 Think Tech Hawaii, civil engagement lives here. Welcome to the Cyber Underground. I'm your guest host, Rachelle Monsilongan, and today's episode, we're going to find out how to start your career in cybersecurity, part two. So the cybersecurity field, as a student, I know that this is a hot and pretty lucrative, financially lucrative career. But what steps could you take to get a head start into this career? What should students do to prepare themselves for the cybersecurity industry? And so today I have a special guest. He's a close friend and a classmate of mine, Nathaniel Weeks. And 10 months ago, he was on the Cyber Underground with Dave and Andrew. And talking about the same topic, but since then, his cybersecurity journey has grown and we both are almost at the home stretch for our career, so, our education. So, Nathaniel. Good to be here. Great, having you here. And do you want to tell us a little bit about yourself, your background? So right now I'm a junior at University of Hawaii, West Oahu. I'm in the Information Security and Assurance Program. And I'm also the Information Control Systems Analyst at the Cyber Security Coordination Center. And that's with Matthew Chapman, correct? That's correct. So we do research. We have, we each, in the center, each have a specialized field. And I do research on the industrial control systems. Awesome, okay. And then, do you want to tell us a little, just go kind of backtrack and see like how you started into this. Why did you choose cybersecurity? Right. So, yeah, last time we had a similar thing that we went over where, you know, I started off in IT, actually. So I was going for an associates in IT. And then I started hearing about all the opportunities coming up in cyber. I think one of the only other fields that was competing is data analytics is booming right now as well. Right, yes, right. But they were starting a new program at KCC, Copioloni Community College. And it was focused on cyber security. And so, you and I were two of the first students through that program. And it definitely helped propel us toward the program that was going on at University of Hawaii, West Wahoo. So that's, I mean, that's currently where I'm at. But I mean, previously I was kind of endlessly going to school and I didn't really know what I was going for. But it's really given me a purpose and the professors have been great and definitely give you something to keep pursuing all the time. I'm never bored, I'm never, there's always stuff to do, right? Right, right. So what are some steps so that you did to get your career started? Right, so, I mean, step one was to start learning my own time and take classes. Right, so you invested in your education, that's one route to take. Right, right, yeah, I mean, it's an investment, right? So you end up putting in a lot early on. But the payoff for this career field is pretty good. So after that, after I started taking classes, the classes corresponded to certifications and so I did those as well. And you earned quite a few. So Nathaniel's one of my classmates that has like, I think six. So I always tease him that one, I think after you find a graduate from West Wahoo I'm gonna buy him one of those accordion wallets and he'll just drop in and show us, telling him I'm gonna get you that. I'll probably do well in the interview, yeah. Yes. No, I've got five. One of them's not really a certification, but I took the exam. This was the most recent one, the CISSP exam. So I took the exam but it requires five years of experience without a bachelor's degree and four years of experience with a bachelor's degree. But they give you enough time so that if you take it and you don't have the experience, they'll give you six years to accrue that experience from the time that you take the exam to bump it up to the certification. So I don't actually have to take the exam again to get the certification. I just have to work over the next few years and document my work and then I'll get the certification. So this is the CISSP. That's correct. And so Nathaniel and I are taking a class together, it's on Saturday. So because he passed this exam, he doesn't need to take the final, which is awesome. Yeah, I think I was the only one to take it. Yeah, he was the only one in our class. One of the other students was planning to take it. So they may have an update this weekend. OK, awesome. You'll have to let me know. Oh, yeah, I'll let you know. I think that's our last class, right? So then our final. So what else would you recommend for students for studying for their certs? Are there any sources that you would recommend them using? Sure. So in addition to, like I said, I line it with classes, right? So we're in the CISSP class. It's above where I'm at to take that exam right now, right? This is a management level certification. It's really ahead of where I'm at, but I wanted to at least get the most out of the class. And so I wanted to take the exam at least and also skip the final. So that's great. So if you're taking a class, that's great. That'll help you a lot. But a lot of times in the class, you learn the material, but you won't learn in the context of the questions that you're going to be asked