For the new cyber security consultants, either your internal or providing consulting services to clients. Speaking this from GRC point of view, most consultant may ignore the fact that for one being effectively in providing sound advice to clients, especially in this modern era of cyber security, one need to at least understand what need to be protected i.e information asset.
Information can be physical or digital/electronic. Information has its life cycle, and go through phases such as creation, processing, and storage. There is a famous data cycle – refer to this blog as https://www.securosis.com/blog/data-security-lifecycle-2.0 . All the phases information will need to be protected.
Diagram: The data security life cycle.
Through this life cycle, when considering digital form of information, it will touch different layers such as Computing, storage, network, and well all these things they just don’t live in the vacuum (cloud), they need to physically hosted, that’s where physical security comes into play.
I believe in deconstructing things to its core or the basic bare. I think the areas below, a cyber security consultant should at least have some high level understanding on how things work and how they are built. (architecture)
- Application and Software: Programming
- Computing
- Storage
- Network
- Virtualisation (plus containers)
- Cloud anyone (understand the top four first)?
