. Some of them  are a little bit longer if it's a program. You are going to go from nothing to functional  a very short time. Theory may vary but typically very little theory in these. If you do a boot  camp you are going to get some lead learning which means that you are going to have somebody  that is a subject better expert to answer your questions. There is going to be defined  progression of knowledge. If you don't know where to start or where to go next, typically  these boot camps will help you out with that. The certifications, many of them will help  you pass an HR check because they are familiar with the vendors, the familiar with the certifications  and they are familiar with the knowledge you have to demonstrate in order to achieve those  certifications. In many cases those automated resume checkers will actually tick the box  if you have the right certifications that they are looking for. What you are looking  out of the screen now is two courses. In the red box is one course and in the blue box  is the other course. My question for you is what is the difference? I will give you a  few seconds here to read it. Good. Both of these are actually courses in exploitation  development. One of them is a masters level course. The other one is a course from a vendor  that you take in one week. The masters level course takes 12 weeks. The vendor course takes  one week. You are covering the same information. What you should think about is if you take  it in 12 weeks, are you going to get a much deeper understanding and much more practice  than if you take it in one week? I would suggest that, yeah, you will. If you are spending  12 weeks with the material, you are going to spend more time exploring that material  and going deeper on it than if you spend one week. That doesn't mean that you are missing  out on a whole lot of stuff. You have taken the one week. Just be aware that a one week  boot camp is going to give you an introduction to all of these subjects. You will have to  go through and spend some of your own time really studying it. What are some of the cons  of certification? I went out to a well-known vendor who will remain nameless. I pulled  up the cost for achieving their certification. Their one week class is $6,200. Then you have  to wait a certain amount of time before you can take the certification. If you want access  to their online labs after the course, it is another $729. We are up at $7,000. Then each  certification attempt is $729. You are up close to $8,000. That is if you pass it the  first time. For whatever reason you fail it and you have to go back and take it, you  will probably need access to the labs and you will probably need to pay for another certification  event. That is another $1,500 every time you fail to pass. On top of that, you will have  to pay to renew this every three to four years. At $8,000, we will talk about the cost of  college later, but $8,000 is a substantial amount of money. Not just compared to college,  but compared to anything. $8,000 is a substantial amount of money. The other part is, as I mentioned,  certification tends to be tools focused. Not always, not all certifications, but they tend  to be tool focused. They are perishable. If you take a certification and you don't do  that on a daily basis for your job, your skill in that set is going to deprecate. The other  thing is, what do they demonstrate? There is this ongoing discussion that always happens  about does that demonstrate knowledge or does that demonstrate your ability to take an exam?  Other people have their own biases on this. I absolutely know people that could not pass  a certification exam that absolutely had mastery of the material. They just couldn't take a  test. I have also seen it the other way, where somebody passes the test and they clearly  knew nothing about the material. There is really a discussion there that happens and  hiring managers will think about this, about does the certification really demonstrate  that you know what I need you to know? Let's talk about college. I know that this  is a very personal subject for a lot of people. Not all schools and all programs are created  equally. If you go and get a computer science from a degree from MIT, it's going to be very  different than if you go to a computer science from maybe a community college or from University  of Phoenix or some other schools. Take a look at what the reputation is not just of the  school but of that particular program in that school. Most of you have never probably heard  of University of Texas Dallas. They happen to have one of the top ranked schools for  computer science in the country. University of California, Santa Barbara has one of the  top ranked schools for cybersecurity based computer science. Really take a look at the  programs, take a look at the schools and realize that they're not all created equal. Most of  the colleges will focus on theory with varying levels of practice. Again, that is a question  that you should ask when you're considering a school and a program. How much is this theory  and how much of this is practice? Then the other question you want to ask is do I want  to just study? Do I want to become a full-time college student or do I want to work and study?  Some of us, we're not going to have that option. Our life situations are such that we've got  people that depend on us, we've got dependents, and so we're going to have to work and study.  That's okay, but for those of us that have the choice, we've got to balance possibly taking  larger loans out to concentrate on our studies, vice taking smaller loans out and working and  studying, and that's very much a personal choice. Job placement. If you're going to go to a  college, you should find out if they're going to help you get a job afterwards. College  degrees are not cheap. They're very expensive, and so getting the degree shouldn't be where  your college stops. If your college or university should help you with job placement afterwards.  