on those exams, because they can be pretty nebulous, right? You can read into them. But it's hard to decipher what the question's even asking sometimes, right? So even knowing the material, you have to be able to think like how they're thinking when they ask the question. So I used transcender practice exams. It's now Kaplan IT, I believe. And there's Total Tester that may be by Cengage. And there are a few other sources I use as well. And are these free or you have to pay for them? Everything that I use is an investment, right? That's what I always refer to it as. But yeah, you end up spending a pretty penny on it. The exam itself was $700, right? And then before that, the one I took before that was the CEH. That one was roughly $600. And so that was the certified ethical hacker. And five other or, well, three other exams or certifications that I got. And then network plus, security plus. And the security plus, a lot of our classmates just recently passed that exam, too. So would you recommend out of all the five that you have taken for at least a study? If they can only afford one, what would you do? Security plus, for sure. I mean, it's a bottleneck. So a really qualified student that was extremely intelligent and very hands-on and good with everything. He didn't have it recently, went out for different jobs. It wasn't getting anything. And whenever professors told him, I would have something lined up for you right now if you had the certification. So it definitely can hold you back if you don't have it. And that's what I've been told. And I also have two classmates, our former classmates, that they went to a boot camp. They did the boot camp. They took the exam. And now they're working. Right. And they came straight from the associate's program. So they didn't even do the bachelor's program. That's another route you could do as well. And for all of this, though, we talk about certifications and classes and education. That's great for the resume. And it's great to get your foot in the door somewhere. But as far as a career in cybersecurity, you need to be that lifelong learner. You need to be putting in the time outside of class, outside of requirements. So take the initiative to self-directive learning, right? Absolutely. And I know you do that a lot. And you helped a lot of us, all of your classmates, like studying and all that. You have study sessions. He and I just had that like, it was the last week's anniversary before his exam, which was awesome. And he was also doing that at KCC as well. And I know you kind of started building your own computer environment at home, right? That's in the works. So the fall semester won't be quite so hectic for me. And so there's some really great resources for building a pin testing lab. And I'm going to utilize that. I've got some switches and routers and some old computers. I'm going to try to throw some stuff together. And also use virtualization to spin up more computers. Well, so other things that you could do, like I know you and I have done this, where we participated in the capital of that competition. So there's one going on right now, the National Cyber League. So that one is actually a good way to practice as well for like hands-on skills and what you're going to actually do in the workforce. There's also the other one we did remember, the collegiate cyber defense competition. That one's a little bit harder, but I mean. So yeah, they're trying to simulate what you're going to encounter in real life. And so they sometimes can be pretty elaborate on what they create. But the cyber, the CCDC, right? That was extremely challenging. But they actually brought in hardware. We had an actual IP phone in there where they would call in help desk tickets. And then we were running an environment. For the NCL, it's more of a capture the flag type thing. CCDC was more like a simulation of the environment. But the NCL, they put in so much time developing those puzzles and those challenges that it really helps to develop a lot of skills that you may not get outside of that. And that's something that one of our professors promotes a lot. Because he says, this is what we teach in our classes. We can't possibly cover everything that we do. A lot of the tools that I've used, like from this past, when I did the regular season, there was a lot of things that I learned from our previous courses at West Oahu that I used. And I would have never known how to do some challenges. And I did exceptionally better. I mean, I didn't place high. But I mean, it's still an accomplishment because I could do things on my own without having to actually be supposed to ask for help. Well, for mine, it wasn't quite as successful this semester because I got one question out of a million probably. Yeah, I just didn't have the time to invest in it. It's time consuming, that's for sure. Because I didn't finish either. And I was focusing classes and that certification exam that was coming up. So bad timing this semester. Totally. But in the fall, in the fall, I'll try. The fall is where we'll probably go harder. So definitely should do that again. The other things that I have experienced, and you also have done this, was gain experience