Transcription
Today, I wanted to show you the secret sauce of it all, and that is where you can go to get hands-on experience. This will help you become more comfortable in your skills, have more confidence, and most importantly, develop a methodology so you can investigate not only faster but better.
Oh, and I almost forgot, these are all free. However, there are some paid options, but those aren't mandatory at all. The reality is that you need hands-on experience in this field; otherwise, it'll be difficult for you to break into cyber security. Enrolling in courses and obtaining certificates typically is not enough for you to land a role in cyber security.
Now, don't get me wrong; there are people who do land a role. However, they are likely to know somebody that's already in the field to help get their foot in the door, and that is not most people.
And what about those job postings that require two to three years of related work experience as a requirement? So, how does one get those requirements? And how does someone like Bobby, who wants to transition into cyber security from an accounting role, compete with everybody else?
The first one I wanted to introduce you to is Cyber Defenders. Sign up for an account with them and head over to the lab section. I highly recommend you start with Bots V1, also known as Boss of the Sock version one. Click on details, and this will provide you with two scenarios. You'll have to identify the who, what, when, where, and why, and also how.
You'll get some serious hands-on experience with Splunk, which is a SIM that companies still use and is relevant in the real world. It will teach you how to threat hunt and identify what evil looks like, and shows you what some log files will typically look like as well.
So, for example, how does an IIS server or even a firewall log look like? Well, if you didn't know, you will know after you try this.
The second one is Blue Team Level 1 Cyber Range. After you sign up for an account, you want to click on challenges and filter for free, easy, and security operations. Once you filter for those, start doing any of these, and you should get a good understanding of some of the skills required as a SOC analyst.
One that I would recommend you start with is phishing analysis. Why? Well, because SOC analysts are expected to know how to analyze a phishing email, and you will likely get that as an interview question as well.
Once you get comfortable with the easy labs, I encourage you to level up and go after the medium and eventually the hard challenges.
The third one is Malware Traffic Analysis. Whenever I want to level up my skills on network traffic analysis, this is the site I typically go to do just that. Under traffic analysis exercises, select "click here," and now you can drill down to any traffic analysis exercise you want.
Click on any of them and download them using the standard password across all malicious zip files. Now, if you don't know what that password is, it is "infected." If you ever forget, you can always click on the about page, and that will provide that password for you.
Once you download the PCAP file, analyze it with any tool you want, such as Wireshark, Zeek, T-Shark; the choice is yours. Scroll down to the bottom and try to answer the questions under your task. Pretend that you're investigating this for a client and write a report in a way that you will be presenting for the client so they can understand exactly what happened.
Bonus points if you watched my previous video on how to create a blog post. Do go ahead and post that report as a blog post for future interviews.
The fourth and last one is Let's Defend, another great resource for blue team labs. There are certain paths that you can take to learn more about SOC analysts. If you click on challenges at the top, you want to filter for security analysts and beginner and easy.
From there, select any of the challenges and start tackling them. Some of the challenges will provide you with a virtual image that you can import into VMware or VirtualBox. Now, if they don't provide that to you, just keep in mind that whenever you do any of these labs, perform it in a virtual environment.
Now, if you don't know how to spin up a virtual environment or get started, I did create a video called "How to Build Your Own Home Lab." If you are interested in the blue team side of things and want to start your career off as a SOC Tier One analyst, I highly recommend you start these labs right away after you watch this video, of course.
Really think about writing your experience in a blog post and include what kind of tools you used to find those flags or even how you set up those tools. That will go a long way, trust me.
When you're doing these labs, typically there are hints and write-ups available for you if you get stuck. However, if the hints don't help or the public write-ups do not exist, feel free to let me know and ask me questions. I may or may not have the answer, but I am always happy to help.
If you are someone trying to get started in cyber security, you don't have to do this alone. I want to help you with that journey, which is why I created a site called mydfir.com, where you can sign up for free mentorship, no strings attached.
This is where I'll be posting books I recommend, cyber security resources, and blog posts.
And that is it for the video. If you found it informative, let me know by hitting that like button and subscribe if you want to.