Business.com

Business.com

SANS GIAC Certification Guide: Overview and Career Paths

Posted: 30 May 2019 09:43 AM PDT

The SANS Institute was founded in 1989 to provide IT security and administration information and vendor-neutral training on those subjects. Since its inception, SANS has trained more than 165,000 individuals via in-class courses, training events, and technical conferences held throughout the world; self-paced online training (called SANS OnDemand); and interactive virtual training (called SANS vLive).

Course topics from the SANS Institute include security essentials, hacking techniques, intrusion detection and incident response, network defense, mobile device security, auditing, digital forensics and related security topics. The "information" component of SANS includes the SANS Reading Room, an extensive library of downloadable security research documents; the Internet Storm Center, which monitors and reports on malicious attacks and provides weekly bulletins and alerts; free security policy templates; the CIS Critical Security Controls for cyber defense and more.

SANS GIAC certification program overview

SANS formed the Global Information Assurance Certification (GIAC) program to act as the certification arm for its training courses, ensuring that individuals meet knowledge and skills standards in specific areas of IT security. More than 165,000 GIAC credentials have been issued. GIAC certifications are well known and highly respected among employers and the information security industry. Even the United States National Security Agency (NSA) recognizes GIAC certifications.

GIAC offers more than 30 security certifications across introductory, intermediate, advanced and expert levels. According to SANS, GIAC certifications are unique because "they measure specific skills and knowledge areas rather than general infosec knowledge." That means a typical GIAC certification requires rigorous preparation and hands-on experience. That's why SANS training comes highly recommended.

Note: Another component of SANS is the SANS Technology Institute, which offers one security-related master's degree – the Information Security Engineering (MSISE). The SANS Technology Institute also offers five graduate certificate programs focused on Cybersecurity Engineering (CORE), Cyber Defense Operations, Incident Response, Industrial Control Systems Security, and Penetration Testing and Ethical Hacking.

SANS GIAC certification tracks

GIAC certifications fall within six specific domains, each with its own certification track:

  • Cyber Defense: Boasting 12 credentials (10 of which are advanced certs), the Cyber Defense certification family is the largest of the SANS GIAC certification domains. Cyber defense certifications are geared to professionals who identify and defend against cybersecurity threats.
  • Industrial Control Systems (ICS): SANS GIAC offers three ISC certifications, one at the intermediate and two at the advanced levels. ISC certifications are geared toward control system engineers and other security professionals charged with cyber security for control system infrastructures and technology along with automation security.
  • Penetration Testing: SANS GIAC-certified pen-test professionals possess the skills necessary to perform tasks that include evaluating attack techniques and methods, recommending security best practices to prevent security incidents, and formulating plans to defend against security incidents when they occur. With seven credentials, Penetration Testing is the second largest certification domain. Credentials are offered for a variety of scenarios, including web applications, mobile devices, Python coding, wireless networks, ethical hacking and more.
  • Digital Forensics and Incident Response: This domain targets InfoSec professionals, including IT administrators, security engineers and security analysts. Also included are law enforcement and legal professionals who respond to security incidents and related cyber breaches, conduct forensic investigations, and examine and gather incident artifacts and related evidence.
  • Developer: Developer certifications are aimed at developers and anyone else interested in building secure programs and applications. Three certs are offered – Java programming, web applications and .NET programming.
  • Management and Leadership:  The management and leadership domain is focused on professionals who may have (or lack) technical skills but provide managerial or project management support. They are also instrumental in developing and implementing security policies on an organizationwide basis. These credentials include certs for auditors, project managers, CISOs, data security law and InfoSec professionals.

Another certification "category" is the pinnacle GIAC certification – namely, the GIAC Security Expert (GSE). Some industry officials consider the GSE to be the premier security-related certification available today. Whereas most GIAC certifications can be achieved by passing a single multiple-choice exam, the GSE exam includes both a multiple-choice component and a hands-on lab.

SANS GIAC certification levels

SANS offers four levels of certifications, including introductory, intermediate, advanced and expert. The table below is a modified version of the GIAC certification roadmap,  which lists each certification by level and certification tracks.

Introductory Level

Cyber Defense

Intermediate Level

Cyber Defense

ICS

Penetration Testing

Digital Forensics and Incident Handling

Management and Leadership

Advanced Level

Cyber Defense

ICS

Penetration Testing

Digital Forensics and Incident Response

Developer

Management and Leadership

Other than the GSE, GIAC certifications require passing one exam and have no prerequisites. That said, GIAC highly recommends SANS training courses, especially for candidates who don't have adequate hands-on experience and aren't able to self-study.