through jobs or internships, volunteer work. So you want to talk a little bit about that, like what you've done in the past. So you and I have done a little bit of that when we were at KCC when we did end testing for companies. It was really more like email phishing and testing the employees to see if they were following best practices with their emails. Because that's the way so many companies get hacked is through email. So I did that. I've done an internship with Hitec Hui, with the National Oceanic and Atmospheric Administration. And they're all great people. And then, like I said, now I'm with the Cybersecurity Coordination Center at West Oahu. And I have another internship lined up that I'm going to be starting soon. Yeah, I'm super excited about all this. There's so many opportunities out there. A lot, yes. So if you show that you're aggressive about these degrees, about these certifications, about your career, there's so many doors that will open up. You have to pick and choose. And so I've found myself saying no a lot more than saying yes to the office. I have to learn how to sit and do that. And Nathaniel always, because I have a lot on my plate. And I say yes to everything for every opportunity. Right, we've taken different strategies on that. We'll talk about that a little bit later, the routes that I did as well. Can you talk a little bit more what you actually do at the Cyber Center? Do you like a blog? So there is something like a blog that we maintain there. So we have the vulnerability research. We have best practices. We have global and we have forensics. And so those people all invest a lot of time in their area of expertise. And they develop these great articles based on open source intelligence. Now, I've written a few myself. But I spend more time working with hardware and developing labs for students. And in fact, I actually taught a class at West Oahu two weeks ago. And then I helped out with another one this past week. Oh, I can't hear. Sorry, I couldn't hear you. Oh, what kind of class did you teach? So it was on the industrial control systems topic, right? So I was programming Arduino. So I did embedded systems programming. So I did that. So we actually get to work with the components that come with the Arduino. We get to create circuits and work with sensors and actuators. And yeah, the labs were a lot of fun, I think. I worked pretty hard on it so that they would have a good experience. I know you're sure it was me. Ended up being a lot more time probably than I should have. And a lot of it is programming as well, right, C. So for Arduino, it's C programming. But there's extra libraries for Arduino. And it's called wiring. Language, right? So you can use a lot of the tools that are either extra for the Arduino or come with like a package deal. So you have keypads, servo motors, things like that. And the libraries that are built into the wiring language make it much simpler. All right, well, we'll be right back. What'd that thought, Nathaniel? I couldn't hear. Aloha. My name is Mark Schwab. I'm the host of Think Tech Hawaii's Law Across the Sea. Law Across the Sea comes on every other Monday at 11 a.m. Please join us. I like to bring in guests that talk about all types of things that come across the sea to Hawaii, not just law, love, people, ideas, history. Please join us for Law Across the Sea. Aloha. Hello, everyone. I'm DeSoto Brown, the co-host of Human Humane Architecture, which is seen on Think Tech Hawaii every other Tuesday at 4 p.m. And with the show's host, Martin Despeng, we discuss architecture here in the Hawaiian Islands and how it not only affects the way we live, but other aspects of our life, not only here in Hawaii, but internationally as well. So join us for Human Humane Architecture every other Tuesday at 4 p.m. on Think Tech Hawaii. Hello, welcome back to the Cyber Underground. I'm Rachelle Mansilou, your guest host. And today, we're talking about how to start a career in cybersecurity. And we have Nathaniel and Weeks as my guest. And we were just talking about our steps and how we are starting our cybersecurity career. And we're almost at the end. We're going to graduate soon. So I graduate actually at the end of this December. And Nathaniel, I think, was it spring? It will be the spring. We started on the same time. Only because I have another degree, so I'm a little bit ahead of him. But we're just, you know. That's not entirely uncommon right now. Yes, right. I didn't know this until the other day. But Melissa has a master's degree. Yes, that's what I heard too. You're right. So we've got other students that have bachelor's degree. Daniel has a bachelor's degree. Right. There's a lot of students where this is their second career. Absolutely. And a lot of people ask me, like, so why did you switch? But I mean, why shouldn't I? I mean, this is such a growing industry. And it's booming. So I mean, I feel like we're going to have a job regardless of what we decide to, you know, which path to take, you know. Sure. Right. As long as you're putting in the time and the effort, the opportunity is there now. There's a major shortage of personnel. So I mean, that's why I said so many doors open up. You