HOPE 2020: How to Turn Your Hacking Skills Into a Career
My discussion panel talk at HOPE 2020 - How to Turn Your Hacking Skills Into a Career.
Thomas Kranz
Tom’s career has spanned over 25 years, as a consultant within Cyber Security and IT. After a successful career helping UK Government departments and private sector clients (including Betfair, Accenture, Sainsburys, Fidelity International, and Toyota), Tom now advises and supports organisations on their Cyber Security challenges.
Tom lives with his partner in Italy, where they rehabilitate their collection of rescue dogs and cats, as well as managing their many opinionated ducks.
Now available, Tom's new book - Making Sense of Cyber Security from Manning.
Pourquoi la cybersécurité doit être une priorité du conseil d’administration
Cet article se trouve également dans ce contenu premium en téléchargement :
Il est de plus en plus évident que les cyberattaques ciblent désormais délibérément dirigeants et membres des conseils d’administration. Ce qui montre que les assaillants pensent trouver là des individus particulièrement précieux, mais tout aussi vulnérables.
Is There Really a Cyber Security Skills Shortage
Companies are struggling to find cybersecurity talent, and roles remain unfilled for months at a time. But is there really a lack of qualified candidates on the market? Is the problem with the lack of skills - or are we inadvertently limiting the talent pool before we even post the job spec?
Why contact tracing apps don't work, and why the UK's NHSX app will fail
People are fed up of lockdown. Families want to get out, people need to earn money, and employers want their teams back at work. Contact tracing apps are being floated as the solution to easing the current lockdown - but will they work?
NCSC (the partnership arm of GCHQ) has been busy reassuring people that the NHSX app is secure, useful, and that everyone should do their part and install it. But is that actually the case?
The first problem is that the development team have decided to not use
Why interception of WhatsApp and Facebook Messenger isn't just flawed, it's dangerous
There have been a number of articles in the press recently on how the UK government has agreed with social media platforms like Whatsapp and Facebook to share user's encrypted messages with police. While it's true that GCHQ and various civil servants have been trying to push for interception capabilities on these platforms for a while now, despite the headlines, nothing has actually been agreed. This is down to two main problems: that encryption doesn't work that way, and that the proposal is da
Building your career in Cyber Security: Certifications
"The long term benefits of sunscreen have been proved by scientists, whereas the rest of my advice has no basis more reliable than my own meandering experience. I will dispense this advice, now."
Following on from my previous article about getting started in Cyber Security, I want to move on to certifications. I've interviewed a lot of people over the years. A lot. And then I've had to built out and lead teams for various clients with the people I interviewed and hired. Certifications are a rec
How do I get into Cyber Security?
Along with "You can't say that" and "Hey, how'd you get in here?", one of the things I've been hearing from people recently is "How do I get a career in Cyber Security?" I thought I'd throw my notes from those conversations in a sort of Liber Primus for those interested in moving into Cyber Security - either as a side hustle or a career.
First: what is it you actually want?
I need to be honest - if you're in it for the money, there's much better options out there. Work in finance. Become a pol
Google do not care about the user.
Google had previously tried to break usability on the web by removing the “www.” and “http(s)://” parts of the URL displaying in Chrome. Facing a strong backlash from users, they quietly shelved the plans.
Now they are trying again, with the same nonsense excuses for it: “ The Chrome team values the simplicity, usability, and security of UI surfaces. To make URLs easier to read and understand, and to remove distractions from the registrable domain, we will hide URL components that are irrelevan
The ICO’s £183m GDPR fine for British Airways is the wrong thing to do
There’s lots of flag waving about how the ICO finally has some teeth, and how GDPR is going to keep companies on their toes from now on. Nothing will change.
GDPR will have no impact on cyber security apart from employing a lot more auditors, with even more ineffectual checklists. The ICO’s “record breaking fine” will result in zero improvements in cyber security.
Companies should be punished financially for having weak security when handling customer’s data — but it’s the executive team who s
Weightmans - Preventing cyber risk and creating resilience
BIBA 2019 Conference: Cyber risk is becoming more and more prevalent! Especially for businesses, how can insurance help?
