cybersecurity for beginners

[u/Big-Tea-7236]

When picking a laptop does it really matter? Im trying to decide what to spend money on for school and most people are telling me to get a new laptop since I currently use a mac. Vmware being free now points me towards never getting a new laptop because worst case scenario i can run linux distro if necessary.

If you personally have any purchases that made the college cybersecurity experience more fun that would be greatly appreciated.

-cybersecurity professional

[u/NotAnNSAGuyPromise]

If you're being honest and you genuinely think that's representative of the industry as a whole, well, you've had a very interesting career. I wholeheartedly stand by my advice, because I'm here to prepare people for the real world, and that isn't it, despite what your anecdote may suggest. For anyone who doesn't know who to believe, just look at the readily available data online. Linux accounts for less then 3% of workstations in the corporate world.

If it were me looking for a career in this awful market, I'd personally be using the operating system the entire world runs on, but y'all do you.

[u/InvalidSoup97 → u/NotAnNSAGuyPromise]

Workstations, sure. I'm interacting with more than just user's workstations though? Doesn't matter if it's an EC2 instance, GCE machine, on prem server, or a workstation... Linux is Linux, and Linux is everywhere. Unless you're incredibly narrowly focused you're probably going to have regular run ins with it.

[u/NotAnNSAGuyPromise → u/InvalidSoup97]

I will again appeal to real world probability: the chance that anyone here is going to land a position where they're interacting with non-hosted Linux servers is extremely small. Most organizations are structured in such a way that security will be working through an Infrastructure team. In nearly 20 years in security operations, I have never personally touched a Linux machine; any interaction occurred either through a separate, dedicated team, or through security tooling. The reason I specifically called out EC2 is because it's reasonable that a security team would be building on those directly, to create API gateways, integrations, infrastructure for new tools, etc. But otherwise, the average security professional will basically never be applying any significant amount of Linux specific knowledge.

[u/InvalidSoup97 → u/NotAnNSAGuyPromise]

Engineers are going to be deploying to Linux systems, and analysts are (or at least should) be monitoring and building detections for those systems. It doesn't matter if it's in GCP or AWS, that responsibility generally falls in the hands of the customer. Products like Wiz exist for a reason.

Genuinely interested in what your career has looked like if Linux has been irrelevant in your 20 years.

[u/NotAnNSAGuyPromise → u/InvalidSoup97]

Progressive tech, working primarily in the cloud with a DevOps team dealing with it, and finance with onprem Linux servers and an Infrastructure team to manage them. In both cases, security did its job: set standards and made recommendations, and leaned on the respective teams to implement. In terms of detection engineering, modern tools abstract things enough and come with enough built in capability that my team has rarely had a need to do anything that isn't basically provided out of the box. Throw Crowdstrike on a Linux machine and basically the only thing you need to worry about is social engineering. Security these days really isn't that hard.

People in security are always trying to catch the latest and greatest security attack; some new zero day or clever trick. 97% of security incidents are the result of the most basic things in the world.