have a lot of people knocking. Right. And so. Having said that, so another thing that students could also do is to network. And that's something that I've done a lot too, as so is you. Right. So in-person networking is actually very important. I mean, I would attend a lot of the conferences, meet-ups, like I was saying, talk to professionals, seek, you know, just advice or anything, and you never know, you know, they might have a job opening, or they might say, hey, just send us your resume kind of thing. Right. And that was actually some of the first advice I got coming into the field was I just started out the gate by asking one of the professionals on you in the field, you know, I said, is there any advice you could give me? And the first piece of advice they said was network, right? And they didn't really have anything else for me. They're just like network and, you know, work hard, of course, right? So that's something, I guess, that goes unsaid, right? You have to do that. But, yeah, that was how I got started right out the gate, was that my first internship with Haitekui was only because I was at a social event and was networking with some of the professionals. And that's how you found that internship, huh? Yep. Yeah, because not a lot of these internships are advertised, right? Absolutely. And there's some that you can just get from word of mouth. I mean, just ask. And in our field, it's a little bit harder because a lot of people are, you know, their soft skills still need to work on it. Absolutely. And a little bit more, what's the word, introverted? Right, yeah. Right, so, but I mean, I try to encourage, especially in my club that I'm in. And Nathaniel, he used to be my officer as well. And he knows that, you know, as much as possible, try and, you know, communicate. Communicate, correct. Yeah. Right. So even that first internship, right, that was not posted anywhere. Right. In fact, there was no internship. And I never heard of cyber, I took Whoey before, but now I'm hearing all about them. Right, and I have great reviews. And like I said, they have great people too. But because I went up and started talking to one of the owners about it, Ann Marie. She said they had been thinking about it. And so they actually created the internship after that conversation. Oh, right. And now James, one of her other students is interning there because I had recommended him. And I think he actually has a job now too, right? Does he? Does he work with them now? Yeah, I think so, like a part-time job. That's great. Yeah, so that's, I mean, that's a great place to be. Right. And so good people to know, right? Yeah, absolutely. Is there any other, like besides, like, what we already talked about, what do you think would help students? Like, I know, like, we've done clubs. So I'm actually the president for the HATS, Hawaii Advanced Technology Society. Do you think that kind of helps people, you know, just the leadership kind of? Sure, I mean, working in a team, doing projects, I mean, this could help anyone in any field, right? So if you're in school for anything, join a club, you know, try to work with other people. I mean, you may not always get along with everyone. And that's the real world too, right? So you have to learn from that. Especially if you're young, like, we've both worked previously, you know. So I mean, we've already got a dose of that. But I mean, if you're young, you're, you know, coming into this field, it'll be a great experience. And not only that, you'll meet people that know vastly more than you probably, right? I mean, I've met people that are so smart. And I hope to know a tenth of what they know someday, despite all my work. Well, those are contacts that you want to keep, right, so that you'll learn something from them, right? Exactly. Yes. But, yeah, I mean, it's just a great way to make connections early on and even carry those connections throughout your career. I agree with that totally. I mean, like, we've met, like, I don't know, like, with my internships, you know, I've done it with the state. So I've met some kind of top officials. And there's a lot of people that I don't even know what their position ones and positions are in the field. And later on, I find out, like, oh, that was like a big wig. I was like, oh, I didn't know. You never know who you're going to meet, right? And then interning with the cyber center, right? Oh, yeah. We represent several government agencies that come in. And we end up presenting what we've been working on. And sometimes they'll have feedback. Other times they'll be just happy with what we're doing. And they're really interested in the program, right? And so we're kind of spokespeople for the program in a way. But apart from clubs and certifications, education, and just doing work outside of those things, right? Like setting up your own labs and everything. The one thing that I think sets some people apart is just the drive. Right, the passion, right? Right. And so, I mean, some of these kids have been doing it since they were super young. And they're the ones that you end up saying, wow, it's one day to know a tenth of what they know. But having at least that passion at any point in