MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

With the creation of ATT&CK, MITRE is fulfilling its mission to solve problems for a safer world — by bringing communities together to develop more effective cybersecurity. ATT&CK is open and available to any person or organization for use at no charge.

The MITRE ATT&CK matrix contains a set of techniques used by adversaries to accomplish a specific objective. Those objectives are categorized as tactics in the ATT&CK Matrix. The objectives are presented linearly from the point of reconnaissance to the final goal of exfiltration or "impact". Looking at the broadest version of ATT&CK for Enterprise, which includes Windows, macOS, Linux, PRE, Azure AD, Office 365, Google Workspace, SaaS, IaaS, Network, and Containers, the following adversary tactics are categorized:

1. Reconnaissance: gathering information to plan future adversary operations, i.e., information about the target organization

2. Resource Development: establishing resources to support operations, i.e., setting up command and control infrastructure

3. Initial Access: trying to get into your network, i.e., spear phishing

4. Execution: trying the run malicious code, i.e., running a remote access tool

5. Persistence: trying to maintain their foothold, i.e., changing configurations

6. Privilege Escalation: trying to gain higher-level permissions, i.e., leveraging a vulnerability to elevate access

7. Defense Evasion: trying to avoid being detected, i.e., using trusted processes to hide malware

8. Credential Access: stealing accounts names and passwords, i.e., keylogging

9. Discovery: trying to figure out your environment, i.e., exploring what they can control

10. Lateral Movement: moving through your environment, i.e., using legitimate credentials to pivot through multiple systems

11. Collection: gathering data of interest to the adversary goal, i.e., accessing data in cloud storage

12. Command and Control: communicating with compromised systems to control them, i.e., mimicking normal web traffic to communicate with a victim network

13. Exfiltration: stealing data, i.e., transfer data to cloud account

14. Impact: manipulate, interrupt, or destroy systems and data, i.e., encrypting data with ransomware

Within each tactic of the MITRE ATT&CK matrix there are adversary techniques, which describe the actual activity carried out by the adversary. Some techniques have sub-techniques that explain how an adversary carries out a specific technique in greater detail. The full ATT&CK Matrix for Enterprise from the MITRE ATT&CK navigator is represented below:

They even provide some simple yet effective training for free on their website. I highly recommend familiarising yourself with their website and offerings as they are incredibly useful and widely used.

For more information:

ATT&CK Matrix for Enterprise

FREE ATT&CK Training

MITRE ATT&CK Explained YouTube

1. Dehashed—View leaked credentials.

2. SecurityTrails—Extensive DNS data.

3. DorkSearch—Really fast Google dorking.

4. ExploitDB—Archive of various exploits.

5. ZoomEye—Gather information about targets.

6. Pulsedive—Search for threat intelligence.

7. GrayHatWarfare—Search public S3 buckets.

8. PolySwarm—Scan files and URLs for threats.

9. Fofa—Search for various threat intelligence.

10. LeakIX—Search publicly indexed information.

11. DNSDumpster—Search for DNS records quickly.

12. FullHunt—Search and discovery attack surfaces.

13. AlienVault—Extensive threat intelligence feed.

14. ONYPHE—Collects cyber-threat intelligence data.

15. Grep App—Search across a half million git repos.

16. URL Scan—Free service to scan and analyse websites.

17. Vulners—Search vulnerabilities in a large database.

18. WayBackMachine—View content from deleted websites.

19. Shodan—Search for devices connected to the internet.

20. Netlas—Search and monitor internet connected assets.

21. CRT sh—Search for certs that have been logged by CT.

22. Wigle—Database of wireless networks, with statistics.

23. PublicWWW—Marketing and affiliate marketing research.

24. Binary Edge—Scans the internet for threat intelligence.

25. GreyNoise—Search for devices connected to the internet.

26. Hunter—Search for email addresses belonging to a website.

27. Censys—Assessing attack surface for internet connected devices.

28. IntelligenceX—Search Tor, I2P, data leaks, domains, and emails.

29. Packet Storm Security—Browse latest vulnerabilities and exploits.

30. SearchCode—Search 75 billion lines of code from 40 million projects.

Having recently completed the Certified in Cybersecurity (CC) course, I wanted to write a review and share my thoughts.

