For a fresh graduate with quite a bit of development (mainly web) background - what is the easiest way to break into the security field?

Are certifications a necessity? Is it possible to get intern jobs doing this kind of stuff?


  • What's your degree? – nmichaels May 2 '11 at 14:08
  • Senior at pretty well known school for Information Systems (BSIS) – user24325 May 2 '11 at 14:12
  • I would hope this is a full fledge university and not a technical college. If you have taken courses on security ( it doesn't sound like you have ) you will have a great deal work ahead of you. – Ramhound May 2 '11 at 14:31
  • Its a full-fledged university, ever heard of Drexel ? I am going to take (2) classes my last quarter dealing with IT/IS security – user24325 May 2 '11 at 14:33
  • My understanding of BSIS is that it is a biz/CS hybrid. is that correct? if so, i think the lack of programming, math, and obviously security/networking courses could be tough to overcome – jon_darkstar May 2 '11 at 14:43

When I did this, I did it by developing a web-based security related product. In my case, a CA (Certification Authority), but there's plenty of other options out there in security topics - web interfaces are used all over the place in device management, access control, log management, intrusion detection.

As a new grad, your best bet is likely to get hands on with the code, staring with technologies you already know and gradually learning areas of the system security stuff. If you want to bone up a little, look into security aspects of web development:

  • OWASP - has a great website
  • SSL understand the options for setting up SSL sessions
  • PKI - learn at least the basics, since this is a common mechanism for the higher end of SSL authentication
  • get familiar with some of the coding libraries that support this. They vary from language to language - for Java/JEE, I mean stuff like bouncy castle, NSS, the Java security packages. Also - not related strictly to Java - Open SSL.

I wouldn't recommend certifications right after getting your degree. Your skills are up to date, and as a new grad, you are (hopefully) the cheapest in salary that you will ever be -- which makes you seductive to companies with a lot of long term, expensive security engineers.

The certifications I know of in the industry are usually targeted to having a broad systems level knowledge and are based on the concept that the certificate holder already has a number of years of experience in the field. This is hard (if not impossible) to have going right after you graduate. The people I know pursuing certifications are all in the 5+ year range.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.