Cybersecurity projects to demonstrate your skills

One of the best ways to apply your learning is to try it out for yourself , and my guest today , infosec Skills author , professor Robert McMillan , has a host of suggestions for low-cost , low-risk security tasks that you can try for yourself to determine whether you have what it takes to keep going in cybersecurity .

And , as a bonus , robert gives some pretty outstanding advice for taking these hands-on experiences and interjecting them into your first job interviews . All that and a lot more in this week's CyberWork Hack . Hello and welcome to a new episode of CyberWork Hacks .

The purpose of this spinoff of our popular Cyber Work podcast is to take a single fundamental question and give you a quick , clear and actionable solution or a new insight into how to utilize InfoSec products and training to achieve your work and career goals .

So today's hack is a little different , but my guest is longtime friend and collaborator of InfoSec Professor Robert McMillan . Robert has been an instructor and creator of our InfoSec Professor Robert McMillan . Robert has been an instructor and creator of our InfoSec skills modules for a while now and I had Robert on an early episode of CyberWork .

It was a great chat . Hope you check it out . But as well as Robert's other hacks in the series , we've got several others in the can . Hopefully you've seen them by now , but I'm very excited to have him back for this particular hack , which is aimed at cybersecurity novices .

So the idea here is we're talking to beginning learners and this is for folks who aren't sure if they have what it takes to go down a cybersecurity career path and really go for it .

So I wanted to see if we can come up with some ways to prove to yourself and , by extension , a future employer , that you have what it takes in the old brain box to work in cybersecurity . So thank you for your time again , robert , and pleasure to have you back on the show . Thanks for having me , chris .

So yeah , like I said , a lot of my guests have talked about a time where , when they were young and they tried a certain thing , maybe they they finished , you know , programming something and it worked .

Or they designed an app for a class and it was a big hit , you know , with their fellow students , or they built their own computer from scratch and their family used it for years . So it could be a big thing or a small thing , but it was something that they could accomplish .

And it said you know you can do this , and it also got them excited to see what's the next thing that I can do , you know . So you know it can be easy to keep studying abstractly and maybe even , you know , collect a bunch of certs , but I think some hands-on experience can really lock things in faster .

So , robert , can you suggest a manageable security project , something you can get your head around and finish ? That will help . You know you've got a good handle on the concepts around cybersecurity , sure .

So , for instance , you know , my first video course , after just doing YouTube videos , was with LinkedIn Learning , and they said , oh , they said you know what do you need ? And I said , oh , I just need a couple of Windows 2012 servers and have them network together . Ok , fine . And then they started saying , ok , what do you need now ?

Well , I'm going to be doing software defined networking that requires this , this and this , and they go . We don't have that . Yeah right , this and this , and they go , we don't have that .

So I had to procure my own equipment for that and , to this day , a lot of the courses , including the ones I do for InfoSec , I use my own equipment , just because it's gotten more and more complicated . But for those of you just starting out , there's a lot of great options .

So when you sign up for the InfoSec Institute , of course you do get a free trial , and so definitely recommend that you do that , and there's all kinds of great labs and great things that you can sign up to take . For instance , on my courses . I have a Windows Server and client course on security .

I created labs for people at the intro and at the intermediate range that you could do online . The great thing about online labs are you don't need high end equipment . You don't need to buy $40,000 like I did .

I bought $40,000 equipment just so I could do my courses , because all that stuff's in there , it's in the background , it's it's sitting on , you know , servers that have the complexity and things like that like you would have in a corporate environment .

So you may not be able to attain all of these different pieces to you know , to do some of the more complex stuff . However , it is certainly possible for you to get your own lab going , just as I did in the early days .

Now , besides the InfoSec Institute , I have found that if you don't have the money yet to do a long-term monthly subscription , yeah , because you're really just getting started and maybe you need something just as basic as basic can be .

I remember trying to save a file the first time on a Windows computer because I started out as an Apple guy a Macintosh Okay and I had to save it with a file extension . I'm like we don't use that in Macintosh . What do we need that for ?

So you know if you're really at that level you know , like I was when I first got started then you can go to learnmicrosoftcom , sign up with your email account and they have some free projects that you can do online and they walk you through . I mean , it's basic , basic stuff . We call this high level , 50,000 foot level .