Then there's a value proposition versus cost. Getting a college degree in something that  is not marketable is a personal choice. Really, if you want to work in Infosec, that history  degree may or may not help you, and we'll talk more about unrelated degrees either, but  if you know you want to work in Infosec, perhaps you want to consider cybersecurity or an IT  or a computer science degree. But there are other degree paths. You can either get an  unrelated degree and get into Infosec, or you can get a related degree and get into Infosec,  and those have their own pros and cons. I'll show you an example of somebody that has an  unrelated degree and has a fantastic Infosec career. The pros of colleges is that all industries  and all companies recognize bachelor's degrees and master's degrees and PhDs. They're resilient.  They tend to be theory focused, which moves at a much slower pace than practice. The tools  change the theory very rarely does, but if you've got a degree in that field, you're  going to get that HR pass. If they're looking for a bachelor's degree, I'm not aware of  somebody that says, well, you've got a bachelor's degree, but it's not the right bachelor's  degree and therefore we're not going to take you. Job survivability, I talked about when  we hit hard economic times. The people with degrees that are working in a field with their  degree tend to be more survivable than the people that don't have degrees that are working  in a field. Right, wrong, or otherwise, it's just kind of how it happens. It's a non-perishable  skill. Right, again, I talked about the 10,000 hours become an expert, 3.42 years. That's  roughly the amount of class time that you're going to spend getting a bachelor's degree.  Writing. Writing is absolutely critical. I'll talk more about that. You're going to spend  a lot of time writing in college. You can be the best penetration tester in the world,  but you have to be able to communicate your findings and writing. And if you can't do  that, you're probably not going to be hired back. Non-related courses. Is that actually  a benefit? I actually believe it is. It's easy for us to learn things that we're interested  in within our chosen major. It is much harder to pay attention, learn things that we're  not familiar with and we're not good at. But learning is like anything else. The more you  practice at learning, the better you become at learning. And so as you're asked to learn  new things throughout your career, it actually becomes easier to learn things if the more  you've practiced it. And then cost. It may or may not be a pro. Again, that depends on  how you choose to fund your college education. If you use grants and scholarships, then cost  is probably not prohibitive. But you also have to make some lifestyle choices about  how you want to live while you're going through college. Otherwise, you're going to end up  racking up a lot of debt. That may or may not be a good value proposition.  So writing in unrelated courses. Writing is absolutely critical for success. That's not  just me saying that's Lenny's ulcer. Lenny's ulcer among various and sundry other things  is a fantastic Sands instructor. And he teaches the reverse engineer malware. And he says,  listen, if you want to excel in information security, you've got to have strong writing  skills. Often these things are ignored. Many of us don't like to write. I am not a fan  of writing. I'm not going to sit there and practice writing. I don't do short stories  or any of those things. Lots of people do and I envy them. It is something that I've  had to work very hard at. Most of us in this field tend to ignore writing because we're  more interested in the technical skills. But just like technical skills, writing requires  practice. And so if you go to college and you're forced to take unrelated classes, you're going  to be forced to practice writing. And it's one of those things that if you're not going  to do it on your own, you need to find somebody that's going to force you to do it. This may  help you do it. The other thing is that understanding other fields helps you explain things. Very  rarely are we going to do info sec for the sake of info sec. Normally we're going to  do info sec for the sake of a company that company's mission may not be info sec. It  may be a bank. It may be an educational institution. It may be an engineering institution. And  if you can't understand what it is that that company does, you're probably not going to  be able to communicate very well why they should be concerned about info sec.  So what are the cons? Well, cost, right? You have to be cognizant of the financial cost  of college. College is definitely not cheap. You have to think, make some choices about  how you're going to live. You have to discuss, think about the applicability. Unrelated  courses are going to be required. Listen, any degree that you get, you're going to have  to take English composition and you're probably going to have to take history and you're probably  going to have to take college math. It's something we all kind of suffer through. But you're  just going to have to do that. The baseline related courses are good because that's where  you get your introduction to theory. But they tend to be not very exciting. For those of  us that love this stuff, we already kind of know how to program in Python, right? We  don't really need an intro to Python class, but the college is going to probably require  that if you're taking computer science. And so you're just going to have to suffer through  it. One of the criticisms is that college is not practical. They tend to be a little  bit behind. And that's true in many programs. They're not keeping up with the latest and  greatest because they're not trying to teach you practice. In many cases, they're trying  to teach you theory, which moves at a much lower pace. The other problem is time. College  requires a significant time investment. Even if you're a full-time student, it's probably  going to take you three or four years to finish a bachelor's. A master's is going to take  you even if you're a full-time student, probably two years. So let's talk a little bit about  the cost. This is the average cost as pulled from an independent journalist for a university.  So a public two-year in-district is $3,400. A public four-year is $9,000. Now, if you  remember a few slides ago, we talked about certifications. And a one-week class in a  certification attempt was $8,000. So for $1,000 more, you get to spend an entire year at a  university becoming a dedicated learner. So what's the value proposition there? If you're  going to go to an out-of-state school, yeah, it's going to be a lot more expensive, right?  