Hackers

Do You know ?

A Different Approach to Network Intrusion Detection

There are many Intrusion Detection Systems out there. What exactly should an Intrusion Detection System or Solution do? Well that one’s sort of self explanatory, it should detect intrusions. There are host based intrusion detection solutions and there are network based IDS solutions. Host based IDS try to determine malicious processes and inter-process behavior from the perspective of a host. Network IDS solutions attempt to see malicious activity from analyzing network traffic. Network Based IDS has a particularly broad view, but is prone to false positives (falsely identifying benign traffic as malicious) and false negatives (not identifying malicious traffic). Additionally, more and more network traffic is being encrypted, thus hiding malicious payloads from IDS sensors. So in addition to the initial cost of purchasing an IDS solution, they require a lot of tuning to get useable results.

This post is about a different approach to network intrusion detection. It is certainly not meant to replace traditional IDS solutions, but can be added alongside existing solutions. This solution looks for traffic that shouldn’t exist at all. If traffic is seen using this method, it should be investigated. This stray traffic is either a result of a configuration error, or a malicious process. In addition to producing few false positives, the cost of this solution is next to nothing.

To implement this solution, a network administrator would basically black hole all address ranges that are known not to be in use and direct the traffic to a host that can capture these packets. The RFC1918 range should be a safe bet. Additionally any public IP address space that is owned by the organization, but not in use could also be used. Let’s look at an example organization’s IP address usage to understand how this might work

ACME Organization

Routing Protocol (IGP): EIGRP (summarization disabled)

IP Addresses (Internal)—

192.168.1.0/24

192.168.50.0/24

192.168.60.0/24

192.168.70.0/24

192.168.80.0/24

10.1.1.0/30

10.1.1.4/30

10.1.1.8/30

10.1.1.12/30

Public Addresses Owned: 192.0.2.0/24
Public Addresses Used: 192.0.2.1-250

In the ACME organization, we should only see IP traffic destined to IPv4 addresses in the above RFC1918 address ranges, the used public address range, and any other public IP address that are not owned by this organization. If traffic appears on the network destined to other RFC1918 address it is certainly out of place and should be investigated. Additionally packets containing a destination IP addresses 192.0.2.0 or 192.0.2.251-255 are also out of place and should be looked at.

So how do we easily capture this traffic for investigation? It is actually quite simple if we think about how routers work and how packets are converted into frames as they are handed back down the OSI model. The first concept we should revisit is the longest match rule that is used by the route table. If a router has a route to 192.168.0.0/16 and another to 192.168.50.0/24, a packet to 192.168.50.12 would match the route to 192.168.50.0/24. A packet to 192.168.33.5 would match 192.168.0.0/16. We can leverage this and inject some routes into our network. So let’s take this concept and apply it to a simple network.

Network Diagram



In the above diagram, we have a “deflection router”. This router is located just behind the firewall, but could be located anywhere in the network (as long as summary routes aren’t overriding the routes that we are about to inject). The first thing we need to do is to deflect packets going to unused RFC1918 ranges out the Ethernet interface connected to our “Sniffer Host”. To do this, we’ll set up an IP address for that interface, and create some routes.

Router(config)#interface fa0/1

Router(config-if)#ip address 10.1.1.13 255.255.255.252

Router(config-if)#no shut

Router(config)#ip route 10.0.0.0 255.0.0.0 10.1.1.14
Router(config)#ip route 172.16.0.0 255.240.0.0 10.1.1.14
Router(config)#ip route 192.168.0.0 255.255.0.0 10.1.1.14
Next we will create routes that will divert the unused public addresses.

Router(config)#ip route 192.0.2.0 255.255.255.255 10.1.1.14
Router(config)#ip route 192.0.2.251 255.255.255.255 10.1.1.14
Router(config)#ip route 192.0.2.252 255.255.255.252 10.1.1.14

Notice, I’m routing the traffic to these unknown address ranges to 10.1.1.14. Does 10.1.1.14 have to exist on “sniffer host”? Not exactly. Actually I might not even want IP bound to the sniffer hosts’ interface. This will help protect the sniffer host itself from being attacked. However, if I take this approach, I must somehow coerce the router to forward the frame anyway. Typically, the router will do an ARP lookup or request to figure out what destination MAC address to use on the frame it has to build. We can trick the router into doing this by creating a static ARP entry. In this diagram, we are directly connecting a host to the router via crossover cable so the host will receive all frames produced by that interface (we just need to remember to put the sniffer’s NIC into promiscuous mode when we start to capture traffic).