Once an application has been approved, candidates have four months to attempt the associated exam. (GIAC does not administer exams immediately upon conclusion of a training event; candidates must wait at least seven days to sit for the exam.) The cost of each GIAC exam is currently $1,899, which includes two practice exams. The lab exam for the GSE is $2,459, and the written exam is $499. (Note: Students can purchase and take an exam as part of a training course, or they may purchase and take an exam by itself.)

SANS GIAC certification renewal

To remain certified, credential holders must renew their GIAC certifications every four years by earning 36 continuing professional education (CPE) credits. CPE credits may be earned by completing approved training or certifications, participating in continuing education, publishing a technical paper, completing certain graduate-level courses, getting community or work experience or participating in cyber range activities. A renewal fee of $429 is also required.

Related jobs and training resources

GIAC certifications cover the gamut of job roles in IT security today. GIAC-certified professionals work as security analysts or specialists (two of the most common roles), information security engineers, network security admins, database administrators, developers, forensic specialists, risk managers and auditors.

Large organizations with security operations centers (SOCs) need SOC analysts, engineers and supervisors, as well as directors of cybersecurity. A bevy of companies also hire employees and consultants who perform incident response, penetration testing and the like.

With almost 314,000 security-related jobs open in the U.S. alone (and 3.5 million globally by 2021), a reasonably educated and experienced person stands a good chance of getting hired fairly quickly. Adding a security certification or two to your resume not only validates your skills, but it may get you noticed by a hiring manager or give you more leverage during salary negotiations.

SANS training courses and events vary in format and price, but candidates can expect to pay around $5,800 to $6,610 for a training course. Although the price tag is high, many candidates recommend SANS training for its quality and depth as well as its usefulness in eventually achieving GIAC certification. SANS instructors are usually industry experts and/or full-time security practitioners, and invariably get glowing reviews from course attendees.

Candidates who attempt GIAC certification exams should consider taking practice tests beforehand. A practice test mimics an actual exam and is, therefore, a terrific study aid. All GIAC certification attempts (except for the GSE) come with two free practice exams. A few practice tests are also included with training courses. Candidates who don't take training can purchase practice tests for $159 each by clicking a link in their SANS/GIAC portal account.

How to Develop a Best-in-Class Mindset Within Your Team

Posted: 30 May 2019 09:00 AM PDT

By shedding the less-than-impressive resumes and focusing on candidates who have stellar backgrounds and qualifications, it can appear that you have the best and brightest candidates. But if you look at the qualities that actually predict a person's potential for success, paper-based hiring just doesn't cut it.

While sifting through resumes and looking for personal qualities that match your culture is important, companies are better served by developing a cultural environment that encourages everyone to adopt a best-in-class mindset – a vibe that leadership cultivates and an attitude your team embodies 24/7/365.

Think like you're at the front of the room

When asked what qualities most influence productivity, more than 50% of CEOs and CFOs pointed to the same variable: a healthy corporate culture. In the eyes of these high-level executives, workplaces that balance creativity, firm values and profitability are best positioned to thrive.

Employees lucky enough to work in such an environment have a best-in-class mindset. It combines coachability, self-belief and a work ethic that equates winning with outworking competitors. My team prides itself on being 100% coachable – never shunning criticism, never giving in to defensive responses and always embracing change.

Seeking out and fostering this mindset takes a lot of work. It happens by actively listening to what drives someone, what defines their goals and how they quantify success. These people say and do things that signal a desire to improve. They understand that winning comes from being open to criticism, and they're the first ones to turn negative events into learning moments. Those are the people who are the best in their class at getting better.

It's not enough, though, to locate an existing best-in-class mindset while interviewing candidates. To keep that mindset alive in a working team, those conversations must continue long after hiring.

How to get to the head of the class

How can you turn your approach around so that you're focusing on a best-in-class mindset when hiring talent and developing culture? Use these strategies to nurture a team of stars with legitimate talents – not just stellar resumes.