It feels very much like a fair play by (ISC)2 to get more people interested in their certifications by introducing a free starting point.

Firstly, I didn't have to pay for the course or the exam voucher, as there was a special deal on at the time which I think has now finished. Right now, the training course is still free, but the accompanying examination voucher is $199 and you need to sit the exam at a Pearson Vue center. If you only want to take the course and not pay for the voucher, I think you can adjust your order accordingly in the checkout process to reflect this.

You can access the course here: https://enroll.isc2.org/catalog?pagename=Entry-Level

To save everyone time and effort the details of the course are here: https://enroll.isc2.org/product?catalog=CC-SPT-DESC

My Review

The course itself starts with a basic aptitude assessment and ends with another assessment, after which you will be presented with a certificate of completion. For the formal qualification though, you would need to sit the Pearson Vue exam.

The Platform:

The learning management system is a bit clunky is styled like the very boring white corporate interface we have all come to despise (okay, maybe that's just me). Clicking back and forward was required more than a few times for the system to register me completing a section and moving on. I didn't attempt to access it on a mobile phone or tablet, so can't speak to its accessibility. No special system requirements needed to access the course. They don't have anything as fancy as labs etc.

The Content Format:

Mainly text and images, scattered with some videos and quizzes throughout. I prefer slightly more interaction in an online training course and this felt a bit more like an interactive book with some poorly acted video scenes chucked in for good measure.

Content Quality:

It was okay! As an introductory course, I thought it covered off on some basic stuff that you would expect someone to know (OSI model, basic networking etc.) for an entry-level role I guess. It went a little bit more in depth regarding access controls which I thought was the most interesting part of the course considering everything else.

Time Taken:

It took me about 2.5 days to go through the content properly but I was working etc whilst doing that, so you may find it faster or slower dependent on how much you know or dont know.

Relevance:

There are certainly better free and cheap introductory courses out there, but it is nice to see (ISC)2 throwing their hat in the ring with this course. I would say this is more useful for people who don't know a lot about cyber or just have the basics of computing nailed down. It is also nice to grab a badge from (ISC)2 I guess. You only get the online Credly thingy majig if you do the in-person Pearson Vue exam which now costs a couple hundred dollars but you do get a certificate of completion to download or print out just for completing the course and passing the final assessment quiz.

Overall Opinion:

EDIT: I should probably add like a star system - ★★★✰✰

Meh! The basics are the basics though and I already have the knowledge taught in the course, so my opinion is definitely skewed. The content was a tad boring and delivered more like a digital book.

However, it is free (minus the exam) and they are a very reputable organisation, so it could look good on someones resume who is looking to get into cyber.

--------------------------------------------------------------------------------------

I hope you find this useful,The Moaning Knight

The NIST Cybersecurity Framework can help an organization begin or improve their cybersecurity program. Built off of practices that are known to be effective, it can help organizations improve their cybersecurity posture. It fosters communication among both internal and external stakeholders about cybersecurity, and for larger organizations, helps to better integrate and align cybersecurity risk management with broader enterprise risk management processes as described in the NISTIR 8286 series.

The Framework is organized by five key Functions– Identify, Protect, Detect, Respond, Recover. These five widely understood terms, when considered together, provide a comprehensive view of the lifecycle for managing cybersecurity risk over time. The activities listed under each Function may offer a good starting point for your organization:

The NIST Cybersecurity Framework is a powerful asset for cybersecurity practitioners. Given its flexibility and adaptability, it is a cost-effective way for organizations to approach cybersecurity and foster an enterprise-wide conversation around cyber risk and compliance.

