97 Things Every Information Security Professional Should Know

Chapter 93. Things I Wish I Knew Before Getting into Cybersecurity

Valentina Palacin

The first time I went to a security conference I felt overwhelmed. I couldn’t understand a thing. One of my then coworkers told me, “Oh, don’t worry, nobody does.” Of course, my coworker was joking, but the joke made me feel less self-conscious about my shortcomings since a lot of attendees were in the same “learning boat” as me. With time, I also realized that at conferences, we see a lot of really cool but advanced practices that are miles away from the reality of most companies, especially on the blue-team side of security.

The problem is more acute depending on where you are in the world, but even in the US, most companies are still approaching security from a reactive perspective. The “hacker imagery” marketing for security products has been around long enough that people easily understand the benefits of buying a detection tool or carrying out black-box pen tests. However, if you start by talking about operationalizing threat intelligence, you will have a much harder time convincing management about the benefits of a more proactive, but also costly, intelligence-oriented approach.

Companies, particularly those that have enough capital, really like tools. The general belief is that for any problem there is a vendor solution that can be tried. They would rather pay for a tool that promises ...