  1. Have an everyone-or-nothing policy. A best-in-class culture only works when everyone buys in. When only some team members adopt that mindset, negativity and counterproductive behaviors can influence office politics and lead to dissension in the ranks. Culture is cyclical: Negativity breeds negativity, and positivity breeds positivity. Build a sustainable first-rate culture by encouraging and emphasizing the qualities you want — compensate for them and tailor your feedback to them. Make it easy to see who is fully embracing the mindset and who is still on the fence.
  1. Make culture your homeroom. Like a muscle, a strong culture is something that you must regularly train and retrain. For example, my team realigns with our values and principles every single time we meet. We rehash them, rethink them and even argue about them. By keeping them top of mind, we immediately know when they're out of focus and how we can retrieve them. Use this culture-focused time to teach and provide opportunities for growth. Assign team members interesting reading material, work with coaches, attend seminars and practice other self-improvement activities. Recognize and praise people who put in the effort to live the culture you're trying to breed.
  1. Leave your crown at home. Too often, I've seen companies start out with a great mindset only to let it fall by the wayside at the first sign of success. Those companies earn their spot at the top and then stop making strides forward. They forget about everything that made their success possible and willfully fall back with the pack. Your company might be dominating your market today, but that won't be the case for long if you neglect to focus on continued efforts to be disruptive.

Stay on the lookout for new technologies, methodologies, and ideas to keep your team ahead of market trends and help your talent continually hone their creativity. Resist the status quo and embrace disruption – it's the only way you'll continue to provide best-in-class service to clients.

The tendency to focus on paper attributes can be damaging to businesses. This is particularly true for smaller companies and startups that need every new hire to bring formative value to the team. Anyone can look good on a resume, but test scores and impressive references only tell half the story.

A culture of collective self-improvement is what's going to keep your team excelling far beyond the hiring stage. There's enough discouragement in the world. Build a workplace where your people can feel free and safe to take risks and become their best selves.

How to Get Started with Text Message Marketing

Posted: 30 May 2019 07:00 AM PDT

Text message marketing is when a business uses texts to reach out to their target market to reach their goals, such as improving lead generation and increasing sales. Research by eMarketer shows that 48 percent of consumers prefer receiving communication from brands via text message over other mediums like email or app notifications. Not only is text message marketing a valuable means of getting in touch with your target audience, but it's also how they want to be contacted and engaged with. 

If you are new to it, it can be difficult to navigate text message marketing. Here are three tips to help you get started.

Build brand credibility

It's hard enough convincing people to hand over their email addresses when you want them to sign up as a subscriber, but persuading them to give you their phone number is even more difficult. Text is infinitely more personal and intimate than email, so if your audience doesn't trust your brand or feels iffy, it'll be difficult to collect phone numbers.

Boost your brand credibility by implementing social proof marketing into your conversion strategy. Social proof is anything you put on your website from other people that endorses your products and services. When customers see that other people love a brand and what it offers, they're more likely to check them out and make a purchase.

Social proof includes client testimonials, customer reviews, celebrity or influencer endorsements and business credentials. You can display any of these elements on your website to show newcomers that others love your brand and its products.

Offer a valuable incentive

Your audience needs to know that if they sign up to receive text messages from your business, they'll be worth their time and give them an enticing offer they can't resist. Imagine getting SMS texts that are generic and don't offer value or insight to the recipient. This is an easy way for people to opt out of your text campaign and lose out on conversions.

Always make sure that when you send out a text, there's an incentive for your audience to get excited and engage with your brand. It helps your audience interact with your brand if you create content that's available only to mobile subscribers. Perhaps you offer them a discount code exclusive to SMS subscribers or share information about a promotion that they get to know about first. Making them feel special for signing up for your text campaign will ensure they stay on that list and continue to love the content you send to their phones. [Interested in text message marketing at your business? Check out our reviews and best picks.]

Use best practices

Have you ever opted in to receive text messages from a brand only to have them contact you way too frequently or at odd hours in the day? Unfortunately, scenarios like this happen all too often and can make or break the relationship your subscribers have with you. It's extremely important to stay within appropriate boundaries and not to annoy or frustrate subscribers by doing the wrong things.

It's a good customer service practice to respect your audience and not text them too frequently. Reaching out with valuable information a few times a month is enough to give them what they need, stay relevant to their interests, and make them remember your brand.

You definitely don't want to text every other day or too frequently, otherwise you risk users opting out of your text services. Respect that these are people with their own lives going on who don't need you texting them more than their loved ones.

The effort that goes into building your mobile subscriber list is completely worth it for the benefits it will bring to your business. It's hard to collect information from visitors on your website, but if you strategize how to keep them happy, your list will continue to grow, which in turn will help build your brand.

How to Become a Commercial Drone Pilot

Posted: 30 May 2019 06:00 AM PDT

Drone pilots are in demand. In fact, the Association for Unmanned Vehicle Systems International projected more than 100,000 new jobs will be created in unmanned aircraft by the year 2025. A recent report from Goldman Sachs projected $17 billion of spending on drones from 2016 to 2020 coming from consumers and another $13 billion from commercial and civil industries. That's because more professionals, like realtors, security firms, advertising agencies, architects, construction firms and developers are looking for aerial video to do business. 