You're looking at on average $24,000. And if you go to a private university, you're looking  at $32,000. So these are all things to keep in mind. Maybe the best option is not to move far away  from home unless you're chasing a particular school in a particular program because they really  teach the things exactly that you want to learn or they have good insight in the industry that you  want to go. If you want to work in Silicon Valley, absolutely go to a University of California school,  right? Because they're there and they have established relationships.  But these are just the cost for tuition and fees. These don't include things like your living expenses.  They don't include things like your meal plans. And they don't include things like your books.  Let's have a little bit of a discussion about reducing cost. This is a mock-up of my dorm room.  Actually, that's not quite true. This is a mock-up of the dorm room after they remodeled it  after I graduated. It looks pretty much like a prison. I lived a very smart lifestyle,  but because I did that, I incurred very little. Actually, in my case, I incurred no cost. But if  you want to have a really nice apartment and you're a full-time student and you're not working,  recognize that your lifestyle is going to go on your student goals. And so that's going to drive  up your cost. And so while I fully recognize that college is expensive, I often question when  people say, well, I've got $100,000 of debt for going to school. And I ask if they lived in a  dorm and they show me pictures of this fully laid out apartment with giant screen TVs.  Delayed gratification is a thing. If you don't want to incur a lot of cost while you're in college,  you may want to cut back your living expenses a little bit.  So, comments of college, the applicability, you're going to be taking a lot of unrelated courses.  You're still going to have to pay for those courses. Again, they're tangentially related.  Practice varies. Not all programs provide you the same amount of practice. And not all schools  are the same. Contact hours with your professors and your instructors matter. Faculty that have been  in the real world and really are subject matter experts matter. One of the things I will tell  you is you are going to meet a lot of faculty members at some schools that have never been in  the real world. They've spent their entire life in academia. And so their view of industry and  what's needed to succeed in the industry is going to be very different than someone who  has spent some time in the industry doing it. Usually you get good, faster, cheap choose two  with universities and college education. It's normally choose one. There are some that are  good and cheap. That's rare. You really have to be lucky enough to be living close to a school  that has a good program. But they're definitely not fast. If it's fast, there are some schools out  there that are online and they will tell you that you can get a master's degree in one year.  It's probably not going to be cheap and it's probably not going to be good. Let's be honest  about that. So go into it with your eyes open. The other thing that you see is a lot of schools  are going to advertise that they're NSA academic centers of excellence. I will tell you having  taken two schools through that certification program that that certification is absolutely  worthless. It is not that hard to get accredited as an NSA academic center of excellence. And  it's a paperwork drill. They will the NSA ask schools to make sure that they teach certain  things. And if they have one slide on one course that mentions that subject, then they get to claim  that they taught it. That is really not what what NSA and cyber command were after. So  I would not really consider that academic center of excellence certification for a school is  worthwhile. Don't don't buy that. So another cons the applicability. I used to teach not just at  the graduate level but at the undergraduate level and I happen to teach one of the last classes  that my undergraduates took before they graduated. And many, many, many of my students would come to  me and go, hey, listen, you know, Professor Brewer loved your class. It was great. I'm about to  graduate with a degree bachelor's degree in computer science. I don't feel qualified to do  anything. Congratulations. You're not alone. We all feel that way. If you spend any time in info  sec, you're just going to get used to the imposter syndrome. I still have it. Many of the people  up on stage today are still going to have it. But what you need to realize is that having a degree  doesn't demonstrate that you're an expert in something. A bachelor's degree demonstrates that  you're capable of being taught and learning new things. And so your employers know that because  you've got a bachelor's degree in computer science, they don't expect you to hop in and be an expert  program. They expect that when they stick you with a more seasoned senior programmer that they're  going to be able to teach you the things that you need to do to accomplish your job there. A master's  degree doesn't mean that you're a master of your trade. It absolutely does not. What it means is  that you're capable of teaching yourself. If you don't know something and you're asked to do it,  you're capable of going out and finding resources and teaching yourself. And a PhD absolutely doesn't  mean that you're an expert in anything. What it means is that you're capable of conducting  independent scientific research. So a lot of people do ask me because I've just got one,  should I get a PhD? And my answer to this is you should only get a PhD for three reasons. The first  one is if you want to work in academia, if you want to be a university professor, absolutely go get a  PhD. There's a hard cast system in there about tenure track PhDs and non-tenure track PhDs and then  lectures. The other reason is if you want to do research, professional research for your career,  go get a PhD. And the last reason to get a PhD, which was my reason was I just wanted one.  