97 Things Every Information Security Professional Should Know

Chapter 76. Get In Where You Fit In

Sallie Newton

First, welcome to the field of cybersecurity. The most important thing you need to know about cybersecurity is that security is not all bits and bytes. You do not need to be able to code or hack into systems to add value to this field. Cybersecurity professionals come from a plethora of disciplines. In fact, I know many InfoSec professionals from what might seem like unrelated backgrounds far removed from tech, like nursing, finance, and fast-food restaurants. What’s the relation? HIPAA, FinSAC, and PCI-DSS. My motto is: get in where you fit in!

Personally, I wondered if my business degree would help to prepare me for a career in cybersecurity. As it turns out, my business degree has served me well in this field. Cybersecurity is about risk to the business. Being able to quickly and accurately convey cybersecurity risk factors to management is a much needed skill set.

One such role at the intersection of cybersecurity and business is policy writing. Policy is the foundation of an InfoSec program; without it you have complete anarchy. Understanding the importance of policy is critical to an effective information security program. As a consultant, I worked a lot with policies and procedures and enjoyed helping companies increase their security postures by implementing rules best suited for their environment. Policies and procedures ...