With a recent proposal from the Federal Aviation Administration (FAA), there's a chance the demand for drone pilots will grow even more. The FAA proposed that flying drones over people and at night should be legal under certain circumstances, and it should not require a waiver. The current regulations require that drone pilots receive a waiver to fly their drones over people or at night. If that requirement is removed, it would enhance the industry and allow drones to fly more frequently. In theory, this would increase the need for drone pilots and might open up night shifts for drone pilots among other opportunities. 

According to an article on Lexology, "The proposed rules will be an important step forward for companies using drones in their business. The current rule prohibiting overhead flight is a significant deterrent to adopting drones as a business strategy because it forces businesses to either conduct operations of limited and unproductive scope or apply for a waiver from the FAA." 

Even as the industry grows and gains popularity, there are still numerous regulations and restrictions surrounding drone pilots. The Department of Homeland Security recently released a video and other information outlining the security risk of using drones, especially those manufactured in China. If you want to become a commercial drone pilot, it's important to understand the security threats posed by drones. 

With drones becoming an increasingly relevant industry, it's not surprising that some people want to enter the field and fly a drone for money. For the most part, it's common to see interested pilots wondering how to become a commercial drone pilot. Despite the rising profile of drones, there's not an abundance of information available regarding the process of becoming a drone pilot outside of government sites. 

If you are interested in learning how to become a commercial drone pilot but don't know much about drones, it's first important to learn the basics of the industry. Increasing your drone knowledge is a good way to get ahead in the field. We'll highlight a few common questions from interested drone pilots before diving into the process of becoming a pilot and discussing important industry regulations.

What does a commercial drone pilot do?

At the most basic and broad level, commercial drone pilots fly drones for companies in a range of industries and for varying purposes. Some companies use drones to take aerial photos and videos for marketing purposes, while other companies use drones for aerial surveillance. There are several uses for drones, and commercial drone pilots execute different drone needs for businesses. 

In our research, we found that most companies hire drone pilots on a freelance basis. Many companies don't have full-time drone pilots, but rather bring people in to fly drones for specific projects. This can require a significant amount of travel to project sites. 

What's the difference between a drone, a UAV and a UAS?

A UAV is an unmanned aerial vehicle. Another common term used in this industry is UAS, which refers to unmanned aircraft systems. Depending on where you're reading about drones, you may see different terminology used. The FAA frequently uses UAV to refer to drones while most mainstream media outlets use the term drone as it's more well known to the average reader. For the most part, those terms are used interchangeably. 

A UAS, on the other hand, refers to more than just the aircraft. A UAS includes the whole system, which means the steering system and the pilot are lumped in with this phrase. That means the UAV is a part of the UAS. 

If you want to get technical, UAVs are more advanced versions of drones. If someone is using a $100 drone for recreational purposes, it won't be referred to as a UAV, but an expensive UAV can be considered a drone. As we mentioned, the FAA uses UAV frequently, and that's the more official term for what commercial drone pilots will use.

How much money does a commercial drone pilot make?

The salary of drone pilots varies quite a bit, especially considering that many pilots work on a freelance basis. The hourly rate also varies by project and industry. Work with thermography might yield higher results, according to an article from MarketWatch, which outlines a drone pilot who makes $200,000 annually thanks in large part to his thermography certification. 

PayScale lists the average hourly rate of drone pilots at $24.18, but that rate varied from $17.75 for the lowest-earning pilots to $78.49 for the highest earners. It's hard to get an exact estimate for how much a drone pilot will make, but the potential to earn hundreds of thousands of dollars annually exists. Achieving that goal requires taking on a significant number of projects. 

If you want to get in on this groundswell and become a commercial drone pilot, you will need three things: 

  1. A drone pilot license
  2. Professional drone insurance
  3. A drone

Get a drone license

The first step in becoming a drone pilot is obtaining a drone license. Selling drone photos without a license could earn you a $1,100 fine from the Federal Aviation Administration (FAA). The government has mandated that anyone who flies a drone for a commercial, nonrecreational or governmental purpose needs to have a special license to do so. This license is called a Part 107, named after the rule that governs it.

To get this license, you have to register with the Integrated Airman Certification and Rating Application (ICARA), then register online for the written test, which costs $150 and can be taken at an FAA-approved location. These are often local flying clubs or airports. This test involves 60-plus multiple-choice questions that cover setting up, operating and safely using a drone. You need to answer 70% of the questions correctly to pass.