Does it really help your career? It's arguable, I would say most cases the juice is probably not  worth the squeeze on that one. It was just a personal goal I'd set for myself for reasons that,  well, I'm just not going to get into, but just be aware of what those degrees are supposed to  demonstrate. None of these demonstrate that you're an expert. So unrelated degrees, everybody needs  InfoSec, right? It doesn't matter if you're a book publisher, if you're a bank, if you're a manufacturer,  if you run industrial plants, all these things right now run on IoT and computers. And so  they all need InfoSec. And taking these unrelated courses helps you learn the language of non-  InfoSec people. If you're an InfoSec person and you go talk to your boss at a bank about IP addresses  and ROP, and they're just going to run you out of the room, they pay you good money so they don't  have to hear that language. They want to know, you know, what do I gain? What do I lose? What does  it cost? And why do I care? So you're going to have to translate the geek speak and the InfoSec  to business processes and thought processes of executives. Baseline courses, regardless of degree,  are going to be the same. It doesn't matter if you're going to get a bachelor's in history,  a bachelor's in women's studies, a bachelor's in computer science, or a bachelor's in electrical  engineering, you're all going to have to take college math, you're all going to have to take  English composition. Those baseline courses are the same and they're meant to be a good foundation  for the rest of your learning. I mentioned writing practice. You're going to need a lot of writing  practice regardless of your degree. That writing is important. It's actually critical, I would say,  in many cases, it's at least as critical, if not more critical than your technical knowledge.  But if you're going to get an unrelated degree and you want to work at InfoSec, at some point  you're going to have to come back and either get some training or some education on the tech side.  You can't just hop in from a history degree and decide that you're going to be  an InfoSec analyst without going back and actually understanding what some of the InfoSec language  means and understanding something about how computers and networks work. Here's a fantastic  example of somebody that's successful with an unrelated degree. Tracy Malief, many of you know  her, InfoSec Sherpa. She's got a bachelor's in history and she's got a master's in library sciences.  She spent 10 years working as a librarian, then was a cyber analyst at Glasgow Smith Klein,  got her first InfoSec certification in 2017 and in 2019 she became an InfoSec analyst for New York  Times. So library sciences doesn't seem like it's a related degree. However, what it taught her to do  was how to do research very, very well. She's certainly a much better researcher than I am  and it taught her how to write exceedingly well. And because of that she's been tremendously successful  not only in the hacker community but as a professional InfoSec analyst. So absolutely,  all degrees are valuable and you certainly can work in InfoSec if you have an unrelated degree.  So Emanuel Kant said that experience without theory is blind but theory without experience  is mere intellectual play and it's true. You need both. You need a little bit of theory  and you need a little bit of experience and practical knowledge if you want to be successful.  Otherwise you're really just a one-sided professional. So you need a bit of both.  So great. I've got more questions about this. Where can I go for learning and networking resources?  Well congratulations. If you're listening to this you're already doing that.  DEF CON and hacker conferences and hacker collectives are great insight. It's a great place to meet  people that may be doing things that you're interested in or that have good and bad experiences  to share with you on their path. Maker spaces. There are maker spaces throughout the country  and throughout the world. Lots of professionals have a passion for InfoSec and what they do that  are willing to share their experiences and share their knowledge for little or no cost.  Capture the flag exercises are great. One of the things I often hear is I don't feel like I know  enough to do capture the flag exercises. That's great. If you knew how to do the capture the  flag exercise it wouldn't be fun. So what I would say is go out there and try it and figure out what  you can figure out and what you can't figure out. Go back a week later what you're going to see is  that the teams that did well did write-ups on how to solve the challenges and that's going to give  you insight into not only how to solve the challenges but subjects that you may want to go back and  learn more on. Mentors and mentees. Everybody needs a mentor. I've got several and I learn a lot from  my mentors. Here's a hidden trick though. I learned far more from my mentees than I learned from my  mentors. They often ask me questions that I go, you know what I actually have no idea and I have to  go back and research it and I have to learn it well enough to explain it to my mentee. So both  being a mentor and a mentee is a great way to learn things. There are lots of free online training  everything from YouTube to online classes to Khan Academy. Hacker cons, you can attend or you can  volunteer. Attending is always great because you get to go to ideally all the talks that you want to  do. Hidden trick of mine is to volunteer at the cons. I've been doing it for a long time, particularly  if you volunteer for speaker operations. You get a lot of one-on-one time with the speakers. You get  to ask questions without anybody else in the room so that's really really great. For military  members that are leaving there's a program called Skill Bridge where you can go get an internship  for six months at a company. That company doesn't pay your salary. The DOD pays your salary so they  get a free intern. You get free job experience. You get to try out that company and decide if you  really want to get hired there. So that's a great deal. For college students and for people taking  either at the School of Hard Knocks or the certification path, go get an internship either paid or  unpaid. Internships are great. Not only do they let you gain some skills, they get let you learn  about the company that lets the company learn about you and oftentimes you get a job not because  you submitted a resume but because you have a personal relationship with somebody in a company.  