It frustrates me when people choose not to invest in themselves. It doesn’t frustrate me from a moral perspective, as if productivity or achievement was some weird moral obligation, but from the perspective of hoping people can realize more of their own potential. I gave up on cyber security years ago because I was afraid it was outside of my capability. What I needed was encouragement and a dedication to learn, whether I ended up being good at it or not.
As my mom has been recovering from her accident, I asked her if she had spent any time reading a book I once bought her for a low-level medical certification she had considered getting. She said no, because most hospitals, uh, require people to do something she doesn’t want to do, and while I totally agree that people should not be required to do that thing, I had to explain that not all hospitals require it. Somehow, she’s gotten it in her head that there are no exceptions, and has basically given up on the certification wholesale, for this reason alone. This is incredibly frustrating to me, as that certification could help her get a better-paying job than what she had before the accident, but sure, she might have to find the right place to put it to use. That doesn’t mean that place doesn’t exist, and it doesn’t mean the knowledge gained from that certification can’t be useful in others contexts, too, especially since I think she would be great at pretty much any job in a hospital or medical facility. Just read the damn book! You have plenty of time right now, why not invest in yourself a little? But to be fair to my mom (who I do love), we all do this to some extent. “Well, I can’t get into that anyway, I guess I won’t even try. Well, that’ll never work out, so why bother? I don’t want to deal with the downsides of that job, so the upsides must not be worth it. Oh, that takes a lot of effort, I don’t know if I have time for that”. We all have such excuses.
To be fair, though, not all self-investment is created equally, and some forms of self-investment have a much higher ROI than others.
Every now and then I hear this story repeated about a woman in her 90s who went back to college to complete her degree. If that’s what she really wanted, then awesome for her, but colleges like to use that story as propaganda for the value of college. I hate to break it to you, but there are many stories of people who thought their degree in Criminal Justice would turn their lives around, just to graduate and find their degree didn’t open any doors whatsoever. I lived that story, but I earned a different degree. Of course, I think going to college and finishing is better for you than smoking weed in your parents’ basement for 4 years. It’s the perspective that matters. Granted, some of those weed-smokers have a life epiphany, go out and start a successful business, and don’t have any student loan debt, so…again, perspective matters.
But it’s one thing to say, “This action has a low ROI, therefore I’ll focus on something else”. It’s another to say, “This action has a low ROI, therefore I won’t do anything”.
For me, there is so much I want to learn about computers and computer security and networking, and I’m really struggling to balance learning what I want to learn with learning what can help me get my first cyber security job. It’s painful, because as an INTJ, I’m rigorously practical, but as something of a subjective idealist, I want to learn what I want to learn, as that feeds into my vision for myself. The two are not quite the same!
For me, it’s been important to focus on fundamentals. It’s tempting to rush into subjects like advanced Linux networking, which I legitimately want to learn, but I’ve also been blind-sided by how much there is to learn about Linux before reaching that point. Some of that stuff I may never need on the job, but that doesn’t mean it isn’t important to be familiar with. This is in fact why college is structured with 100 and 200-level classes that introduce the broader topics of a subject before diving into special subject courses in the 300s and more highly-focused classes in the 400s. It’s not that you can’t pick up a book from the 300s and learn from it, but reading the 100 and 200 level books first gives you the foundational knowledge that allows you to understand where the specifics of the 300 and 400-level classes fit into the broader subject. Don’t neglect those!
As much as I like to rag on the price of 100-level textbooks, which is completely unnecessary, 100-level textbooks actually have the highest ROI on an information-per-unit-of-time perspective. (I buy them two or three versions old. This can turn a $120 textbook into an $8 textbook sometimes 😉 , but I’m also not in college anymore, so that’s a luxury I can indulge)
Entry level jobs are not expecting you to have 400-level knowledge of everything. And even if they did, they would assume you already had the 100 and 200-level knowledge to go with it. If you don’t have that, don’t expect to survive the interview! This tells you what you should focus on: start with the fundamentals, and build from there.
While malware analysis is something I’d love to learn eventually, I’m having to realize that such knowledge simply isn’t valuable at the entry-level. I think learning C (something you would want to learn if you were going to learn malware analysis) is incredibly valuable and helps inform pretty much everything you know about computers, but most cyber security jobs don’t require it, and as such, even a C expert is not necessarily going to get a cyber security job without the requisite security-specific knowledge that employers are looking for. You ignore this to your own employment peril! Mind you, learning C at the more experienced levels can make you a serious rockstar (as overused as that term is), but it’s funny because it does essentially nothing for you at the lower levels. My general strategy is to continue learning it, but as a low-priority supplement. There are several books on it that I’m having to deliberately not buy, because they are more like 200 and 300 level classes that simply aren’t useful right now compared to the 100-level knowledge and other more pertinent subjects.
I think this is working? I think this is right?
Sometimes that first certification isn’t enough: sometimes you need the second or third certification to get anywhere. But what’s most important is the foundational knowledge that allows you to succeed at the second or third certification. Don’t think the first step isn’t worth it just because it takes several steps to get where you’re going! There’s that aphorism that a journey of a 1,000 miles begins with the first step.
I’m probably repeating myself at this point, but it’s interesting to reflect on the subject and see how I’ve handled things and had to push back on some ideas. This career path could be so easy if I just let myself flow from the basics to the advanced topics, not getting impatient with the slow progress, but letting knowledge build upon itself and take me further and deeper with time. If I can make peace with this, I think it would take most of the pressure off of me as I realize that no, advanced knowledge is not expected from me right now, but if I get my priorities straight, the advanced knowledge will make perfect sense when I get to that point.
Don’t give up on yourself!