Applicants must be at least 16 years old and have a government-issued picture ID. Additional requirements from the FAA include the ability to speak, read, write, and understand English as well as being in the physical and mental condition necessary to complete a drone flight. Note: It may take a couple of weeks, depending on your location, while you sit on a waiting list. There are about 700 locations in the United States.

To give you some idea of the test's difficulty level, here's a sample question:

A stall occurs when the smooth airflow over the unmanned airplane's wing is disrupted and the lift degenerates rapidly. This is caused when the wing:

A) exceeds the maximum speed.
B) exceeds the maximum allowable operating weight.
C) exceeds its critical angle of attack.

You don't have to go into this test cold, though. The FAA offers a free two-hour training course that you must preregister for and an online study guide. If that's not enough, there are plenty of sites that can help teach you the rules and regulations of flying a drone, such as RemotePilot101 and UAVGroundSchool. The latter offers to pay the fee for your Rule 107 test if you don't pass. Taking practice tests is a good way to increase your knowledge and feel more comfortable when the actual test rolls around.

After the test, your score will be uploaded in 48 hours. Then you can apply for your Remote Pilot Certificate. The TSA will run a background check on you before you can print out a certificate. 

The FAA summarizes its process to become a drone pilot in six steps, with the first three being the most noteworthy. 

  1. Schedule your drone test through a Knowledge Testing Center.
  2. Pass the aeronautical knowledge test.
  3. Complete FAA Form 8710-13. 

After completing those tasks, you receive an email once your background check is completed. You then are mailed your remote pilot certificate, and you should keep that with you when flying your drone.

Purchase drone insurance

The next thing you will need is professional drone insurance. Don't assume that your home, personal or professional insurance will cover this. Most modern policies exclude drones from coverage. Instead, you should look into getting a professional drone insurance policy from a company such as AIG or Agion that offers sufficient coverage for any accidents. This should include coverage for your equipment, the cameras that you attach to your drone and enough coverage to protect you if your drone crashes into something or somebody (something that's probably inevitable). 

One interesting and usually lower cost option is called Verifly. This offers policies that you can buy on the spot that provide up to $10 million in coverage. There's even an app that allows you to buy on location for a fixed amount of time. You can even get drone insurance for as little as one hour.

Pick a drone

Finally, you'll need the drone itself. If you are shooting video for a client, they are going to want professional-looking video that has sharp detail and bright, clean color. Although you might be able to get away with a cheap drone like the $799 Mavic Air, you would be better placed to look at investing in a larger, more flexible drone, like the DJI Inspire Two, combined with a camera like the Zenmuse X5. This combination will allow you to shoot the same beautiful, smooth 4K video that you see on nature documentaries. It isn't cheap, though: this combination will cost you about $5,000. 

Whichever drone you decide on, you'll need to register it. The FAA requires anyone who flies an unmanned aerial system (UAS) or drone that weighs more than 0.55 pounds and less than 55 pounds be registered. It will cost you $5, and you must renew it every three years.  

If you pick a drone that weighs more than 55 pounds, you'll need a 333 exemption, which is hard to get and generally requires a real, full-on pilot's license.

Get flying

There are a few rules you'll need to abide by as a commercial drone pilot. According to the FAA, the following are several rules that require a waiver.

Screenshot from FAA.gov

Before you start flying, you want to make sure you're either following all of the Part 107 rules or that you receive a waiver for the above specifications. It's helpful to get hands-on training as well, as it's unlikely that you will get too many high-paying projects without proving that you have more than just knowledge and have flown drones previously.

A quick Google search yields dozens of potential in-person training options. You can find instructors in your area who can help you develop your skills through structured hands-on training. DARTDrones is a well-respected drone training company that helps pilots learn the basics of flying. The company also offers courses for when you're looking to gain more advanced training. Plenty of options exist in the industry, and it's worth spending the money to take one and learn how to fly your drone properly rather than trying to become a commercial drone pilot without hands-on training.

Upon following the rules and completing training, you should feel comfortable flying your drone commercially. The more experience you get once you start flying and completing commercial projects, the more money you will be able to charge for your services.

This year is a good time to become a commercial drone pilot, and the field can be lucrative. It will, however, take some money to purchase the equipment, training courses and insurance needed to become a pilot. If you want to become a commercial drone pilot, you have to be committed to the startup costs.

Additional reporting by Richard Baguley.
Posted by: at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)