Why military members past present and future are more well equipped for Cyber Security than almost every other candidate

How many of your candidates have consistently received user awareness training in phishing, information security and operational security annually for the past 3 or more years?

I am guessing not many, which is precisely why military members are among the most well-trained candidates you will see. Military members receive world-class user awareness training that's application focused. Like all military training it is about meeting mission and nothing is more about application than mission!

Hire a vet.

An open letter from a Social Engineer

Hello! My name is social engineer. I like to use any and all information about you to gain access to your money, healthcare records and personal identity. It’s Halloween and it can be a scary time. Sometimes I’m scared by the amount of info people share about themselves and their loved-ones online.

A great way to wrap-up National Cyber Security Awareness Month is to limit the amount of info I have access-to by navigating to this page on facebook and clicking this button called, “Limit Old Posts.” This makes the amount of info available to me much more scarce! You can do this same thing on other social media sites too.

Of course if you need more scaring to be convinced, just sign-in to facebook and head over to http://www.takethislollipop.com for a close-to-home demo of how your own info might be used against you. IF YOU DARE!

Happy Halloween!

Free and reduced IT and Security Training for Vets

I have seen a lot of talk lately about Cyber Security training for Vets. So in observance of this upcoming Veterans Day I am publishing this list of free and reduced resources. Unlike a google search, I am sorting these by my percieved training value from a hiring manager's perspective as a seasoned InfoSec Practitioner.

But first an overview, employers are looking for people to work in InfoSec who have real skills, both hard and soft, many of which are acquired in military service. As always, OJT is what you make of the opportunity so YMMV.

Employers need people who have technical skills but in many cases those who solely have technical skills are less in demand than those who can also translate their technical knowledge into words, concepts and stories that business people can understand. The age-old paradigm of Knowledge, Skills and Abilities (like them or not) are hard at work here.

Much of security work is consulting. Consulting has been defined by some as the art of giving advice to those who haven't asked for it and may not want it, sometimes aggressively or violently so. This begs a focus on soft-skills, which is sure to be assessed as a part of any hiring process for an InfoSec gig. At least for the ones you want to have anyway. So each of us must work to find a balance between soft and hard skills. For these reasons, I am including both here.

Soft-skills Resources by Overall Value

     ISSA International - Dedicated to developing and connecting cybersecurity leaders globally. If you do nothing else join, attend and contribute. My first pure InfoSec role was a result of doing just this.

     ToastMasters International - a world leader in communication and leadership training. Enough said.

    BSides Security Conferences - Yes you can cite conference attendance as legit training on your resume and you should! It shows personal investment, current knowledge and industry involvement. Not to mention you might meet your next employer or recruiter there. Tickets can be had for 10's of dollars!  

     Selling Security to C-Level Executives - Tips on how to cut the hype and speak in terms business decision makers understand and relate to.

     The Challenger Sale Summary by HubSpot - A simple approach to selling just about anything in a way that makes an emotional connection.


Hard-skills Resources by Overall Value

     LinkedIn Premium for Vets - includes access to Lynda.com and ability to email outside of network! A tremendous gift from LinkedIn.

     Cybrary.it - Free IT and security training courses - many of these focus on basics or essentials which will be gauged in the interview process but also working toward certifications.

   Fortinet Veterans Program and launch of the Fortinet Network Security Academy (FNSA), designed to develop and train action-oriented cybersecurity experts to address the global skills shortage.

     DHS’s Federal Virtual Training Environment (Fed VTE) offers free online, on-demand cyber security training to government employees and Veterans. Veterans can sign up for an account through the Hire Our Heroes website and follow instructions through “ID me” to verify veteran status and register for a FedVTE account. - Includes just about every IT or security certification course you can think of! Course Catalog here.

     SANS CyberTalent VetSuccess Immersion Academy - FREE Industry-leading SANS training from world-class instructors in a hands-on immersion format, hyper current content, widely-recognized GIAC certifications, and a direct recruiting pipeline to top employers in cybersecurity.


Specific Conference Info:
FREE for Vets
     2016 Metro-Atlanta ISSA Conference, Building on the Foundations of Effective Security, Wednesday November 16th at the Loudermilk Center. This conference will focus on the basic building blocks of Process and Policy, Data Governance, Access Control, Encryption, Monitoring and Incident Response, and Continuity Planning. Seasoned veterans in the field will give presentations based on their experiences in one of these six areas. To view full conference agenda - http://www.gaissa.org/gaissa_conference_agenda_2016.html Veterans use code VETSISSA2015 at checkout for free admission.