//What does it take to be successful in the information security field?

Normally I’d be posting something related to the Sony hack and why it doesn’t really matter that is was or was not DPRK and asking why everyone is so focused on the destructive malware versus the fact that Sony made many mistakes in the years prior that ultimately led to what we are witnessing in the media today, but I digress…

I’ve been doing this teaching thing for quite some time, 7 and a half years to be exact, and recently went back in time and added up all of the students that have had a course with me…which totals out to just over 800 as of last quarter.  I started thinking about not only how I got here but also how my advice and teaching style has changed over these years.  In thinking back, the one question that inevitably comes up every quarter in class is “what does it take to be successful in this field?” to which my answers are always almost the same.  I’m not basing my answer to this question solely on what I did or how I got to where I am, my answer is based on a combination my own experiences along with traits I’ve observed from others that I’ve worked with throughout my career who I consider to be great security folks in general.  I also think there are traits that need to be shed by some folks in our field as well, which I’m also happy to convey to those who ask.

So why am I writing this post?  Well, when I first started teaching I attempted to cater to everyone in the class and tried not to offend anyone.  Perhaps with age, and after many years of trying to make every student happy, I realized I was doing the students a disservice.  I wasn’t exactly treating them in a way that would clue them in on the general expectations of those in our field or in a way that would force them to learn traits that would make them successful.  However, and NOT to my surprise, I noted some students just don’t like this new method.  Some students just don’t like to be told that they are going to have to work hard, some just don’t like the fact that they may have to research something on their own, and some worry more about the grade than what they take away from the course that they can apply in their current roles or in the future.  At the end of every quarter the school asks (used to be mandatory) students to provide course evaluations back to the instructor along with comments on strengths, weaknesses, what they liked, didn’t like and so on.  And every quarter I’m both thrilled and dismayed after reading the comments.  Of course some people really enjoyed the course, some disliked it, and I expect that…but some disliked it for reasons you wouldn’t think.  And what is most dismaying is that some of these reasons fly directly in the face of what I think it takes to be successful in our field…and that worries me.

So what does it take?  For me I boiled it down to three main required traits: curiosity, perseverance, being able to learn new things on your own.

Let me start with curiosity – inquisitiveness, interest, and imagination…all synonyms of curiosity.  If you don’t find yourself asking “how or why does this work?” very often then you’re probably not curious by nature.   Curious people are fascinated by things that generally leads to a burning desire to know why and how things in this world work.  Curious people have been known to take things apart (sorry mom) and sort of put them back together.  Curious people like to build things as well, because starting with the pieces helps them to understand how it works, then they are likely to take what they just built apart and try to make it better.  I pair imaginative with this trait as curious people tend to find themselves thinking of new ways of doing things or finding unique solutions to problems.  We often find ourselves needing to ask how something works, or coming up with new or novel solutions in our field…so I put curiosity as one of my top 3.

The second is perseverance.  I feel this is a strong trait of people I see as being successful across many different fields, but also feel it is critical to carry this trait if your field is information security.  It is easy to get frustrated in our field just based on the breadth of knowledge it requires.  I don’t mean to say you need to know everything, but as my career progressed I found myself leaning on knowledge that wasn’t directly related to security that allowed me to see the bigger picture of things and how what I was doing was going to affect things that I previously wasn’t thinking of.  We also need perseverance as we are often beat down and blamed for “IT not working like it should because of security” or being the “team that says no all the time”.  I’m not advocating that you take a strong stance each and every time someone challenges you (being stubborn is not the same as perseverance), you need to pick your battles, and when you do you will need to stand your ground.  This trait leads me to the last one…where perseverance is required to not give up on something just because it is hard.

Learn how you learn, so that you can teach yourself new things in the future.  When I was an undergrad I hadn’t yet learned how I learn best, or better yet, how to teach myself.  By the time I was a grad student I had figured it out and learning, and courses in general, became much easier and fun which allowed me to focus on how to apply my newly gained knowledge to both past and future problems I would encounter.  I find myself learning all the time just to stay current, so if you’re going to stay current in our field then expect to become a lifelong learner.  Yes, I know this also applies to other fields as well, but I feel it is critical in our field given the pace of change.  I used to think this was a “young” student’s problem or a generational issue, but over time I found that to be a misconception on my part.  This seems to affect all generations equally based on my observations.  My advice is generally pretty simple, if you’re not curious or inquisitive and you can’t stick it out through perseverance it is unlikely that you’ll find yourself being a lifelong learner.  One thing that I get in the evaluations each and every quarter since I’ve changed my style is that “I can’t believe you said that we should use Google to answer our own questions”…which blows my mind.  When I started in this field I had Hacking Exposed and IRC…today’s new students of the field have Google, 100’s of published and unpublished security books, and way more educational resources than ever before.  So why not use them to your advantage?  Why is being asked to learn something on your own such a bad thing?

To conclude, I realize there are other traits that are required in order to be successful, but I feel that without the three I boiled it down to that the others don’t matter.  Finally, I realize that some people who aren’t strong in these three traits will still stay in the field and be satisfied with putting years into the field only to push buttons every day.  Which reminds me, I was watching Caddyshack the other day and there’s a line where Ty tells Danny that “the world needs ditch digger too”…relating that to this post I always make it “the world needs firewall admins too” in my mind.