LTR102 - Teaser

I started writing LTR102 a while ago but have decided to release a teaser chapter of the new book for free for folks to check out and feedback on. This is the introduction and chapter 1.

Enjoy!

Expanding your horizons and surviving in security, this is my next book following hot on the heels of Learning the Ropes 101. If you have read the first book, welcome back! If not, and this is the first time you have picked up something I have written, welcome. I hope you enjoy the content I have put together.

Like the first LTR101, this book started as a blog post and was going to be one extensive guide for folks who have just started in the industry but have not found their footing or have not looked at more technical topics that quickly grew arms and legs. As a result, it will now become a second book/ebook, with accompanying posts along the way with general hints and tips.

Why Another Book?

Following LTR101, many people have gotten in touch to say yes in fact, the book helped equip them with the necessary skills to begin their journey into the security industry. Thus the lessons learned and topics covered in the first book are going to be built upon. Secondly, as the first focused on penetration testing and bug bounty hunting, I hope that this one can cover some broader topics that are often overlooked, such as defensive things, understanding risk management, architecture design and many more. It won't be a bible for all the things, but I hope to give folks starting out an excellent fundamental understanding of a wide range of topics.

I decided to write a second book for several reasons, the primary one being that a lot has changed since I first released LTR101 five years ago! There are many more people in the industry now than back then, which is great, plus there are lots of other paths into the industry that are not just offensive security. As a result, I felt that the need for a more expanded introduction was needed to direct folks down different paths and give them the tools and techniques required to expand their knowledge in the various flavours of security.

The assumed level of knowledge for this book is; aimed at anyone who has a fundamental understanding of the topics explained in LTR101. These are detailed below:

• Core Fundamentals - Explains the basics of how networking and the internet works.
• Operating Systems - A sub-section for each operating system and the benefits/tools for each.
• Virtualisation - Explanation of what it is and why it is helpful to know about it.
• Programming - Some fundamentals on logic and scripting.
• Infrastructure - Building on the essential networking, explaining the role of infrastructure in penetration testing.
• Web Application Testing - breaking down web application testing and what is involved, some methodologies and tips.
• Importance of Reporting - Explaining how to compile your evidence professionally, also expanding on how to write a good report.
• People Skills - How to build your connections and get your foot in the door.
• Penetration Testing - Explaining what is involved in the job, what to expect and how to keep
  learning.
• Hacking Your Career Path - Some tips on preparing a CV & applying a more creative approach.
• Further Reading & Resources - Links and books to checkout to further your learning.

Additionally, if you have any recommendations or requests for additions, please contact me on Twitter.

Is this Book for you?

I will explain some fundamental concepts that some people may find easy to understand, whereas it will just click for others. So hang on and bear with me, please.

Scratching the itch of wanting to learn this stuff; Following on the main chapters in the first book, this section will take steps to explain some core technical fundamentals in a relatable way which hopefully you'll understand. It will also build out concepts of different attack paths and follow more information about each subject. It will be by no means the be-all and end-all of knowledge as there are already excellent books that cover a lot!

Explaining the business side of each topic; Behind every technical consultant, penetration tester or defender, there is a mindset of reporting to the business. This section will give the reader some hands-on tips about good things to mention when translating topics into business sense as not everyone is a 1337 h4x0r!

Logical Thinking and Soft Skills

Starting off from a non-technology standpoint. One of the key points often overlooked in the security industry and IT, in general, is logical thinking. If I do an action, what is the likely reaction? While this applies to all aspects of life, it is also closely tied to tech.

This lesson is about how to learn a critical skill set to have. Hacking, in reality, is a creative process that is based more on lifestyle than teaching. I cannot teach you every possible topic that you need to know, but I can help you recognise what you need to learn.

This is also true due to the constant advances in the field of technology and specifically security. What I teach today may not be relevant tomorrow, but by understanding the fundamentals, you will be able to go onwards and learn more. You should embrace the hacker mindset and the learning habits, which are probably the most vital part and separate you from mere muggles(a person who is not conversant with a particular activity or skill).

Think of this scenario, if I am using a shopping website and manage to set the price to £0.00 or even a negative value -£1,000,000. What happens? Well, in a broken situation, the site might permit you to gain the item for free! Or even worse(I've seen it before), credit your account with the negative value!

Another critical topic that often is not covered in learning materials is soft skills which are arguably one of the more essential skills. The ability to provide coherent communications be that over the medium of voice, the text of in person!

Core Topics

Over the following few chapters, I aim to explain the different areas you'll want to look into and better understand the technicalities. I believe that anyone can become technical if they are willing to learn.

Fundamentals Recap

The first chapter flies over a recap of the first book to catch you up on some of the content to be covered in this book. The primary objective will be to bring the reader up to a standard level of understanding and then build upon it. If you have just read LTR101 or already know a bit about security, please skip this chapter.

Different Flavours of Security

Once we are all on the same page, the second chapter will dive into the different colours and flavours of security. While the first book focussed heavily on the paths into offensive security and bug bounties, this book aims to look at security from all angles and provide you with the tools and methodologies to help you further your learning. This chapter will look at the different routes into different areas and topics you will need to understand and learn along the way. It will also attempt to open your eyes to the other side; for example, if you are defensively focussed, it will explain offensive security and vice versa.

Certification Paths

Knowing about the different aspects of security is excellent, and this chapter will look into some of the certification paths that can be followed to learn how to find your way. It is also important to note that not all certifications are made equally and that certifications are not the end-all and end-all. As a result, some folks do not need certifications or do not go down that route.

Learning The Trades

This chapter dives into the different trades involved within the field of information/cybersecurity. The primary goal will be to explain the different areas involved in the offensive, defensive, risk, and other security aspects from both a high level and a technical path walkthrough.

Pentesting & Incident Response: Consulting

Once you are familiar with the different paths that can be taken from both a self-learning perspective or academic or both. The next step is understanding that not all the skillsets involved in offensive or defensive security are technical. Especially if you plan on going into an incident response or penetration testing as both involve a large amount of client interaction and reporting, therefore understanding some of the nuances required when it comes to consulting and client engagement.

Surviving in the industry

This chapter explains some survival tips for expanding your knowledge in the field and bridging gaps in your understanding. For example, if you train in a blue team and want to transition into learning about offensive security tooling and techniques, this section will give an insight into what is required.

Security Research

In LTR101, I touched briefly on programming fundamentals and some of the core requirements. In the security research section, I hope to expand on the understanding from a coding perspective and explain some programming fundamentals and different languages that can aid you in security research. I will also explain the other expanding areas and hone your skillset to grow constantly and build a research toolkit.

Continuing Your Career

Finally, once you have had an overview and deep-dive walkthrough of the different areas of security, the paths that can be taken and the constant learning paths that can be expanded. The next step is to understand the approaches that can be followed to further develop your career, including typical career progression and jumping between teams and sides of the security attack defend coin.

Thank You

Thank you for buying, downloading and sharing this book; I hope you have learned at least one new thing from reading it. Please feel free to message me on Twitter or email me some feedback and thoughts on the book.

Like the first book, my aim is to keep the eBook version up to date with new techniques and links where possible. In addition, like the first book, I also aim to have some physical copies made up; therefore, if you are reading this physically, you are one of the lucky few!

Now you have read this, all that is left is to say best of luck in the industry; I hope you continue developing and learning. If you see me at a conference, please come and say hello; I'm always happy to speak to folks!

Feel free to share it with someone who might benefit from it, be it a physical or digital copy. Sharing is caring, and the more folks learn, the better we become as security professionals.