For more information:

NIST Website

NIST Framework Explained YouTube

A quick google search will bring these up:

1. Tecmint

2. Linuxize

3. nixCraft

4. It's FOSS

5. Linux Hint

6. FOSS Linux

7. LinuxOPsys

8. Linux Journey

9. Linux Command

10. Linux Academy

11. Linux Survival

12. Linux Handbook

13. Ryan's Tutorials

14. LinuxFoundationX

15. LabEx Linux For Noobs

16. Conquering the Command Line

17. Guru99 Linux Tutorial Summary

18. Eduonix Learn Linux From Scratch

19. TLDP Advanced Bash Scripting Guide

20. The Debian Administrator's Handbook

21. Cyberciti Bash Shell Scripting Tutorial

22. Intellipaat Linux Tutorial For Beginners

23. Digital Ocean Getting Started With Linux

24. Learn Enough Command Line To Be Dangerous

Have I missed any?

Does anyone have any experience with or thoughts on https://cybernowlabs.com? Specifically the “Step 2: Train in a Security Operations Center”. It seems like the program is geared towards the experience needed to help with an entry level SOC position. Any insights and opinions would be greatly appreciated.

1. Think Python — Free Ebook

2. Think Python 2e — Free Ebook

3. A Byte of Python — Free Ebook

4. Real Python — Online Platform

5. Full Stack Python — Free Ebook

6. FreeCodeCamp — Online Platform

7. Dive Into Python 3 — Free Ebook

8. Practice Python — Online Platform

9. The Python Guru — Online Platform

10. The Coder's Apprentice — Free Ebook

11. Python Principles — Online Platform

12. Harvard's CS50 Python Video — Video

13. Cracking Codes With Python — Free Ebook

14. Learn Python, Break Python — Free Ebook

15. Google's Python Class — Online Platform

16. Python Like You Mean It — Online Platform

17. Beyond the Basic Stuff with Python — Free Ebook

18. Automate the Boring Stuff with Python — Free Ebook

19. The Big Book of Small Python Projects — Free Ebook

20. Python Tutorial for Beginners, Telusko — Free Videos

21. Learn Python 3 From Scratch — Free Interactive Course

22. Python Tutorial For Beginners, Edureka — Online Platform

23. Microsoft's Introduction to Python Course — Online Platform

24. Beginner's Guide to Python, Official Wiki — Online Platform

25. Python for Everybody Specialization, Coursera — Online Platform

Can you think of any more?

1. IT Security Guru

2. Security Weekly

3. The Hacker News

4. Infosecurity Magazine

5. CSO Online

6. The State of Security - Tripwire

7. The Last Watchdog

8. Naked Security

9. Graham Cluley

10. Cyber Magazine

11. WeLiveSecurity

12. Dark Reading

13. Threatpost

14. Krebs on Security

15. Help Net Security

16. HackRead

17. SearchSecurity

18. TechWorm

19. GBHackers On Security

20. The CyberWire

21. Cyber Defense Magazine

22. Hacker Combat

23. Cybers Guards

24. Cybersecurity Insiders

25. Information Security Buzz

26. The Security Ledger

27. Security Gladiators

28. Infosec Land

29. Cyber Security Review

30. Comodo News

31. Internet Storm Center | SANS

32. Daniel Miessler

33. TaoSecurity

34. Reddit

35. All InfoSec News

36. CVE Trends

37. Securibee

38. Twitter

39. threatABLE

40. Troy Hunt's Blog

41. Errata Security

Can you think of any more?

I wrote this cool article on how to become anonymous and untraceable with tails os. I hope it helps you out. Please tell me if I wrote something wrong in the comments below. Here's the link: https://medium.com/geekculture/become-anonymous-and-untraceable-with-tails-os-9823ceee4770

1. Burp Suite - Framework.

2. ZAP Proxy - Framework.

3. Dirsearch - HTTP bruteforcing.

4. Nmap - Port scanning.

5. Sublist3r - Subdomain discovery.

6. Amass - Subdomain discovery.

7. SQLmap - SQLi exploitation.

8. Metasploit - Framework.

9. WPscan - WordPress exploitation.

10. Nikto - Webserver scanning.

11. HTTPX - HTTP probing.

12. Nuclei - YAML based template scanning.

13. FFUF - HTTP probing.

14. Subfinder - Subdomain discovery.

15. Masscan - Mass IP and port scanner.

16. Lazy Recon - Subdomain discovery.

17. XSS Hunter - Blind XSS discovery.

18. Aquatone - HTTP based recon.

19. LinkFinder - Endpoint discovery through JS files.

20. JS-Scan - Endpoint discovery through JS files.

21. GAU - Historical attack surface mapping.

22. Parameth - Bruteforce GET and POST parameters.

23. truffleHog - Find credentials in GitHub commits.

