Chapter 3: Different Strokes for Different Folks

Now you know the different types of roles in the cybersecurity field, but there is another dimension to your career plan you must consider. The industry, sector, and environment will all influence the type of work and the driving mission of the organization.

In this chapter, we're going to cover the following main topics:

• Understanding cybersecurity pros and cons in several industry sectors
• Working in the public sector versus the private sector
• Introducing cloud platforms as an explosive cybersecurity opportunity growth area
• Understanding the typical organizational hierarchy structures of an information security office

The idea is, after this chapter, you will have a vibe for the various industry types and what you can expect working in any one of them. Personally, I work in healthcare and it's quite satisfying knowing the work I'm doing has a positive impact on people's health and...

Understanding cybersecurity pros and cons in several industry sectors

There are so many areas to work in but let's enumerate them so we can get our arms around them. The United States government's Cybersecurity and Infrastructure Agency (CISA) identifies 16 critical infrastructure sectors. These sectors represent the cross-section of critical assets, systems, networks, and capabilities that the United States depends on for national security and economic stability. Cyber threat-based impacts on these sectors could have a material impact on society. While this is focused on the United States government, it's reasonable to extend the importance of these sectors to other countries' societal support systems and overall stability.

These 16 sectors are as follows:

• Chemical
• Financial services
• Commercial facilities
• Food and agriculture
• Communications
• Government facilities
• Critical manufacturing
• Healthcare and public health
• Dams...

Working in the public sector versus the private sector

We spent some time earlier talking about working for the government, specifically, we went into the federal government in depth because of all the cybersecurity requirements outlined there through FISMA and other initiatives.

It's important to call out here working in the public sector, which would be the government, versus working in the private sector, which would be with private businesses and vendors. Some of the interesting things from a cybersecurity professional perspective is when you work in the public sector, you typically get lower salaries, and you are not authorized to accept gifts from vendors (such as tickets to shows, meals, travel to vendor conferences, golf outings, and so on). Also, you may find yourself pigeonholed in your job with certain roles and responsibilities, not being able to get exposure to other areas of the field.

Public sector jobs are more stable. The government occasionally does furlough...

Introducing cloud platforms as an explosive cybersecurity opportunity growth area

Let's spend some time talking about cloud security. The last 10 years have seen a massive paradigm shift in the traditional approach any business has had to support their information technology needs. Traditionally, businesses would have data centers, servers, and clients. All this (on-site) infrastructure was housed within their own environment. They'd have to hire networking staff, application staff, server administrators, database administrators, and so on in order to maintain the environment to allow their business to actually operate. The advent of the cloud paradigm has empowered organizations to migrate or offload infrastructure to these cloud providers.

As a brief primer on cloud service providers, the three big cloud service providers currently are Amazon AWS, Google Cloud Platform (GCP), and Microsoft Azure. There are different types of cloud service offerings also. There is Infrastructure...

Understanding the typical organizational hierarchy structures of an information security office

We've talked about different industries, sectors, and paradigms, but how is information security programmatically executed in an organization. You wouldn't have only 10 security operations analysts for a cybersecurity office and call it a day. You would be missing significant organizational elements. Let's explore what a typical cybersecurity program role and structure would look like. This way, you can identify the roles that Kim shared with how they interrelate and how you fit in.

The typical information security office organization can be seen in the organization chart in Figure 3.4. This structure is typical with capabilities grouped by function related to an information security program.

Figure 3.4 – Typical CISO organizational chart (This chart was redrawn from the http://jcsitnet.com/journals/jcsit/Vol_7_No_1_June_2019/1.pdf research...

Summary

In this chapter, we looked at some technical challenges. Regardless of the industry, all businesses need cybersecurity-minded professionals that are informed about evolving threats and attacks to be able to inform the business about dynamic risk and how to best mitigate it while continuing to enable the business to succeed. It's important to know how to speak to the business side, not just IT. This is critical in the private sector especially.

We've talked about many different industries, sectors, and business types in this chapter. You can get general cybersecurity knowledge and break into any of these areas and have a fruitful career, but there are industry-focused cybersecurity certifications and educational avenues that can help you stand out as the best candidate for a job, shortcut your path to having the knowledge to perform the work in that sector, and give you the skills to have an impact.

In the next chapter, Jon is going to share with you exactly...

Further reading

• [0] Beyeler, Walter E., et al. Copy of A Model: How Cyber-Attacks affect Brand Value in the Financial Industry. No. SAND2012-9898C. Sandia National Lab. (SNL NM), Albuquerque, NM (United States), 2012.
• [1] Deloitte Financial Services Cyber spend report: https://www2.deloitte.com/us/en/insights/industry/financial-services/cybersecurity-maturity-financial-institutions-cyber-risk.html
• [2] The Department of Defense Cybersecurity Maturity Model Certification (CMMC): https://www.acq.osd.mil/cmmc/docs/CMMC_ModelMain_V1.02_20200318.pdf
• [4] A breakdown of the CISA critical infrastructure: https://www.cisa.gov/critical-infrastructure-sectors
• [5] City of Baltimore shut down by a cyber-attack: https://www.baltimoresun.com/politics/bs-md-ci-it-outage-20190507-story.html
• [6] City of Atlanta shut down by a cyber-attack: https://www.wired.com/story/atlanta-spent-26m-recover-from-ransomware-scare/
• [7] City of Greenville shut down by a cyber-attack: https...