Router(config)#arp 10.1.1.14 abcd.abcd.abcd arpa

Now the router understands the egress interface for these packets based on the route statements and the interface that is connected to the 10.1.1.12/30 network. The static arp entry gives the router the information that it needs to “frame” the packets. As long as the interface is up and the router doesn’t have more specific routes to a destination, it will send these packets to the sniffer host.

Earlier I pointed out that this router is in the path to the firewall but it could be located anywhere in the network. Keep in mind that if summary routes are being used, that may need to be evaluated. If this router isn’t already in the path of all packets (aka the default gateway), the routes can be injected into the IGP. This might look something like the following.

Router(config)#router eigrp 1
Router(config-rtr)#redistribute static

Now all we need to do is connect the Sniffer Host to our router via a crossover cable and start our favorite sniffer program. We don’t even need an IP address or the IP Protocol bound on the sniffing interface. A good technique for capturing traffic might to be using dumpcap (part of the Wireshark package) to capture anything destined to MAC address abcd.abcd.abcd and storing it in a file. For example, create a directory called “c:\caps” and enter the following command.

C:\Program Files\Wireshark>dumpcap.exe -i 2 -b duration:86400 -b filesize:50000 files:1000 -f "ether host ab:cd:ab:cd:ab:cd" -w c:\caps\badtraffic.pcap

The above command uses dumpcap to capture traffic on interface 2. The interface number is entered following the “-i” parameter. To determine the interface numbers use for a system, use the following command “dumpcap –D” (case sensitive). The parameters following the “-b” parameters are the ring buffer options. These tell dumpcap when to create a new file. In this case, a new file would be created at least once every 24 hours, the files would never exceed 50MB, and 1000 files would be retained. This should keep space consumption below 50GB. The string following “-f” limits the capture to the frames that contain the MAC address abcd.abcd.abcd (from the static arp). Finally “-w” directs dumpcap to save this contents to a file in the c:\caps directory. The filenames will be based on badtraffic.pcap but will also include a timestamp in the filename.

Now that we have this in place, we can easily test it. To do so, simply ping an address from an RFC1918 address space that is not in use. For the ACME network, we could ping 192.168.254.200. It is a good idea to test this from various points in the network. These packets should make it to our capture file. Double clicking the capture files should open it in Wireshark. We can now investigate the file for any signs of configuration errors or reconnaissance against our internal network. While this is not a comprehensive IDS solution, it is a good way to see when an internal host has been infected with something that it is trying to propagate to other internal hosts.

Ever heard of Layer 8?

In the networking world many are taught the Open Systems Interconnection model or OSI model of networking.  The OSI model is described as a layered approach of how data travels in the network.  The layers taught in any networking class are, starting from the bottom and working your way up:

Application Layer

Presentation Layer

Session Layer

Transport Layer

Network Layer

Data Link Layer

Physical Layer

However, for years I have always heard the joke about Layer 8.  Now although the OSI has no official designation of such a layer, it has been my experience that such a layer may exist!  In fact, Cisco even addresses this “layer” in their CCDA certification although they do not refer to it as a Layer of the OSI, which they are correct.

In the CCDA, it is taught that in order to make a good design you need to know what the business and technological requirements are and you have to live within the business and technological constraints.  Think about that for a minute.  You have to design a network to deliver who knows what and you have to do it with certain constraints, usually a limited time line or budget.  Have you ever found yourself in a meeting where a customer wants what is technologically impossible, against their company policy or so expense that not even all the money in the world could afford what they want?  I have… often.  To make matters worse the customer may have multiple people present the business and technological constraints and goals and they may conflict with another person’s goals and constraints within the same organization.  Then comes the process of debating, negotiating, hashing out the details to find some kind of compromise and to find a solution that will meet all of the goals and be achievable within the constraints that exist.  It is this process that I refer to as the Layer 8.