Don't expect that once you take these that you're ready to get a job in cybersecurity . Yeah , right , right . This is just you know real hand-holding intro stuff here , oh yeah .

Make sure you're really comfortable yeah yeah , exactly , you know the InfoSec Institute is going to does have introductory courses , but I've never seen anything as simple as what I've seen at LearnMicrosoftcom . Love it . So you can go there . They've got the videos and the intro text and and then you know the labs and stuff like that .

Then you can sort of graduate , you know , on to more advanced courses . I love the fact that InfoSec has some advanced courses for people who are lifelong learners , I mean those folks you know . It's like OK , what's the next thing ? Because technology changes so quickly it's hard for me to keep up with it .

So I'm going to learn from someone who has kept up with it and then I'll be at that level , you know , at some point and you know three years from now .

If you sign up for a free month of that , you can sort of poke around in there and see what's what's interesting to you and as , as as Robert said , you can check out his Windows 10 , or is it server 2019 and Windows 11 , server 2022 . Yeah , and a lot of our skills learning paths have cyber ranges and sort of hands on things .

So it's pretty cool , like they'll give you a little simulation of you know a command prompt environment and you can actually go through and do all the pieces yourself .

You can do code injection , you can do you know some sort of capture the flag things or whatever , and you can really lay hands on it in a sort of low stake situation where you're not going to break anything You're not going to . You know .

All you got to do is , you know , reset it and start over if you messed up , and I think that's really really conducive to learning . You know , all you got to do is , you know , reset it and start over if you messed up and I think that that's really , really conducive to learning .

You know , I mean we've had a lot of guests on who have said that you know they dismantled their family's computer when they were , you know , 12 years old and then put it back together . But it can be a little scary if it doesn't work out and maybe you know that's , that's the last thing . You , in this case , yeah .

So so , yeah , let's , let's talk a little bit about doing some of these projects . You do something hands on and , you know , do you have any advice for sort of designing , like the scope of the project that you would want to accomplish ? Because , like you said it's , it's one thing to say , like , learn that Microsoft dot com .

Ok , I did this to this , learnmicrosoftcom . Okay , I did this to this . Now , like , how do you sort of like plan for yourself to say , okay , what's the next hardest thing I can do for myself to sort of feel like I'm moving up the ladder ?

You know , nothing feels as good as getting your hands dirty and you know your own project , and so what I recommend is that you start out , you know , assuming that you have a decent computer with , say , at least 16 gigabytes of RAM , and if you don't see if you can upgrade it or obtain a new or borrowed computer that you're able to do this with , if it's

a Windows computer , you can go ahead and install Hyper-V on it . It's just a feature that you can check the box , you know .

When you go into the control panel , the system settings , you can add Hyper-V and it also includes if you have the professional version , the enterprise version or even the student version , then you can get a free virtual machine operating system for another Windows 10 or 11 , as well as Linux versions that you can install .

That's all included right in there in Hyper-V on any one of those versions of Windows . Now , if you have a home version , you can upgrade it . It's not that expensive . Microsoft would love for you to upgrade it . It's just go to Microsoft's website and say , hey , upgrade my operating system , and then you can get all those advantages .

However , let's say you don't want to use Hyper-V . Let's say you don't want to use Hyper-V , let's say you want to go a different direction . You can install VMware Workstation the current one , I think , is 17 , or VirtualBox , which I believe the current version is 7 .

And you can install that on any computer Windows , macintosh , linux , any one of those computers assuming that your computer has the virtualization feature turned on . You might have to boot into the setup and turn on virtualization . It's just simply a checkbox that you do and by default , a lot of times it's turned off .

And then you can install any one of those virtual machine products VMware Workstation , virtualbox especially for non-Windows and then you can get all kinds of great projects that you can download . Now one place I like to go to you can get some free projects is GitHub . Github is owned by Microsoft .

They have a ton of free projects that you can download onto these virtual machines , and the nice thing about it is is you can break these virtual machines and you can start over again and you know no harm , no foul . So you can start over again and no harm , no foul .

You can get free versions , demo versions , 180-day demo versions that you can use over and over from Microsoft at the Windows Eval Center . Just type in Windows Eval Center in a Google search and you'll find it , and you can download any version of Windows Client or Windows Server for VMware VirtualBox for half a year , which is fantastic .