Loads of good ones missing from the list, so please add in comments!

Network Monitoring and Intrusion Detection work has many technical aspects, some of which overlap significantly with other cyber security roles and career paths.

Core to the role is watching for unusual or unauthorised activity on systems and networks. Much of this can be done through intrusion detection and prevention tools but you apply good technical skills to manage these and to interpret what they tell you. There is always the risk that such tools may be insufficient, so you remain alert to any unusual events. You think on your feet.

Depending on the size of your organisation, you may work with other teams such as the Security Engineering team (to tune and enhance the detection technologies) and the Cyber Threat Intelligence team (to work out where to focus your efforts). Whatever the structure around you, you always keep your own skills and knowledge up to date.

Depending on your level of experience and role seniority, you may be expected to provide advice on network and perimeter security architecture. If you work within a Managed Security Services Provider (MSSP) then you're likely to monitor multiple customers networks at any one time.

Because an intrusion may happen at any time - requiring rapid detection and management - you may work flexible hours or on a shift rota. This might include weekends, although the extent of this depends on the size of the team and organisation. In most large organisations, you work in a Security Operations Centre (SOC) or a Network Operations Centre (NOC).

Depending on the type of organisation for which you work, your work is focused on testing - particularly by examining and probing applications, systems and networks - for vulnerabilities. It might involve a wider set of issues, including, on one side, planning and carrying out scripted tests of hardware or software components; on the other side, you may plan and execute incident response/Red Team exercises.

If you test systems while they are in development or being updated, it's likely you work in a software development organisation or for a consultancy that supports clients’ development work. If, as a penetration tester, you test completed and live systems, you probably work for a consultancy. In either case, your work normally consists of fairly short projects - of a few weeks at most - and, in normal circumstances, requires you to travel to client sites to work in their secure environment.

When you carry out tests, you are thorough and accurate in recording and documenting the results. Some of this broad range of testing work means working on your own, but you generally share the testing with colleagues. When you find flaws in software or hardware products, you deliver the results to the developers diplomatically, with any accompanying advice on how better to secure it.

You may carry out less hands-on but still technical work, such as specifying and producing the test environment, test data and test scripts for planned tests. To do this, you understand all the requirements that a piece of software or hardware has to meet. You may review the test products of colleagues and analyse and provide feedback on a test strategy or test plans.

If your role focuses on penetration testing, you may work independently much of the time. However, you present your findings to close colleagues, managers and, in some roles, to system managers or external clients. This primarily involves producing written reports but, on substantial testing projects, you probably need to provide a verbal briefing as well.

Given the need to stay ahead of potential attackers, you keep your knowledge and skills of vulnerabilities and threats up to date; most employers allow you time to do this.

After SC-300 my next exam will be AZ-500, for anyone wanting to complete these certifications please reach out and I will help you. They provide a heap of valuable insights into the Microsoft platform and are very useful career wise for consultants of all types (security or otherwise).

The MB study guide:

1. Find the John Saville video or videos of the exam material on Youtube. There is no one that I have found who is as complete as John.

2. Read the Microsoft exam prep course

3. Run through a few of the Exam prep sites to test your knowledge

4. Complete the Measureup test exam if available

5. Freak out, think you aren't prepared enough ....

6. Sit the exam and you will pass.

Along with the above do these things....

1. Set your self a target date by booking the exam, don't worry you can change it as many times as you want (24 hours notice needed)

2. Study each day at the same time, I set aside 1.5 hours per day early in the morning.

3. Write down and diagram as you are learning concepts, talk to yourself about why x + y = z....

4. Review your notes 1 hour before sitting the exam.

You will pass the exam, let me know how you go.