If you have not had this experience, consider yourself fortunate.  However as unpleasant as such a situation may be, there are some good learning opportunities for both the design engineer and the customer.  In fact, during this political process as I choose to call it, I have learned a great many things that have been beneficial to help me increase my understanding and help the customer increase theirs!

·      Education and understanding is key when going through the “Layer 8” or “political” process.  During such meetings I have come to realize that more often than not, the customer doesn’t even know what they want themselves!  They just want a solution to work and to be as convenient and easy as possible and they want it for next to nothing.  Listen, really listen to your customer and restate what they are telling you to make sure you understand the feedback they are giving you.  They may be surprised at what you understand from then.

·      Ask who, what, when where, why and how questions.  This will be extreamly helpful in getting the customer to really think deeper and consider the outcome. 

·      Explain in basic principles how technology works.  Some people really don’t want to know the deep details, however, give your customer enough understanding to help them make an informed decision.  It is been amazing to hear customers” gratitude for explaining technology to them. 

·      Give people options.  My kids really don’t care for being told what do to or how to do it.  Customers can be the same way.  Instead of dictating to them what they should be doing (even if you are right), give them options and explain the pros and cons of each option.  Remember it is ultimately their decision, not yours.  Help then to make decision via the process of elimination.  Objectivity is a must!

·      Control emotions!  I cannot stress this enough.  It can make or break a deal, get you promoted or fired!  It is difficult, but it can be done.  People are passionate creatures and that is ok, as long as the passion is controlled.  If it gets out of hand, you may find yourself having a Darth Vader conversion moment and that is not going to help yours or your customers situation. 

·      Document!  The old saying “the customer is always right” rings true, even when they are wrong.  We all make decision, some good and some bad.  All those decisions have some kind of consequence, some good, some bad.  When participating in the Layer 8/political process, acknowledge ownership where it is due.  This is a joint effort and there must be joint responsibility.  Documentation is the key to not only hold people responsible but serves as a reminder of what is discussed, agreed upon and finally decided.  Documentation helps serve as a reminder to everyone.  I can’t remember everything that is discussed in a meeting, but having good notes and documentation sure helps remind me of things and helps to keep me in check.

The Layer 8/political process isn’t for everyone.  Some love it, others hate it.  I love to see customers enlightened as I explain technology to them on their terms.  I really don’t care to be the mediator of a heated debate.   Oh how glad I would be if I had the Enterprise transporters to get me out of those situations!  Unfortunately, that isn’t an option so the mentioned points are the things that have helped me get through the Layer 8/political process.  For a designer, there is much more than technology skills that are needed.  Good personal and communication and negoation skills or "soft skills" are an absolute must to survive this process.

----------
Ref:Cisco.com

Five Tips to Keep Your Career Moving Forward

Now that 2011 is coming to an end and 2012 will soon be upon us, many will be making New Year’s resolutions. The most popular resolutions probably relate to health. However, many people also include career goals in their resolve. With the continuing economic challenges, it is tough but not impossible to feel like personal career growth is continuing. This article is only peripherally related to our current series of discussions on job roles and tasks. This is article is a New Year's Article that focuses on five key things that everyone can do to help keep their careers moving forward, even in tough economic times.

Tip 1 - Find a Mentor

Finding a mentor may be a challenge. In many cases people tend to keep what they know to themselves. Some people seem to think that if they are the only person that can do a task, they are more valuable to the organization. Furthermore, some people like to place themselves high on a pedestal and have the desire to stay there. I think we have all met people like Nick Burns. I doubt Nick would make a good mentor.

For those unfamiliar with Nick Burns, here is a video excerpt from Saturday Night Live.

A good mentor is someone that you can trust and who can help you stay on track. This is not a person that does everything for you when you get in over your head. This is a person who gently steers you in a direction that is conducive to your career or your particular role in an organization. This person can not only be beneficial for career goals, but also for specific tasks that may be a stretch for your abilities. The challenge is finding someone that is willing to take the time to share their experiences. If you cannot find someone within your immediate circle, you can always have lunch with others in the industry and learn from each other’s experiences.

