Finding Student IT Security Placements in the Industry? 273
CABAN writes "I am a third year computer security and investigations student. My program requires a three month placement in the IT security and forensics industry. Finding an appropriate learning environment seems to be harder than I expected. Lack of security clearance, no real world experience and many companies, who just don't see a need for ITS, are the critical shortfalls right now. What tips does Slashdot have for finding organizations who are willing to let students get involved with sensitive security procedures and cases?"
hey (Score:5, Informative)
Re:hey (Score:2)
No real answer. (Score:5, Insightful)
Your program should then have some mechanism to facilitate such placement. Most programs that require intenships provide assistance in placement. If yours doesn't, then you are being shorted. This isn't a DJB class is it?
Re:No real answer. (Score:3, Insightful)
The only solution may be within the school, since they require a placement. If they can't even offer you that, then they're being very unreasonable.
Re:No real answer. (Score:2, Insightful)
Re:No real answer. (Score:2, Insightful)
Student wastes three years of his life going into debt and then the school says "get an internship or fail to graduate".
I guess life's not fair, but if I catch you moaning about socialism when people are talking about supporting those who were unable to get a degree and get employed, you'll find my boot shoved very far up your hypocritical ass.
Re:No real answer. (Score:3, Insightful)
Certainly if they're going to require you to find such a difficult to find position for graduation, they should provide you with placement or waive the requirement. This is a world appart from visiting your campus career center. The guy isn't trying to get a job, he's trying to get his diploma.
Assistance (Score:3, Informative)
Re:No real answer. (Score:5, Funny)
Re:No real answer. (Score:2)
Your school's IT Department (Score:3, Insightful)
Re:Your school's IT Department (Score:2, Informative)
unusual program requirements (Score:2, Insightful)
Why not work for Lowes (Score:3, Funny)
Co-Op/Intern (Score:2)
Financial and Insurance Services (Score:5, Informative)
Re:Financial and Insurance Services (Score:2, Informative)
Re:Financial and Insurance Services (Score:2)
Re:Financial and Insurance Services (Score:2)
Also, I worked for a defense contractor that did work for the DoD and did not have a security clearance. There are positions that do not require clearances, and some of the ones that do only require a "Secre
Utilities also (Score:2)
Simple. (Score:3, Funny)
Do what everyone else did.
Hack into a bank and get caught.
You'll get a few years in the state pen, but then you'll be a hot commodity.
(P.S. This is one fucked-up world.)
Re:Simple. (Score:2)
Re:Simple. (Score:2)
Be aware that the adjustment to getting a paycheck as opposed to being traded for cigarette packs will take some getting used to.
Re:Simple. (Score:3, Funny)
Or hack into a bank without getting caught. If you're careful, you'll probably find a noticable demand for your services in certain circles [wired.com].
Of course, statute of limitations does eventually run out, if you stay within the country and don't get caught; something like three years for grand theft, five years for wire fraud, and six years for the tax evasion on your illegal "income". Of course, some vary from state to state, and I'm not a lawyer, so I don't know what other ch
Re:Simple. (Score:2)
Yeah -- fevered with one of the several opportunistic infections that comes from being raped by HIV-positive inmates.
If you want to engage in violations of the "law" you might consider replacing the current de facto government with a constitutional government. Hell, who knows, if you did that you might make civil disobedience more viable than violence.
Security Infinite Loop (Score:3, Informative)
2.You can only get a security clearance if you work for a company that will pay for it (and justify it).
Rinse and repeat.
My suggestion would be to get a position which doesn't require a security clearance with a company that has security positions available. The company is more likely to hire you into one of those positions and pay for your security clearance, if you already work for them. That's what I'm doing (sorta).
Course, I don't have a clearance yet so maybe it's not the best idea
Re:Security Infinite Loop (Score:3, Insightful)
Re:Security Infinite Loop (Score:2)
Re:Security Infinite Loop (Score:2)
My suggestion: Try to get in with the government. Many government jobs require security clearances and aren't at all shy about initiating a background check if it looks like you're the right person for the job.
I've always heard that a security clearance typically puts your resume above all others without, even if the job in question involves little in the way of sensitive information.
Re:Security Infinite Loop (Score:2)
I could tell you how to fix that, but then I'd have to kill you. Sorry!
Re:Security Infinite Loop (Score:2)
One way to get a clearance is to begin working on a non-classified project and hope you move to another project within a few years. Or, if you're lucky, you could get recruited directly onto some big juicy aircraft project or something. I've heard that the clearance process costs many tens of thousands of dollars, which is why so few companies want to foot the bill. This is probably the biggest thing I hated about government contacting: no training or clearance, unless it can be charged directly to ol'
Re:Security Infinite Loop (Score:2)
As someone who works in the industry (Score:5, Insightful)
Re:As someone who works in the industry (Score:3, Informative)
Once you meet the requirements though, you absolutely must go get your CISSP
That's trying to put the cart before the horse. In order to become a CISSP, you need a mimumum three years full-time experience in security.