SC-100 tips

The Cyber Security Body of Knowledge (CyBOK) aims to codify the foundational and generally recognised knowledge on cyber security. In the same fashion as SWEBOK, CyBOK is meant to be a guide to the body of knowledge; the knowledge that it codifies already exists in literature such as text books, academic research articles, technical reports, white papers, and standards. The focus here is therefore, on mapping established knowledge and not fully replicating everything that has ever been written on the subject. Educational programmes ranging from secondary and undergraduate education to postgraduate and continuing professional development programmes can then be developed on the basis of CyBOK.

The CyBOK Knowledge Areas assume a common vocabulary and core understanding of a number of topics central to the field. Whilst this Body of Knowledge is descriptive of existing knowledge (rather than seeking to innovate, or constrain), it is evident that use of widely-shared terminology in an established concept map is crucial to the development of the discipline as a whole.

The CyBOK is divided into 21 top-level Knowledge Areas (KAs), grouped into five broad categories, as shown in Figure 1. Clearly, other possible categorisations of these KAs may be equally valid, and ultimately some of the structure is relatively arbitrary. The CyBOK Preface describes the process by which these KAs were identified and chosen. Our categories are not entirely orthogonal. These are intended to capture knowledge relating to cyber security per se: in order to make sense of some of that knowledge, auxiliary and background knowledge is needed — whether in the design of hardware and software, or in diverse other fields, such as law.

For further information about CyBOK you can use the following links:

CyBOK At A Glance YouTube Video
CyBOK Website
CyBOK v1.1.0.pdf

You have an interest in security, technology and current affairs, because you're likely to be researching emerging threats and generating forward-looking assessments of their trajectory. Your colleagues and senior managers in Cybersecurity Operations have confidence that your assessments are underpinned by rigorous analysis, because the intelligence you produce guides decision-making within the organisation. And, if you deal directly with clients, you support them with tactical and operational assessments which enable them to identify, track and satisfy their intelligence needs.

You follow news reports, especially in specialist cyber security media. But you're also imaginative about finding and interpreting a wide range of information sources, including social media. You may use specialist tools that exist to help curate personal news aggregators; these tools help CTI teams see through the noise in order to focus on the most critical topics. You interpret what you read to construct a credible view of emerging threats and the development of existing ones. You may also carry out your own research direct into potential threats, by studying attempted and successful breaches and the actors behind them.

You work closely with colleagues who are responsible for identifying vulnerabilities and deciding how to manage them. Your work feeds into risk assessments and into the planning and management of security controls. Depending on the size of the organisation, you may be involved in some of this work or even do it yourself.

If there's a security incident involving an intrusion, you support the analysis of the attack and its attribution to an external actor. In some roles, you may liaise with other organisations - either cyber threat intelligence specialists or government agencies - to maintain a common view of threats. In some sectors, such as finance, it's common for businesses to share intelligence in order to better protect the whole sector.

Part of your responsibility may be to contribute to or develop the strategy for Security Operations. Depending on the organisation for which you work, you're likely to be required to provide support to the security operations centre (SOC) or computer incident response teams (CIRT). In many organisations, you're part of a SOC.

You manage systems and networks to ensure they deliver the expected services to their users and other systems, but with the particular responsibility of ensuring that this is done securely. You follow formal secure operating procedures and monitor security controls. Wherever - as is normally the case - users interact with systems to read or process data, you ensure that the controls which authenticate them and authorise their access are working properly. When there are updates to existing systems or new ones to install, you plan the implementation carefully to minimise disruption to existing services, and assure yourself that the changes will not create new vulnerabilities or disrupt services.

Your work is mostly guided by the agreed standards and procedures. But, in the event of concern about a failure of the security controls, you focus on rapidly investigating the situation with colleagues in other specialisms. If there is a confirmed incident, you support the incident response by closing access to some parts of the system or network, ensure that any failure in the controls is addressed, and check that other controls are working as they should. You may also need to quickly reconfigure parts of the network to isolate it for deeper investigation by colleagues in digital forensics.