your career and then following it and pushing as hard as you can is really going to give you more. Especially if you find in our field, there's so many avenues you can take. So if you find something you want to focus just on that, then do that. Because I know a student that he goes to Manoa, and he's pretty young, younger than us. But his parents spent $10,000 for him to go to a kind of a well-known computer and learn all about coding and all that kind of stuff. And now this kid is like, he's like a genius. But I mean, if you have that money, you do it. Right, of course. The $10,000 is, I mean, it's a lot right now. It really is. And it makes it tough when you're trying to pay bills. I mean, if you're a kid and your parents are paying for it, of course, that's great. But like you and I, we have kids. Right, it's more about looking at it as an investment. So if you look at it in any other form, it can be really hard to pull the trigger on something. This last certification, $700. I mean, we weren't just doing so well off. I was like, well, we have $700 that we're never going to use, because we get so much money. It was just because it was such a big opportunity and it's going to pay off down the road. So you have to look at it that way. And that's pretty much how our education is as well. I mean, I know all the struggles that we both go through. But I mean, the payoff is going to be big. I know also. Right, and for those classes, I mean, they require you to do some things that you may not necessarily feel like contribute directly to what you're going to be doing. And that may be true. You may end up working in a networking position, but everything that you studied in one class was on an entirely different topic. But it definitely makes you more well-rounded. And especially when you're doing presentations, when you're doing papers, things that you wouldn't normally do if you had just taken up the first job offer and just quit school and went with it. It's just building your skill set, right? Your character and the well-rounded part is really where I focus on. I think it's a great. I think that's when we'll make you the best security professional if you're well-rounded. Sure, yeah. Is there anything else you want to add? Like, you know that, oh, I know. So what other certifications are you planning to take down the road? If you have enough money left by then. You're right, yeah. At some point, I hope to have a company pay for it. I don't mind. Employed, but apart from internships. But I really liked the Cisco exam that I've taken. That was one of the funner ones. It was a challenge. And so I think I really enjoy networking. I enjoy that side of the house. And so I definitely want to do that. There's a new CompTIA when it came out, the Pintest Plus. Oh, yeah, I want to do that, too. And in the fall, I'll be taking the in-sale class. And so I'll be doing a lot of the Pintest tools, using a lot of the Pintest tools. And like I said, creating my own Pintest lab. So I figure that could coincide with those things and make it line up like the other classes have. Well, after you graduate from Westall, how do you plan on getting your master's? I know Dave, he always encourages me because I already have a bachelor's. I have two what he wants. He's like, you don't do your master's. Well, like I've heard several times now, the master's is the new bachelor's, right? So that's kind of sad because he worked so hard for the bachelor's, and they're like, well, not quite good enough anymore. But that's fine. And our field, actually, the bachelor's is kind of good enough because there are so many opportunities. But if you want to keep pursuing higher positions and more opportunities and manage your own positions, it really helps to have the master's degree. If you want to teach a class, that's required as well. So I could teach one class at Westall, but I can't teach a semester of classes. He and I got off and we keep getting told like, come back to ACC and teach a class, but you can see at your master's. That's kind of like holding us back. Just two years of your life and the several classes. Well, do you have any other tips before we go by on any quick takeaways? I think we've pretty much covered it. I mean, there's a lot to it. And it takes sometimes taking a step back because you can get so invested in how much of a challenge the day-to-day is. But in retrospect, sometimes you're surprised by how things really are going. So this semester has been really tough for me. But then when I look back, it's probably been the best semester I've had. And when you look back, you look how far you've come. Right. I don't want to pat myself on the back too much. There's still a lot of struggle ahead. For both of us, I think. But just stay motivated and work hard. Yes, stay motivated. I would say never stop learning and apply what you learn because you'll most likely forget it, but you keep applying what you learn. Right. And that's even after you graduate. Yes. The lifetime learners. Yes, everyone else. I definitely am one of those. Oh, thank you for coming on to the show. Thank you. Thanks for having me. OK. Until next time, stay safe. And Aloha, this is the Cyber Underground.