There's a lot of people asking how important it is to learn programming for cyber security, and the lawyerly answer is, well it depends. Because just starting off, there’s many roles that don’t really require you to code, and based on how advanced you want to get, programming may or may not be all that important for you. In this video, we cover the relationships between cyber security tooling and expertise, an on-the-job scenario where I wished I knew how to code but couldn’t, and ending with some advice for all the non-programmers out there just starting out. Let’s break it down! So how important is coding really? Think about it this way. Just about all the tools you use in cyber security are written in code, and programming lets you write tools. So the important questions to answer first are: what are tools, and what’s the value in knowing how to build them? On a conceptual level, tools extend your ability to change the environment around you, whether in the physical or digital world. Combined with intent, they let you create action and change. So the more advanced your tools are, the more leverage you have, and the wider range of actions and change you can achieve. Archimedes once said: “give me a lever long enough and a place to stand and I’ll move the Earth.” If he was standing in something more sophisticated like the Death Star, he’d also have the ability to blow it up; if he knew how to operate it, of course. In the cyber world, it’s no different. Being able to get results in cyber depends on the types of software tooling at your disposal and your expertise at using them. So the first principle to keep in mind is that it’s the combination of tools and skills that really determine your overall cyber abilities, whether for an individual or for a team. So to improve your overall effectiveness, it’s important to be balanced in both. Currently in the field of cyber security, most people fall into one of three categories: blackbox users, tool operators, and developers. Most blackbox users will usually only know the basics of using one or a few different software systems, and only in situations that they’ve been trained in. These guys might even have a few certifications, but aren’t able to apply their training to solve problems independently in more complex scenarios without the help or mentorship of more experienced practitioners. Being able to modify tools or craft new ones is out of the question. The vast majority of people in cyber security would fall in this category, and knowing how to code isn’t all that important for them, because they’ve yet to master many of the most common tools in the role they’re already in, whether it’s Wireshark, Metasploit, Autopsy, Burp Suite, Volatility, Cellebrite, Group Policy, et cetera. You’ll be much better off first focusing on the fundamental principles like understanding computer networking, operating system architecture, and solving technical problems. In the next category, we have tool operators who are quite experienced at using a variety of software to get things done, and can creatively chain them together in real-world scenarios. These guys are the backbone of companies’ IT and security shops, and are often the workhorses getting things done. But for those without the ability to code, the downside is that when you’re in a situation without an immediately apparent tool available, there’s not much you can do about it. Taking the time to learn some programming can really amplify your ability at this stage, since it lets you automate many of the tasks that you once performed manually. Now as for tool developers, especially those who are actively involved in operations, they can understand the ins and outs of the tools they use. Knowing how to program lets you modify existing software or craft something more custom to solve specialized cyber security problems. The operator-developer types tend to be some of the best cyber practitioners you’ll meet in the field and are hard to come by, depending on the team you’re on. In terms of overall ability, you’ll find that people who can chain tools together or write custom-built code have increasing levels of expertise that are orders of magnitude higher. And I tend to find that those with programming backgrounds tend to progress faster and deeper in their learning journeys than those who don’t. Here’s an example: When I was first starting off in the field, I worked as a security analyst in three-man team with no certifications and a very basic understanding of code. We were monitoring for malicious activity on the network using a software called Splunk, which lets you build advanced queries to search across large datasets, like network logs. In many enterprise networks, the only traffic allowed to exit are common protocols like NTP, DNS, HTTP, HTTPS, which is what you’d expect from internal users browsing the web or servers fetching updates. These services typically get hosted on ports 123, 53, 80, and 443. Firewalls would drop any other type of traffic destined for other ports to limit the risk of data exfiltration. To bypass this, malware will often hide their communication traffic within these common protocols as covert channels to evade detection. I pushed the idea of monitoring DNS traffic for signs of malicious activity, after reading about the technique in some academic white papers. I wanted to develop a way to assign DNS queries in our logs weighted risk scores depending on the number of subdomains, the length, and overall entropy of the query. Because I didn’t know how to code, I had to chain together an incredibly massive Splunk query to calculate everything. Even though this method worked and discovered outbreaks on the network, it was pretty slow and bogged down the system, and I had to rely on one of the other more senior guys on the team to re-implement my solution as a module in Python to do the same thing, but more efficiently. On one hand, having the curiosity and persistence made me a valuable member of the team. But at the same time, had I learned the most basic programming skills, it would have given me the flexibility to describe the outcome of what I wanted to do using the language of code. This experience later prompted me to act and take coding more seriously to patch-up my skill gap. One caveat I do want to make is that it's important to draw the line between scripting and software development, since many people will use the word “programming” or “coding” interchangeably to describe both of them. Scripting would normally refers to writing short snippets of code in an interpreted language to automate tasks or glue the functionality of other tools together. Software development on the other hand, is a broader term that covers scripting, but also involves writing algorithms or libraries as part of a larger, more complex toolchain. People often consider Python or Bash as scripting languages, and compiled ones like C++ or Java to be more geared towards software development, but generally it depends on the complexity of the tool and your intent: whether quick and dirty or something more robust and enduring. Now on the operator versus developer axis, you’re going to see a lot more scripts closer to the operator side, and more compiled languages on the developer side. This isn’t true across the board, since people can bounce around the spectrum, but it’s a decent rule of thumb. For instance, in 2016 a group called “The Shadow Brokers” dumped a bunch of hacking tools used by the NSA, which you can now easily find and study on GitHub. You’ll notice there’s a mix of Python scripts more geared towards operators to run by hand and compiled binaries for implants and exploits that definitely takes a team of engineers to craft. For those of you who really really aren’t into software development-level programming, you can get pretty far by at least learning how to read and write scripts, since on the operator side of the spectrum, your focus is primarily on the pre-built tools with some degree of customized automation thrown in. In this case, it’s not massively critical to have a coding background, because in my experience, most computer science programs are much more heavily focused on topics like applied math, programming theory, and software development at the academic level. I personally think it’s better to start off learning scripting, which can be quick to pick up and a bit more pragmatic for day-to-day technical tasks. Three books I recommend for learning scripting are: Automating The Boring Stuff with Python, Learn Powershell in a Month of Lunches, and the Unix and Linux System Administration Handbook, for learning Bash. For practice, one of my favorite resources is a site called runcode.ninja, which hosts scripting challenges that you can do in just about any language of your choice. Definitely check it out, since they’ve got hundreds of practical exercises covering everything from encryption, forensics, to reverse engineering. All in all, it’s totally possible to have a successful journey in cyber security without programming skills. But as you progress in experience, you’ll quickly find that the types of problems you’ll be dealing with aren’t easily fixed by readily available tools. All you can do is maybe rely on someone else on your team to help you implement a solution, or learn how to do it yourself. Being able to craft your own tools with code makes you so much more versatile and well-rounded of a cyber professional. It really turns the tables and puts you in the position of helping others on the team be more effective, which at the end of the day, translates into more opportunities in different organizations. So what’s your take? How important do you think coding is for people in the cyber security field? I’d love to hear more about your thoughts in the comments below. And if you found this video helpful, share it with friends, and subscribe with the bell for notifications, since we’re trying to come out with one of these every week. Thanks so much for watching, and I’ll see you soon!