Re:As someone who works in the industry (Score:3, Insightful)
Re:As someone who works in the industry (Score:2)
This is the description of the Advanced Investigations course. It's a joke.
Re:As someone who works in the industry (Score:2)
The bigger problem is majoring as an undergrad in a niche job market. Anyone who expects a 20-year-old to really be into such a specialized field is fooling themselves, because 20-year-olds are still growing up. The kid won't realize what the job really entails until it is too late, and retraining out of such a specialty is a downer. It can lead straight into managing a clothing store or--drumroll--preparing taxes for a living (
you really need to have connections (Score:2)
you need to make those critical connections in college or atleast your parents need to know people. people who say academics get you everywhere are idiots, it is all who you know and who you know knows.
small companies, security vendors (Score:4, Informative)
My
IT Security (Score:2, Informative)
NSA Internship (Score:5, Informative)
Its a 12-week program following the student's third year.
As a participant in the Summer Network Evaluation Intern Program (SNEIP) you will acquire an appreciation of the challenges our Nation faces in network security as it relates to real-world work experiences. You will experience first-hand some of the critical work done at NSA as well as have the opportunity to apply your skills on hardware and software systems to enhance network security and contribute to the security of U.S. information systems.
Sadly, this wont benefit you since the application deadline has passed.
Re:NSA Internship (Score:2)
It looks like you have to be enrolled in a Computer Science or Engineering program in order to qualify. Tough luck for those of us in Security majors.
To be exact... (Score:3, Informative)
The NSA's stated requirements...
Must be a U.S. citizen
Must be a college student majoring in Construction Management, Supply Line Management, or related Facilities/Logistics field
Have a minimum cumulative grade point average of 3.0 on a 4.0 scale
Must possess strong written and oral communication skills
Eligible to obtain a high-level security clearance
Must have reliable transportation to and from work
As noted, this yea
Re:To be exact... (Score:2)
Must be a college student majoring in Construction Management, Supply Line Management, or related Facilities/Logistics field
That's interesting. I guess "Construction Management" is for getting the eavesdropping devices and communications lines into new buildings.
"Supply Line Management" is for sneaking the devices into existing buildings and offices by replacing ordinary appliances and electronics with "cooperative" ones.
And "Facilities/Logistics" must be for pl
Oops (Score:2)
Some tips (Score:5, Informative)
- Offer to help with more general systems development/support as well as the security element. You might have to spend a signficant percentage of your time acting as a cheap coding monkey in order to get exposure to the stuff of relevance to you.
- Offer to train other staff free or charge, or provide audit or documentation for systems.
- Highlight the risks of security problems in terms of real monetary costs to an organisation who don't invest in security.
- Sell yourself as an independant and pro-active potential employee who won't be a drain on resources.
- Be flexible in the work and projects that you can offer. Remember that you will only be hired for the work experience if you can fill a valid required business objective.
- Cast your net wide, and speak to people on the ground in an organisation. Contacting a small group of companies via HR departments is a guaranteed way for your e-mails to end up in a black hole.
- Get on the phone or right physical letters. They're emotionally harder to discard or ignore than an e-mail.
- Remember to contact non-obvious choices such as schools, charities, NGO's, open source projects?
- Above all, be enthusiasitc and state your willingness to learn!
Good Luck... (Score:2, Informative)
This is a h
University IT (Score:2)
University IT doesn't count? Usually, there's plenty work to do in the security and forensics area.
If I were a IT security company, I wouldn't hire someone with no previous experience for just three months. The risks are simply too high.
Join the Military (Score:3, Insightful)
Re:Join the Military (Score:2)
Which is why it helps to already have one. (By having joined the military before going to college... all the GI Bill money and a clearance, too!) Of course, I waited so long to start school
Since you asked . . . (Score:3, Informative)
Re:Since you asked . . . (Score:4, Funny)
They INVENTED snow
Re:Since you asked . . . (Score:2)
Re:Since you asked . . . (Score:2)
Universities (Score:2)
A sign of things to come... (Score:2)
Before you go out there trying to get your 'career' in gear and finding a com
Rich Dad, Poor Dad (Score:2)
Security Clearance (Score:5, Informative)
Apply to one of those and the government will usually pay for the security clearance. A lot of times, government positions rotate their interns into many security positions and place them with a mentor, so you get the benefit of varied experience. Even better, these are most often available during the summer (three month vacation to a security position works) and since most places start processing in December/January, you're right on that edge for applying.
I suggest you check out your own various government agencies and send your resume out. Processing time for young people usually borders about four or five months (although it can take over a year), which would put you, if all goes well, at the perfect timing to get one of these positions. And, better, agencies often hire their interns for full time positions when the students graduate, and you will already have your clearance.