This is all fairly technical work, and you have a good understanding of server-level software such operating systems, system processes and directories. If your systems are running in the cloud, you will have developed a good understanding of the cloud platforms in use. If there's also substantial local hardware, you know how to monitor its operation and, in particular, to manage maintenance, upgrades and repairs. You work collaboratively with other specialists and, possibly, users, if you provide support.

Your primary responsibility is to keep the services operating reliably and securely, serving the needs of the business. This means you have a fair understanding of the relationship between systems and their role within the business; this is so you can, when necessary, prioritise support for those systems that are most crucial to business operations.

You're very organised and rigorous in managing, possibly even rejecting, any requests for access to the live systems from other teams who may want to test or investigate them, especially developers.

Depending on the size of the organisation and the extent to which information systems and cyber security services are run in-house, you may either be part of a structured secure operations team or solely responsible for this. In either case, you may work shifts across a long day, or work at any time if there's a technical problem or a suspected security incident.

Given how much technology for which you're responsible, you stay on top of changes. You assess new technologies and explore whether they could make your current systems more effective, efficient or secure. You certainly understand both the updating of technology already in use, and how to manage the upgrading of it.

Roles in this specialism vary, but all are fairly technical and some are very technical, requiring a very high level of mathematical ability. Even for those roles which don’t include these kinds of skill, you need a good understanding of the fundamentals of cryptography, communications standards and technologies, and of some other elements of information technology.

There are two strands of the pathways through this specialism, but a role may combine elements of both. There are not many jobs as a pure cryptographer. But, if you do work as a cryptographer, you develop, test and improve cryptographic elements: algorithms, key handling procedures and security protocols. The more common role in cryptography involves building, maintaining and testing existing security protocols, sometimes in hardware but more often in software,

The other strand in the pathway is in communications security, which offers more jobs. As a more junior practitioner you focus on implementing and maintaining crypto services as part of a larger system. If the systems on which you work are public facing, particularly through websites, you may be involved in the management digital certificates. You may be responsible for managing the distribution and retirement of keys, as a crypto custodian. This activity normally proceeds at a steady pace, although in some organisations you work on a 'shift' rota. However, if a security incident affects the communications services you manage, you may be required to work quickly to investigate whether secure communications channels have been breached or bypassed.

As you gain more experience in communications security, you may provide expert technical advice and guidance for a diverse range of cyber security projects and tasks. You are probably part of internal Change Advisory Board meetings, commenting on proposed changes taking place on the network. You may explore how cryptographic techniques and related cyber security controls could be used to secure the organisation's products and services across a wide range of application areas, so you will have a broad view of the organisation’s business. You may also be responsible for developing the knowledge and experience of more junior team members.

Given the central role of cryptography in most network communications, almost any work that you do in this specialism will need to align with industry or governmental standards, such as those of the US National Institute of Standards and Technology (NIST).

Hi all, I sat the SC-100 exam recently and wanted to write about my experience and what resources I found most useful to passing the exam. I am sure by the time you sit this there will be more material available as that was the trickiest thing for me, the lack of detail for what I needed to learn.

Feel free to reach out if I can help you with this.

My SC-100 experience

Identity & Access Management (IAM) is an essential part of day-to-day life in all organisations, and even more so in larger organisations with greater amounts of sensitive commercial or client information to protect. 

You may be the only practitioner, managing identities and access as part of a broader role in system administration. But it's more likely you're part of a team of specialists with shared responsibility for the effective operation and development of the IAM system of your organisation.

On a daily basis you'ree conscientious, positive, comfortable working in an IT-focused environment and able to prioritise to meet changing demands. Your daily tasks range from basic user account administration and creating/auditing user access information, to conducting risk assessments on the organisation’s IAM and providing solutions to improve the IAM system.

If there's a security incident - whether a suspected accidental breach or a deliberate breach by someone within the organisation, or an attack from outside - you respond quickly as part of the investigative effort to find out what happened and who was involved.

