The field of cybersecurity offers many different career paths to explore. From web security to risk mitigation and beyond, the options are expansive. Personally, I am interested in cybersecurity management and running a business. In this paper, I delve into various roles within the field, including those on both the red and blue teams. As I want to be a business owner, I need to understand how both sides work, so I will discuss different areas of cybersecurity and positions in them. Furthermore, I will be talking about different theories and how they apply to my career choice of a cybersecurity professional and business owner.

This paragraph will explore how blue and red teams work together to secure a network. To begin, blue teamers stationed in a security operations center (SOC) must comprehensively understand an attacker’s mindset. That is crucial because awareness of how an attacker might penetrate your network enables you to identify potential indicators of compromise (IoCs) and investigate them before they become a security incident—now moving on to the red teaming side. Red teaming is the offensive side of cybersecurity and is now required with blue teaming if you want a strong and secure network. “A successful red team campaign tests the many defensive facets of an organization via interactions with systems, users, and applications, and identifies the ability of these objects to impede the actions of the assessors” (Oakley, 2019).

Furthermore, the red team also tests the blue team’s response and playbook plan. Now, the blue team needs to be able to respond to alerts and quickly mitigate the issue or issues. That is why red and blue teams are vital to creating a solid network. 

Additionally, there are many different positions on the blue team side. One is a network security engineer. They must understand how to authenticate and authorize different users on a network because once an account becomes compromised, an attacker can move laterally to find the proper accounts to escalate privileges to a domain administrator account (Diogenes & Ozkaya, 2018). Another position is a security operations center analyst. Otherwise known as SOC analysts, they reset users’ account passwords and check alerts to ensure they are not malicious or escalate the problem to an incident response team. An incident response team responds to incidents like malware or network intrusion. They try to figure out what happened and how it happened to a machine.

Now, let’s move to how cybersecurity professionals have to understand social principles. First, cybersecurity professionals worry about human behaviors and user training every day. They need to know how they work to design human-centric plans and programs. Another example of social principles that cyber professionals have to deal with is victimization because their company may be hacked, or a user clicks on a link and they become a victim to a cybercriminal. They also need to quickly respond to the incident to limit damage down by the cyber attack. Something cybersecurity software developers need to know is human systems integration to help make configuration and development more human focused. They allow the cybersecurity professionals to better understand and secure their network with less errors. Without social science principles, cybersecurity can fall apart because humans are left out of the design process making it easier for misconfigurations.

Moving onto key concepts and their applications are white, gray, and black hats. White hats are cybersecurity professionals who have permission to hack or defend a network (Kaspersky, 2021). These would be contractors, incident response, and other blue team jobs. A gray hat may have some permission or no permission (Kaspersky, 2021). These could be security researchers or people that want to test their skills. However, they will most likely report the issue they find with the network. Now, black hats hack for financial gain, power, or just because they can (Kaspersky, 2021). They do not report the vulnerability and will most likely abuse it. Criminals and dark web forms to sell data to other criminals. However, I would be looking for white hats and converting gray hats to my company because everything I would need to do has to be legal. I would be looking for the best of the best and people that are willing to learn even if they do not fully understand the topic at hand. I need problem solvers and white and gray hat hackers are great at solving problems.

Furthermore, we can apply  Neutralization Theory to gray hats because they most likely know they are doing something wrong. However, they rationalize what they do to help the organization or secure the internet. Additionally, as an owner I would have to rationalize how pros and cons of every decision I and the company make. Another theory we can apply is Reinforcement Sensitivity Theory (RST) to all three types of hackers. Black hats most likely enjoy the rush of adrenalin they get after getting a successful hack. White hats are patching a network from a vulnerability—finally, gray hats when they get in like a black hat. RST also applies to owning a business because I would get adrenaline rushes from closing big deals, and securing fortune 500 networks.

Moving to the topic of marginalized groups in cybersecurity, as a company owner. It is essential to understand diversity and why it is so important. Embracing different backgrounds and ideas is key to building a strong, independent team, and that’s why I would hire people from different backgrounds. I need a strong team to stand out from the rest. Unfortunately, women remain significantly underrepresented in technology compared to 25% of technology professionals (Leclair & Pheils, 2016). According to the U.S. census, women make up 50.4% of the United States population. This disparity displays the need for greater inclusivity in the industry. I would help solve this problem by hiring qualified women to my team, and building from there.

Furthermore, people in underrepresented communities have to worry about not receiving the proper cybersecurity hygiene education, allowing them to be victims of scams at a higher rate (Cornish, 2021). Additionally, they are at risk of their critical infrastructure failing first because of underfunded infrastructure. I can solve this problem by offering my services at a discounted rate because I would be working with the government. Allowing me to laterally move to other underfunded areas and help them with risk management. Another underrepresented group is children. Depending on their school, they may receive some cybersecurity lessons. However, a majority need more training. I would try and solve this problem by funding a few students to get certifications and providing free resources for others.

Exploring the connection between my career and society poses a challenging question. While I am not particularly interested in network administration, I aspire to establish a contracting company that collaborates with government and private entities. As a result, I will protect critical infrastructure with red teaming drills and help companies secure their computers with proper risk management profiles. Furthermore, I must protect the company’s privacy and data. As a boss, I will oversee efforts to protect sensitive data and preserve individuals’ and companies’ data. I will be leading the next generation of cybersecurity professionals and help teach the new generations of cybersecurity professionals.

References

Cornish, P. (2021). The Oxford Handbook of Cyber Security. In Google Books. Oxford University Press. https://www.google.com/books/edition/The_Oxford_Handbook_of_Cyber_Security/Q9FGEAAAQBAJ?hl=en&gbpv=1&dq=marginalized+groups+in+cybersecurity&pg=PA775&printsec=frontcover

Diogenes, Y., & Ozkaya, D. E. (2018). Cybersecurity – Attack and Defense Strategies: Infrastructure security with Red Team and Blue Team tactics. In Google Books. Packt Publishing Ltd. https://www.google.com/books/edition/Cybersecurity_Attack_and_Defense_Strateg/pyZKDwAAQBAJ?hl=en&gbpv=1

Kaspersky. (2021, April 9). Black hat, White hat, and Gray hat hackers – Definition and Explanation. Usa.kaspersky.com. https://usa.kaspersky.com/resource-center/definitions/hacker-hat-types

Leclair, J., & Pheils, D. (2016). Women in cybersecurity. Excelsior Niche.

Oakley, J. G. (2019). Professional Red Teaming: Conducting Successful Cybersecurity Engagements. In Google Books. Apress. https://books.google.com/books?hl=en&lr=&id=tFOMDwAAQBAJ&oi=fnd&pg=PR5&dq=red+teaming+cyber+security&ots=346PTMoU0o&sig=n4kk1K6rzy_S-SDUAdK3Iihgbe4#v=onepage&q=red%20teaming%20cyber%20security&f=false