I, however, like many
But if you are planning on going into the security profession, that security clearance is something you will want/need anyways, so if you can get it now, all the better!
hmm (Score:2)
In this economy? The closest you'll ever get to hardening a security system is when the assistant manager at McDonald's lets you lock up for the night.
Small Business Sector (Score:2)
Of cour
One step at a time... (Score:2)
Work for a casino or slot machine manufacturer (Score:5, Informative)
These places are always looking for good, qualified people and seem to have trouble getting them. I was one of two people in the whole agency with a CS degree, making me uniquely qualified. Generally, they have to take people with a criminal justice degree and teach them the ins and outs of the computer system. They would love someone already trained in computer security.
Besides looking at your local casinos, you can also check out the slot machine manufacturers. Sierra Design Group [sierradesign.com], located in Reno, is a group I highly recommend. They have an awesome, stable product, that the industry loves and runs on Unix. They're a subsidiary of Bally Games [ballygaming.com], so you can find their job page here [ballygaming.com].
Another computer, located in Austin, is Multimedia Games [multimediagames.com]. They pretty much have the lock on the class 2 games. Here is their jobs page [multimediagames.com].
'unique' means 'the only one' (Score:2)
Since you were one of TWO people, you were not uniquely qualified. If you had been the only one, then yes that would have been a true statement. Unique means "the only one of its kind", not 'special' or its synonyms.
Moose and Rocco will be by shortly to discuss your severance...uh, pay that is.
Re:'unique' means 'the only one' (Score:2)
Re:Work for a casino or slot machine manufacturer (Score:2)
Take your lumps, like the rest of us did (Score:2, Interesting)
Don't expect to get involved in computer forensics straight off the blocks. As a previous poster mentioned in a roundabout way, look for a security position that's more closely affiliated with a traditional IT role (patch management is a good example).
Though I don't want
Er... Run screaming to a different major? (Score:3, Funny)
Now, I want you to really stop and consider this for a moment...
You can't find work as slave labor in your chosen field, and you think you'll do a whole lot better once you graduate?
Switch to a business or marketing major now. If you can handle IT, a quick lobotomy aught to get you through such a degree in no time at all.
You may have to do some self-initiated tactics. (Score:2, Interesting)
er...FOSS? (Score:3, Interesting)
For example, the BSD projects have dedicated security officers. Other projects could probably use help. Pick large ones that have some substance (legal corporate/non-profit structure, etc) to them: Mozilla, the Apache Software Foundation, etc.
Re:er...FOSS? (Score:2)
Re:er...FOSS? (Score:2)
You're going to have to sell this idea to your professors, guidance councelor and probably the head of the college of business and/or arts & sciences (depends on your university). At a minimum, this includes legitimizing FOSS engineering as equivalent to an internship with an actual company, something that a
My University is offering... (Score:2)
We're offering two of such positions - perhaps you'd find something like this on an intern basis - we have a rather robust security department as it is, so I'd venture to say other Universities would as well.
If you are an American (Score:2)
Choose a better program... (Score:2)
My brother-out-law (read S/O's brother, we aren't married...) is in a co-op program as an engineer, which at least gives him the benefit of a well established field with lots of choices. So much for the plusses.
What precisely are you going to learn in three months? For my BOL, physics is physics, and electrons are electrons, doesn't matter where you work. Not so in IT. Even where "experts" agree on a result, they rarely will agree on the method of achieving
Re:Volunteer for an open source project (Score:2)
Go back to the Curriculum Design Moron, and insist that since they're internship policy is crippled at best, and thereby crippling your ability to satisfy it, that they should accept you volunteering on say snort for three months.
But, the battle ain't over by a long shot. First you have to convince them, then you have to reach terms. Obviously they aren't going to send you home for three months and accept on faith you've been doing whatever for the snort project. So once
Go Government (Score:2)
Catch-22 (Score:2)
If your program has that as a requirement, perhaps ask them how previous students satisfied it and network that way.
This won't win me any fans... (Score:5, Informative)
My advice would be to get a sysadmin or operational job first, and spend every second of free time addressing the security aspects in that environment. Then when you move into a security specific job you have some meat to talk about: "well at company X we implemented Plan Y to address this issue", and "I found that we consistently had problem Y". I personally would be very skeptical of a security pro right out of school.
Re:This won't win me any fans... (Score:3, Interesting)
Not gonna do it. (Score:2, Informative)
Private Sector (Score:2)
If you're an intern here, you 'might' get to monitor spam, logs or the IDS. Involvment in investigations is not something we hand out as an entry level option.