Another place you can sign up is the Cybersecurity and Infrastructure Security Agency , known as CISA C-I-S-A dot org . Cisa is great . It's the security agency that you can sign up for Now . I've signed up a long time ago to get these updates for when some new vulnerability comes out .

They send me an email anytime you know some new hack has come out or you know , and I learn a ton from them . So it's a great place to go to get various different projects and information that you can do on your own .

So one of the things that we talk about a lot on the show is that you know , especially when you're just getting started in your career in cybersecurity , you know it's one thing to have okay , I have a certification on my resume that shows I can do that but one of the things especially with people who have no experience trying to get into a job that requires

experience is documenting outside experience that you've done . So some of these things that seems like would make really good kind of calling cards when you're trying to sort of show off what you can do . So you know , I think an important part of this whole endeavor is documenting what you've learned from these small projects .

So do you have any tips for how to document completed projects in a way that others can understand and that you could maybe put on your resume ?

And that's because every you know version of Windows that people were using had the same bugs in them as all the other ones , or software that they were downloading and installing , or whatever it was .

And so what I found was is that after a month , if you haven't seen that problem in a month and you're , you know , I was solving 20 problems a day , you know . So you know , over the course of a month we're talking about hundreds of issues I've solved . A month later that same issue comes up .

I'm like wow , I know I've seen this before , but I sure can't remember how I fixed it .

However it is , you want to organize it , onenote is very customizable , very easy to use . It'll sit down in your system tray so you can easily recall it . Now , if you want to get a little fancier , you can . And again , microsoft Office , you can use Microsoft Access . Access is sort of a simple , low-grade SQL server , right ?

It uses an MDB type of a database , so you can't put hundreds of thousands of records into it , but you can certainly put in thousands of records so you create . There's plenty of YouTube videos out there if you want to learn how to create your Access database and customize it the way you want to .

I've got over 4,000 videos on my YouTube channel , not just on Access but Windows and other things , so just that channel alone has plenty you can learn from there . 4,000 videos on my YouTube channel , not just on Access but Windows and other things , so just that channel alone has plenty you can learn from there .

And so you make your Access database and then it's searchable . So the next time you have an issue , you say , hey , put in some keywords , click search and boom , you saw how you solved it last time .

Now for employers , when you go to do an interview , here's a tip for you Is that let's say , you've already got some experience in a job , or maybe you have experience in college or on your own home lab that you can relate to some of these questions that are coming to you in this interview .

Try to get no more than around five really good stories , because what you're going to find is pretty much any of the questions that they're going to ask . You are going to relate to at least one of them . What you're going to find is pretty much any of the questions that they're going to ask . You are going to relate to at least one of them .

If you try to get 10 stories or 20 stories , you're not going to remember all the details . Right , it's going to come out funny , you know so . But if you have five really good stories that you practice ahead of time , practice with your family . You know somebody in your family .

Practice with one of your friends you know about , you know explain , you know how it is that something happened . Then when you do go to get interviewed , then you'll have all those different things down pat . So if they say you know , what did you do in order to , you know , secure this computer from ransomware , you know .

Or what happened when ransomware broke out , what did you do ? And now you have a story you know and you can , you can talk about that , that and you've got it , you know , very well explained in your head , so now you can explain it , you know , to that potential person .

You know , and , like you said , you can crowbar it in , as long as it makes sense to what they're talking about , but you know never mind to be of a story of this one time when , blah , blah , blah , blah , next thing you know they're putting check marks next to your name in their hire pile .

If you enjoyed this video and felt that it helped you , please share it with your colleagues and on any forums you're on and on your social media accounts , and please like the video and subscribe to our podcast feed and our YouTube page . You can type in CyberWorks InfoSec on YouTube . You'll come to our page . Just hit subscribe . Hit the bell .

Everything will be delivered to you just like magic . There's plenty more to come for listeners of all levels , and so if you have any topics you want us to cover about any aspect of the cybersecurity career experience , drop them in the comments below and we'll get to them very soon .

But until then , we will see you next time , and this is Chris Sanko saying happy learning . Hey , if you're worried about choosing the right cybersecurity career , click here to see the 12 most in-demand cybersecurity roles . I asked experts working in the field how to get hired and how to do the work of these security roles so you can choose .