What does it take to be a Cyber Elite?

Patrick Jones wasn’t always one of the cyber elite. Long before he us, he began his career as a system administrator

How we think like the adversary to stay ahead of the adversary

He admits security wasn't always his top priority, concentrating more on just making things work. That changed when he met some co-workers who specialized in something called penetration testing. Patrick thought it sounded pretty cool, so he trained to switch roles.

“As a pen tester, I was throwing the exploits, trying to take over boxes,” he says. “We attacked systems from the point of view of the guy who wants to steal your information.”

By demonstrating where companies needed to strengthen their networks, he helped protect them from the actual bad guys. Now Patrick’s 12 years of pen testing invariably informs the work he does. He specializes in reverse malware engineering—taking the malicious software used to exploit vulnerabilities and tearing it open to see how it functions.“When I’m reverse engineering something, I’m like, ‘Oh yeah, this is what they’re doing,’ because I’ve thrown that same exploit,” he says.

Driven by money or politics, malevolent hackers are constantly finding new ways to infiltrate networks and avoid detection. Staying ahead of them means constantly updating your skills.

That’s why, “as a cyber elite, you need to be curious,” says Andrew Payne, another Booz Allen reverse malware engineer. “When you’re curious, you’re willing to learn.”

Andrew lists Twitter as an essential means of satisfying his appetite for cyber learning. “It’s probably one of the better resources due to its immediacy,” he says. “I follow a number of people who are heavily involved in the industry, even if not well known.”

“On any given day you might learn how to fly a new drone—or see if you can write something that will knock it out of the sky.”

Sites like Twit.tv and Krebs on Security, podcasts like Security Now, and subreddits like r/netsec round out his list of online authorities on cyber and related topics.

“We go to the Forge Hacker Space to learn hardware hacking. On any given day you might learn how to fly a new drone—or see if you can write something that will knock it out of the sky,” he says.

Resources like that are a big part of why the SANS Institute honored the firm. According to SANS, “employer-supported training to maintain the currency of skills [is] one of the two highest-rated factors that impact retention of highly technical cybersecurity professionals."