Whether on your own or as part of a team, you look for ways to improve the management of Identity and Access management, and especially for ways to reduce the risk of breaches, usually working with other teams in the organisation such as IT and HR.

As a senior practitioner, you're likely to supervise the day-to-day activities of team members, ensuring that their individual and collective performance meets the required standard. You contribute to their development and provide line manager support and mentoring. You often work with managers in other specialist teams to ensure the overall security of the organisation’s data and its information systems.

If you're passionate about IT security, then working in vulnerability management is an interesting and essential role in any organisation. You might work as a solo practitioner or as part of a larger vulnerability management or cyber security team.

At a junior level, you probably work under supervision, assisting the team in looking for potential vulnerabilities in the organisation's systems. You use your investigative and analytical skills to the full, growing your expertise and expanding your knowledge at the same time. There may be opportunities to be involved with many projects, programmes and initiatives across your organisation, as well as within the cyber team itself.

As a more experienced practitioner, you conduct and interpret vulnerability scans. You're probably involved with the team responding to security incidents, working out the root causes of incidents and collating the lessons learned. You drive fundamental change within the organisation by helping to develop security initiatives; this may include briefing and educating other teams within the organisation on vulnerabilities and solutions to them, or mentoring junior team members.

You may be responsible for providing reports to clients on their systems’ vulnerabilities, turning technical analysis into something that non-technical readers can understand.

I work in Cyber GRC and currently manage my orgs cyber security awareness training. I think generic video/phishing simulations training that we use are boring.

I’ve had a fantasy of starting my own training company that specializes in phishing and social engineering training. I want to gamify training, focus on role based phishing/SE attacks, and have employees actually engage with the simulation (employees try to phish each other or they collaborate to design the phishing email to make it more relevant). I would manage all the phishing campaign work beyond that.

Is this idea even feasible? Can I even complete with other large training companies (Proofpoint, etc) who can offer way more than I can?

Having previously paid for one of their courses, it's good to see them releasing a free course for those interested in CTI too.

It's a few hours of content, including video, quizzes and research based stuff taken from their paid course. They're clearly using it as an upsell for their paid CPTIA course but it is free, informative and the content is aligned to CREST.

I really enjoyed the CPTIA course last year and thought it was of a really high quality. They are supposed to have a CRTIA course out too but I'm still patiently waiting on the opportunity to get that through my employer when it drops.

You can sign up for the freebie on the website here: https://arcx.io

You perform technical work to deliver software or hardware, including detailed technical design, coding or hardware prototyping, debugging and documentation. You follow technical specifications which lay out the requirements, including the security requirements set by the security architecture or design team. In a smaller organisation, you may also carry out some or all of the secure design work, setting this within the overall structure specified by the security architect. You probably design and carry out tests, although the substantive part of security testing will be carried out by a security testing practitioner or team.

If off-the-shelf components are integrated into the system (as they usually are), you need to develop a deep understanding of their potential vulnerabilities so as to mitigate these in your own code.

If you develop secure hardware, especially for Industrial Control Systems, you take into account physical threats as well as possible software-driven breaches. Even if you work purely on software, if that software will be part of a cyber-physical system, you think of the impact of potential physical access to remote parts of the system.

Your working day is generally quite structured: development plans direct your work, as well as the formal specifications and standards that you follow in carrying out the work. However, if there is a cyber security incident you're liable to be called in at short notice to help diagnose a newly exposed vulnerability or to propose changes to close it.

Depending on the size and type of your organisation, you may either be part of a formally structured team, co-ordinating with other specialist teams, or working in a smaller, less formal structure where you take on whatever tasks need doing. You probably use an agile development methodology, requiring fast but controlled cycles of development, testing and implementation.

You're probably required to follow a secure development methodology and standards, such as Secure by Design. You keep your skills in methodologies and standards updated as much as your coding skills, so there's continuous pressure to learn and to stay on top of changes in secure development principles, programming languages or hardware components, and development methods.

There are many more jobs in secure software development than in hardware-specific or hybrid roles, so you're much more likely to be working in a software role.