All the gear and no idea
Support when you need it, where you need it.
Even with high-tech security in place, many companies still suffer cyber attacks due to simple set-up blunders.
Most companies that suffer a cyber attack believed it would never happen to them. What makes it even harder to understand is the costly, cutting-edge security they had in place to deter hackers. But, these strong defences turn out to be a cyber Maginot Line if they’re not activated or deployed properly – ineffective because they could be e
Ways to close the digital skills gap in cyber
Tom Kranz, Director of Cyber Lab at 6point6, a technology consultancy, writes that the digital skills shortage is a permanent thorn in the cyber industry’s side that needs to be tackled now before it’s left to fester any longer and cause real long term damage.
Despite being exaggerated by many as a full-blown crisis, the talent shortage is actually something that needs properly addressing, not hyperbole. With hackers ramping up attacks and developing increasingly sophisticated tools and methods
Why cyber security needs to be prioritised at board level
There is growing evidence that cyber attacks are now deliberately targeting executives and board members – not businesses themselves – which shows that attackers believe this group is particularly vulnerable as well as valuable.
More must be done to raise awareness of potential cyber threats at board level, as well as supporting businesses in developing a strategy that offers solutions to combat potential weaknesses in a company.
Typically, hackers attack companies and their employees to steal
Why companies can't treat cyber as a bolt-on
To access this content please sign in or register below for free
Breaking the chains: How FUD is holding the cyber sector hostage
Fear, uncertainty and doubt (FUD) has become an ever-looming cloud over the cyber sector in recent years as companies and suppliers pounce on the opportunity to capitalise on this rhetoric and peddle their wares to fearful customers. To misquote the age-old advertising maxim: fear sells.
Of course, the big problem with this is that customers and, businesses – people – become immune to the constant avalanche of outlandish claims and equally outlandish fears. “FUD fatigue” is something that, unfo
Being Successful in Cyber Security
Cybersecurity can often seem like a murky world of espionage and counter-espionage; where men in blacked out vans kidnap carefully chosen nerds from the streets of the country’s small towns to keep us safe from those pesky bad guys. However, to succeed in the world of cyber security you do not require a specific set of skills as the Liam Neeson of Taken 1, 2 and 3 will have you believe. This does beg the question of what do cybersecurity experts look for when hiring the next generation of keyboa
The Matryoshka Dolls of IT
I often get complaints from clients that their IT projects are always cumbersome, delivered late and over budget. They’ve had an impact on the business, certainly, but it’s far from a positive one. There’s a lot of blame to go round for this, and finger pointing can be fun, but what needs to be done is to get our C-level stakeholders and project sponsors to understand the implications of proposed work versus timelines.
Building a solution as a green field implementation is easy - there’s nothin
The DAOO Loop
Everyone should be familiar with John Boyd’s OODA loop - Observe, Orient, Decide, Act. There are a number of variations (pick a favourite!) but the basic premise remains the same: you gather information before acting.
Witnessing recent transformation projects that have run into difficulties, or foundered completely, I’ve seen people trying to use a twist on this - the DAOO loop.
Transformation projects are complex, and as I’ve discussed before, they should never be driven by technology or impl
On the S3 outage and Agile Cloud Native Serverless failures
Our newsfeeds are filled with hundreds of articles about Amazon's S3 failure on Tuesday. Doom, gloom, S3 down in US-East-1 and cascading failure - dogs and cats, living together: mass hysteria! It's been covered on Forbes, Business Insider - even The Daily Mail and The Sun (hardly bastions of technology reporting, but "OMG Instagram is down!" cuts off their supply of click bait).
The real story is not about S3 taking a nap, nor about the cascading failures across Amazon's services, nor about Am
Why digital transformation fails
A 2013 report by McKinsey showed that 70% of transformation programs fail. We’ve all seen our fair share of high profile disasters - the BBC digital transformation, the NHS National Programme for IT and the Co-Op Bank’s failed core banking systems replacement are all prominent examples.
Working with many clients across different vertical markets, there are a few common themes I’ve seen. These can basically be boiled down to:
• technology is an enabler, not the solution
I see the first one cons
Load More Articles