Professional organizations, ISC Square, ISACA, all of those tend to have monthly meetings. Those are  great. Go network, go talk to people. They will give presentations. If you want to know how they got  to learn about what they learned, they will tell you. Oftentimes they're happy to do that.  Boot camps and lunch and learns, a lot of organizations will offer boot camps and lunch  and learns for free in some cases because they want you to sign up for their paid classes later  but you don't have to. You can go for an hour and learn about Network Recon or OSINT or whatever it  is that they're talking about. So lots of free resources out there. So at the end of this,  what's the best solution? It's to choose your own adventure. If you want to be a ninja, do all three  pass. Do some experimentation on your own. Go through the school of hard knocks, get some  certifications, take some college classes, get a degree but choose a path and start on it. Journey  to a thousand steps. You have to take that first step. What you should consider is what are your  goals? When you start on this journey, what is your next goal that you want to achieve and how can  you best get there given your timeline, your finances and your goals? So there is no wrong  path. There are pros and cons to all of them. Eventually if you want to be professional, you're  going to find out that you've done all three and so it's really just a matter of which path you want  to start on first. There is no wrong path. So with that, thanks so much for your time and I will be  on the Discord if you have questions. Have a great day. Pablo, thank you so much for all of that.  Just sort of great overview because as you said, we tend to have this discussion and everyone camps  in my way is right or my way is right and it really is. Everyone needs to customize their own  career path and take bits and pieces and depending on your finances and where you are in life,  all of it and that's what's so great about the industry is that we have so many resources.  We have so many role models. We can craft our own path and employers are also starting to  really realize that experience over certifications but it's going to change  depending on the employer. I really appreciate you pulling this presentation together and also  all your great comments to people's questions and Discord. I want to remind everyone that we're  doing resume review and career coaching all day Friday and all Saturday afternoon. You need to sign  up in the Discord channel. Pablo, thank you so much. I can't wait to be able to hug you in person.  Thanks Kathleen. Looking forward to seeing you. Take care.
DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_0_83.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_84_1079.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_1080_1463.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_1464_2075.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_2076_3335.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_3336_4355.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_4356_5003.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_5004_5243.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_5244_7007.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_7008_7055.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_7056_7103.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_7104_7151.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_7152_7199.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_7200_7247.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_7248_7295.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_7296_7343.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_7344_8003.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_8004_8051.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_8052_8255.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_8256_8507.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_8508_8639.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_8640_9143.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_9144_9323.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_9324_10895.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_10896_15239.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_15240_17339.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_17340_17507.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_17508_20315.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_20316_20507.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_20508_21995.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_21996_23855.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_23856_26963.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_26964_27119.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_27120_29507.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_29508_31067.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_31068_34307.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_34308_34367.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_34368_35723.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_35724_36659.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_36660_38783.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_38784_40979.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_40980_42467.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_42468_45743.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_45744_49511.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_49512_52331.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_52332_53855.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_53856_54371.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_54372_59591.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_59592_60839.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_60840_61091.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_61092_61175.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_61176_62843.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Pablo_B_CdRf1rwRBDs_62844_62936.png