Chapter 5: Getting Hands-On Experience with No Experience

Jon's previous chapter on certifications and education was important because it helped educate you on the field and industry, which, in turn, helps you deliver value as you become a cyber professional. One challenge these two don't help with is the common requirement of experience.

It's the chicken and the egg problem all over again. Employers want to give jobs to people with experience, but you can't get experience without a job. Let's crack the egg in this chapter and explore getting hands-on experience in the specific area you want in innovative ways.

Hands-on experience can be more important than having a certification, especially when you first enter this industry. This chapter will provide all the guidance you need to get that valuable hands-on-keyboard experience, without having to have a cyber job yet.

This chapter will start off by presenting several actionable ways to get experience...

Technical requirements

Check out the following link to see the Code in Action video:

https://bit.ly/3iaGzUk

Hacking all the things

This section will guide you on offensive security skill development through a vulnerable web application home lab. A walk-through of building and using a WebGoat system on a Raspberry Pi will be provided to help you learn about web application security and Open Web Application Security Project (OWASP) top vulnerabilities.

WebGoat

WebGoat is an intentionally vulnerable web application that is designed to educate individuals on web application security concepts through actual hands-on exploitation of web application vulnerabilities, as well as descriptive write-ups on why the vulnerabilities allow exploitation.

A great way to get hands-on experience and actually develop real cybersecurity skills and get experience is to have a home lab. Home lab is a fairly subjective term. A home lab could be one computer running some applications, all the way up to having physical network appliances, security appliances, and endpoints simulating an actual corporate network...

Guarding all the doors

There are many, many skills that cybersecurity defenders can learn about to be more proficient at their job. This section will teach you about defensive skill development through analyzing actual malicious network traffic for indicators of compromise and interesting attributes.

There are whole books dedicated to just learning about blue team skills. This section of this book covers just a few of those many skills, but it is intended to give you a good taste of that world and to give you practical hands-on experience. We will gain some experience with Wireshark, a network traffic analysis tool, and take a brief look at malware analysis.

Wireshark is a network analysis tool that every cybersecurity professional should be familiar with, especially if you're going to be a blue team or a security operations analyst. Wireshark analyzes network packet capture (PCAP) files. PCAP files are captured network traffic files.

Wireshark has a nice, clean graphical...

Blazing your own trail

Building and working through labs for hands-on cyber skills is great, but there are more generalized ways of getting experience and socializing yourself within the cybersecurity community. This section highlights alternative opportunities from the traditional 9-5 entry-level position that allow you to apply cyber skills in controlled settings and develop practical cybersecurity experience through methods including internships, conference events, non-profit support, and looking within your own organization.

Conferences – more than just talks

Cybersecurity conferences offer an amazing amount of opportunities for you to gain experience, network with people who can get you experience, and to get exposure to many topics in cybersecurity that you may not naturally encounter on your own. There are many cybersecurity conferences to choose from and taking advantage of them should be accessible.

Some of the larger ones that you may have heard of include...

Looking in the mirror

This section will show you how to look inward to show how you already have cyber experience and don't even realize it and, more importantly, how to showcase it on a resume. This technique is not exclusively for individuals pivoting from an IT career into cybersecurity, but it will be easier for those individuals with that work background.

One common mistake I see professionals make that are transferring into the cybersecurity field is that they think that they don't have any experience yet. I hear comments such as "I worked help desk," "I was a software engineer," and "I was a networking engineer."

Whatever their work background is, these individuals take on the position that they have not worked in cybersecurity. In this section, I'd like to challenge you and your assumptions that you don't have cybersecurity experience. Quite often, cybersecurity skills overlay many different parts of the business, and...

Summary

This chapter showed you how to build labs to gain hands-on skills so that you can experience working in cybersecurity. This will allow you to capture cyber work experience in your resume and to speak from experience during cybersecurity job interviews.

We also explored how to get a cybersecurity job and experience through internships and leveraging your current role. Internships and supporting information security offices at businesses provide you with real-world experience that is practical and helps you develop your skills.

Finally, we discussed how to take full advantage of cybersecurity conferences to professionally network, demonstrate your skillset, and learn about cybersecurity. I wouldn't blame you if you took a break to go find your socks, as I know this chapter blew them off.

Now that you have the necessary skills and experience, in the next chapter, you'll learn how to brand yourself so that you stand out among your peers and take the final...