Want to be a Cyber Security Expert? Be an ethical hacker first.
Why following your passion may not be so cliché after all…
Follow you passion.
Beh… People say that these days like it’s easy as eating chocolate cookies under the sun with a sign saying: My life is perfect.
But there may be some truth in that. Angela Duckworth (if you haven’t heard about her, you should seriously read her work in her book Grit) mentions that the four elements that dictate if a person “will make it” or not are:
- Interest
- Practice
- Purpose
- Hope.
And you may be wondering? What does this have to do with Cyber Security and Ethical Hacking? Quite a lot. These are the same four elements that distinguished the best Security Stars from the rest.
Interest
On average, most of the security professionals that are not excelling at their jobs did not kick-start their careers in cyber security in their best pure interest. Most of them were guided by motives such as:
1) Job Security
2) High Salaries
3) Potential in a booming industry
Funny enough, the security stars were previous Amateur Ethical Hackers who were so deeply interested in the topic and realized that it is impossible to secure anything if you don’t know how to attack it. The interest was so deep that they could spend hours trying to find holes in the systems and therefore, also hours finding ways to patch them from others. Former Amateur Ethical hackers see this as a puzzle game and they cannot imagine having that much fun in their day to day jobs:
“I’m so lucky, I get up every morning looking forward to work, I can’t wait to get into the laboratory, I can’t wait to get on the next project” — Alex, little security breaker since his teenage years.
Practice
Success comes after hours of deliberate practice. If you are going to make sure to secure a system, you also need to make sure that you can see beyond the obvious. And that takes time. And the more you have practiced in the past, the quicker the analysis will be. Amateur ethical hackers spent hours (and hours and days) of deliberate practice trying to hack into machines (Hack the box, anyone?). That makes their day-to-day job very fun.
In comparison with the average non-passionate Security professional, they can find this exercise very frustrating. I always make a comparison between Ethical hacking and Chess. I do believe that both are very similar in their core nature. For both, you need to think steps beyond what the adversary may do and act accordingly. In order to become a chess/hacker grandmaster you also need (yes, you guess it right) deliberate practice.
Purpose
“The one that knows its why can overcome any how”
This quote has guided my day-to-day life and it is based on a very strong backbone. Logotherapy father Viktor Frankl takes about this in his book “Man’s search for meaning” where he explained that having a purpose helped him to survive the concentration camps. It doesn’t stop there, the Japanese concept Ikigai has been linked to the long lifespan of the people living in Okinawa, mentioning that having a purpose to wake up every morning is directly responsible for the long years lived by the Okinawans.
Having a purpose is also the backbone for any amateur hacker. They can range from “I need to get the root of this Linux machine or I won’t sleep calmly tonight” to “There is a very critical hole in this application that may impact hundreds of machines, how can I patch this?”. Having a clear goal in mind helps to overcome any how. And as mentioned before, hacking skills are not easy and they require deliberate practice. Not having a clear purpose in mind can lead to people not being consistent and dropping the practice by using any excuse: “I’m bored”, “This effort isn’t worth it”, “This isn’t important to me”, “I can’t do this, so I may as well give up”. Having a clear purpose will make you overcome these hurdles and excel as a security professional.
Hope
Aha… The hope that something better will come. That there is a better version of yourself in the corner. The hope that you will become the best ethical hacker. The hope that you will create the safest application. The hope that you will get down that machine and you will find that desired vulnerability. The hope that there is something there that you are willing to struggle for. The hope that something better is around the corner and it’s up to you to get it.
The so-called hope is what differentiates the average security professional from the former ethical hacker. Amateur hackers know that nothing comes easy and that is complicated. But with enough persistence and deliberate practice (including hours of rabbit holes and trials and errors) you can achieve anything. There is never a “good enough”. You can always secure better, you can always attack better. Average security professionals tend to accept the “good enough”. And this is not to be blamed, because if you cannot see the many chess combinations available, it is impossible to see that there is always a better future for security.
Before jumping into a Security Career, fall in love first. Fall in love with Kali. Fall in love with Burp and Nmap. Fall in love with netcat and Dirbuster. Find the beauty in that Linux server, in the Windows machine. Make love to the console and use terminator when needed. And find that purpose. It is what will make it shine.
The one that knows its why can overcome any how…
