As we approach the end of the first quarter of 2019, many cybersecurity professionals are trying to predict what new threats could emerge in the remainder of the year. Many believe that phishing will still remain the top threat vector out there, but its growing levels of sophistication and covertness will greatly expand as the year goes on. It’s becoming much more difficult to tell the difference between a spoofed and an authentic website.
Cryptojacking is also estimated to emerge as a top contender as well, as the virtual currency market gains a stronger foothold in the financial markets and E-Commerce; but many forecast that the malicious use of artificial intelligence (AI) and machine learning (ML) tools will be the newest threat vector.
Given this reality, the need for highly skilled cybersecurity professionals will only continue to escalate in demand, especially as it relates to the Cloud. One such role that is expected to be “red hot,” not only now but in coming years as well, is the role of the cybersecurity consultant.
What is a cybersecurity consultant?
Given the many job titles out there, it can be difficult to get a good understanding of what a cybersecurity consultant really is. Here is a good definition of cybersecurity consultants do:
“A cybersecurity consultant performs a variety of roles within the cybersecurity field. They play both the attacker and the defender in computer systems, networks, and software programs. Seeing what weaknesses there are and figuring out how to strengthen systems to prevent hackers from exploiting vulnerabilities.”
From this definition, one can see the overall picture of what a cybersecurity consultant is and what they do. It is important to keep in mind that this is such a broad job title, so it will involve wearing many hats and working with various types of people in the organization, both IT and non-IT related. The cybersecurity consultant can play both sides of the threat landscape. For example, they can act as the good guys that are trying to protect the lines of defenses of the business or corporation, and they can also act as the cyberattacker.
Because of the dual nature of this role, you will often find that the cybersecurity consultant will be working heavily with penetration testing teams. For instance, they can work on both the red and blue teams and offer their insight to the organization as to how they can better protect themselves from looming cyberthreats. They can also be found working very closely with threat hunting, incident response, and even forensics investigations teams.
Other specific job duties also include the following:
*Ascertaining the most cost-effective methods when it comes to securing the IT infrastructure of an organization. This includes all the assets such as the workstations, wireless devices, the network topologies, software applications, and any proprietary customer information and data. This also includes finding out ways in which to better protect the endpoints of the entire IT infrastructure.
*Interviewing both IT and non-IT personnel in determining the overall security issues that the organization faces, both from an internal and external standpoint.
*Conducting vulnerability and risk assessments.
*Determining and implanting the appropriate security related best standards, practices and controls.
*Create IT related benefit/cost analyses which are often used by C-Suite.
*Plan and deploy the various network configurations for the IT infrastructure.
*Work with all of the IT teams (especially the pen testing team) to prepare final reports on any security weaknesses and vulnerabilities and the solutions that can be used to mitigate them.
*Work as a project manager for a software development team.
*Help craft and define what the security policies should be for the organization.
*Assume responsibility for the software and firmware upgrade/patching processes.
Our next post will further examine how to become a cybersecurity consultant, and what it takes to become successful in this field.
