Thread by @AlyssaM_InfoSec

Hey #infosec n00bs!!

One of the worst habits we have in security is speaking in absolutes. Saying things like "Unhackable", "Breachproof", "Fully Secure", "No Risk". They're simply untrue.

But this also includes when we talk about skillsets. There are no absolutes.

1/

So when someone says, "You must know x, y, z" or "You have to do a, b, c" to get a certain job (or any job) in security, you can simply toss out those absolutes in with all the other fallacious absolutisms that security people throw around. Simply ignore them.

2/

The reality is we need people of all different skillsets, all different backgrounds, and with all different perspectives in order to be successful. Security is about problem solving and problem solving is strongest when different viewpoints collaborate.

3/

Even within a specific security domain, job class, or title, we need that diversity of thought, skillset, perspective, etc. in order to thrive. You'll notice that job descriptions, as awful as they can be, do bear this out. Requirements for the same title will vary by org.

4/

Sure, there will always be skills, experience, etc. that might make the job easier, different, etc. but that doesn't mean they're required or that you need them to be good at that job.

Anyone who says otherwise is misleading you. Again, consider the source carefully.

5/

And if you doubt my expertise on this subject, feel free to ask me about how I've gone from a hacker at 12 years old to a security executive at 44.

Or ask around to other infosec people and pay attention to how many will agree with the above points.

6/

What I'm saying is, study what you're interested in. Play around with the technologies you find fascinating. Develop the technical security skills that you find most intriguing. We'll have a place for you no matter what you choose and we want you here!!!

/FIN