97 Things Every Information Security Professional Should Know

Chapter 14. A Diverse Path to Better Security Professionals

Catherine J. Ullman

Like many InfoSec professionals of my generation, my background is not in computer science. I wound up in my first technical support role after discovering that my original, nontechnical career path was unsuitable for me. A good friend suggested I explore technology. Twenty years later I find myself firmly entrenched in the security field. In retrospect, a letter of recommendation from a former supervisor containing the statement, “Cathy is very good with computers” was very telling. As a result, I would argue that there is no specific path one should take to get into computer security. What matters more is obtaining some key skills on that journey, which are not necessarily technical in nature. Let us explore them now.

First, communication skills are essential for success in this field. Security professionals, whether entry level or advanced, are often asked to explain technical ideas to people who are not technical. Furthermore, it is not uncommon to be asked to communicate ideas to people at different levels within an organization. The ability to express one’s thoughts effectively and efficiently, either while speaking or in writing, is a must. Effective communication involves listening (or reading carefully), not just speaking/writing. This step provides feedback so that both parties know whether ...