George Papakyriakopoulos

Modern implementations are expected to provide more granular controls around allowed and blocked traffic, with approaches such as context-aware access and application-aware access. Just filtering based on IP addresses and ports is no longer enough in a cloud native world. Rather, a modern firewall must understand the concepts of identities (users and applications), provide posture assessment capabilities based on factors such as time of day, geolocation, role-based access control, connecting device state etc. as well as being aware of higher layer concepts (application actions, API endpoints etc). These features must be available to be included as part of policy enforcement and must be configurable in an automated and adaptive way.

Establishing and fostering a blameless culture is a must to de-escalate conflict and get your point across. When a new security gap is introduced it is a collective cultural failure and lack of proper awareness rather than a failure of a single engineer or team. It is the security team’s responsibility to build a culture where people are not afraid to make mistakes, but at the same time they understand and share the associated risk and are willing to reach out to the security team when they are uncertain about a decision and the risk it carries.

It cannot be stressed enough that cybersecurity is a vast field that breaks into various specialisations, other more technical and other more administrative in nature. The first step to advance a cyber career is to dub into multiple specialisations and gain distinct skills (penetration tester, SOC analyst, threat intelligence engineer, security consultant, devsecops engineer etc). By building a wide range of cybersecurity skills you achieve two main outcomes. Firstly, you can identify what specialisations interest you more and focus on advancing your career towards those expertise areas and secondly, you can unlock more senior positions (security manager / lead / director) by having a broader skillset that is usually required.

Somewhat controversial but I would argue that cybersecurity is an “advanced” field in IT, meaning that it requires baseline experience and understanding of core IT concepts as well as prior IT experience before someone ventures into cybersecurity. A background and previous experience in system administration, cloud engineering and/or application development paired with a strong hands-on security certification (OSCP, CPTS etc) can do wonders in opening up opportunities in junior friendly cybersecurity roles.

It is also very important to understand what sectors of cybersecurity you are aiming for as a future career. Cybersecurity boasts a very wide array of concepts and technologies that often require completely different skillsets and career planning. Are you aiming for an offensive role requiring penetration testing and security assessment skills ? Are you looking to be part of a blue team requiring incident response and management skills ? Are you more interested in the GRC side of things requiring a more consulting-based and compliance-based skillset ? Understanding your aims will help you understand your current level relevant to your target goal and the next steps to take to make it there efficiently.

I would strongly recommend gamifying every aspect of cybersecurity especially for tech-focused individuals. Running internal CTF and security hackathon events for engineers, keeping scores and offering nice rewards and presents for the top performers greatly helps foster an amazing “security champion” culture within teams, with people becoming representatives of the security team within their teams and spearheading efforts to improve and enhance security posture across the organization. Simulated phishing can also be gamified to reward people with top scores and further reinforce their “phishing detector” mindset and the dopamine factor at play when someone wins in a competition helps reinforce positive security manners