Security Clearance? What the heck... (Score:2)
Check out Canada, or, if you really want to have fun, Europe. They even speak English there
I guess I can sing the security clearance blues myself. American research labs (MERL, AT&T, I assume even the IBM ones) expect candidates to obtain a clearance -- which I, as a foreign national,
How about your university? (Score:2)
Just make sure you stick to security and don't try to automate their jobs away. From my expirence most professional univerity IT departments go out of their way to "create"
Thoughts from a security professional (Score:3, Informative)
1) The security consulting industry is larger then a lot of people realize. This would be one of the first places to look for beginner level positions.
2) Not all security jobs require security clearance, only government jobs (or jobs that are in some way related to government work) do. There are several industries that require the services of a security consulting company. For example, Financial intuitions are *required* to have independent security audits performed of their IT environment. There are various regulations out that motivate companies to hire security people (GLBA for financial institutions, HIPAA for healthcare, etc.)
3) Security professionals are in more places then you might realize. Any one of the top 15 accounting firms in the nation will most likely have a security consulting practice. There are countless managed security solution providers. There are companies (many of them!) that do nothing but provide real time 24x7 monitoring to their clients. Any one of these companies can usually find use for an intern, especially one that has the information security mindset, and most of these will not require a security clearance.
4) Contrary to what some may have you believe, certifications aren't everything. You can not get your CISSP until you have 3 years of experience (assuming you graduate) or 2 years of experience (assuming you graduate with a Masters). No company that is looking to hire an intern will be looking for that intern to have their CISSP or CISA.
5) Good news, the security industry is booming and everyone is hiring. The company I work for has consistently hired more people every year since I started. Three years ago there were 30 professionals dedicated to information security consulting, now there are about 85, a large portion of which were hired straight from college.
So, in summary, I would focus your efforts on companies that perform security services such as consulting companies (read: accounting firms, and specialty firms like the foundstones of the world), managed service providers, datacenters and various niche services such as real time intrusion detection shops. Start making phone calls, asking if they have a security practice, and who you could talk to about a job. These places are hiring, if you aren't on their radar already, it's up to you to put yourself on their radar.
who would hire someone for security for 3 months. (Score:2)
Personally I would think it would be a bigger security risk to have an intern for 3 months then it would be without one.
When it comes to business and security, if they take security serious, I would be very suprised if they would ever let someone outside of the company will little expierence, for only 3 months come near their sensitive data.
Consider pursuing individual cyber security topics (Score:2, Informative)
For example, many companies have identity management problems - particularly in industries with largescale mergers. Just documenting the variety of identities each employee has on different systems
The quick way... (Score:2)
2) Fax sensitive stolen data to the same company
3) Offer to become their security guru to prevent other people from stealing their data
4) Proffit!!
change majors (Score:2)
if the companies don't see a need for ITS now who do you think is going to hire you after you graduate?
It started a few months ago. (Score:2)
Re:Don't you have an advisor? (Score:4, Informative)
Also, there is a precedent for security companies hiring Co-op students. If I am not mistaken, The Canadian Security Company (I can't remember their proper name, CSE or something like that) hires some students from my university every study term. The students have to go through a security clearance process that has several requirements such as: you must be a canadian citizen and, criminal record checks and such.
if you want to see our website, go to www.cs.unb.ca [cs.unb.ca]
So yeah, the point of all that is to tell you to definitely get in touch with your advisor. I'm sure you have a course advisor (if you don't, get one!). He or she should be able to point you in the right direction.
Re:Don't you have an advisor? (Score:2)
Re:Don't you have an advisor? (Score:5, Funny)
Editing configuration files with a text-editor is really brain-dead -- that's what a graphical user interface is there for, to prevent erroneous data from endangering the system.
Some of them even have no clue how to maintain w decend web site. They insist on installing an ancient editor instead of using the standard-compliant web-editor of Word.
What do they teach you?
Sometimes I am really glad that we were able to outsource our security to an Indian company with competent people. The United States are really going down the drain with the students we see nowadays.
Re:Try the Fed (Score:2, Informative)
Re:Try the Fed (Score:2)
Quite honestly this is probably the easiest way to get security clearance.
Don't most US clearances require that you be a citizen?
Canada, dammit! (Score:2)
Moreover, how many are at Canadian colleges with a "computer security and investigations" program [flemingc.on.ca]?
Re:Sample cover letter (Score:2)
Re:Hack in...... (Score:2)
A lot of really good security professionals get locked out because of that little hacking question that comes up during security processing.
They m
Re:Hack in......Frank W. Abagnale jr (Score:2)
I can't disagree with you about that.
That is why a lot of these forensics/computer security programs are actually taught by reformed blackhats. One is taught to "think like a crimminal," but generally under the protection of proper permission, and signed papers.
They actually "unleash" these students on systems as part of red or blue teams, but always with prior permission.
That
Re:Here it is. (Score:2)
Re:Why not become a Cop? (Score:2)
Many police agencies have cyber crime units, and many take on interns. You might check with your local law enforcement and see if they have something in place for this.