Tip 2 - Build your Network

There are many networks out there, so let me elaborate. There are social networks like Facebook, Twitter, Google Plus, and LinkedIn. What I’m talking about here is YOUR network. It may consist of contacts that you have met personally, as well as a subset of individuals from any or all of the social networks I mentioned. What is important is that you start to build solid relationships for a couple of reasons. You never know when you might need a “go to” person or a subject matter expert in a particular area. Additionally, making others aware of your areas of expertise or experience can be beneficial. People are in YOUR network if you feel comfortable reaching out to them and they feel comfortable reaching out to you. Don’t abuse your network. It should be a “qui pro quo” arrangement that is mutually beneficial for you and them.

Tip 3 - Help Others

Helping others is sort of the opposite of finding a mentor. Helping others can actually help you in many ways. First, there is no better way to solidify concepts than pushing your knowledge to the point that you can explain something simply. I am not advocating that someone should share their knowledge about something that they know nothing about. However, an individual that has worked with a specific topic or technology often will initially struggle to explain it. Working through this struggle often leads to a much deeper understanding.

If you can't explain it simply, you don't understand it well enough. -Albert Einstein

Tip 4 - Continue Learning

Since you are reading an article on The Cisco Learning Network, you may naturally desire to continue learning. This is a good thing. With networking technology, I do not think there is a point that you look at yourself and think “I have arrived”. Like other career choices in technology, we must be comfortable with change. The value that you bring to an organization is your ability to work with that change. Your thirst for knowledge should not just be in deeper understanding, but also broader understanding. How technologies interact with one another is as important as knowledge about the individual technologies. Nothing lives in a vacuum anymore. All areas of technology are interoperating with other areas to achieve some business goal. Although the fact that someone can configure a router or a switch is very important, companies are looking for people that can solve the business goals and challenges.

Tip 5 - Keep your life in Balance

If you love the challenges of technology, keeping your life in balance may be difficult. I think it is important to keep your relevant areas such as family, church, health, and personal time in check. Others tend to view your priorities based on how much time you spend nourishing each of the “loves” in your life. This is valid because we tend to spend more time with those things we enjoy. So if technology is dominating ALL of your free time, you may need to schedule “technology free” times to balance out your life. I have personally witnessed family or personal issues that have had serious adverse effects on individuals’ careers.

Conclusion

I think everyone knows that many challenges exist in the current job market. The challenges seem to be even more prevalent with those who are young or inexperienced to the field in which they are seeking employment. Although technology jobs are more prevalent than some other fields, challenges still exist. If you are not employed, my recommendation is to do what you can to get employed. Even if your employment is less than what was expected, there is always room for growth. For those employed, focusing on these five tips will help keep their careers on track. As new and exciting challenges present themselves, simply gravitate to the areas that are of interest to you.

Ref:

CCIE Career

Sydney Lab View

This is the meeting area from you can see the city view as well.

Information Security for Fun and Profit

Continuing our series of discussion of job tasks, roles and careers, I wanted to talk about security. As many of you know, I consider myself to be a jack of all trades as opposed to someone that has a deep knowledge of fewer topics. As we will soon see, this actually lends itself well to information security. In this article, I will discuss different disciplines commonly found in security and the skills that are most relevant. We will touch briefly on the certifications that are most relevant to each role and see how we can build our careers as we gain knowledge and experience.

Certifications

Since this article is part of the Cisco Learning Network, I would expect most readers to be at least somewhat interested in certifications. In technology, certifications are one of the more prevalent earmarks of knowledge. In information security, this is also the case. Cisco offers many certification programs. Some are Security centric, while others are not. Even certifications that are not focused on security usually have security components. For example the CCNA program addresses device security, access control lists, and switchport security.

The fact that security is integrated into many non-security centric exams is a theme also found in non-security centric job roles. In other words, security is part of everyone’s job in the enterprise environment, not just information security professionals. For example, one may find themselves working in a network design role. Even though that is not a security position, security is still an important skill that must be integrated into the day to day tasks of that position. Even employees in a non-technical role still need to be well integrated into a solid security program.

Regarding Security centric certifications, Cisco offers the following certifications and specializations. Some of these programs are being discontinued, but may still be associated with individuals.

• CCNA Security
• CCSP
• CCNP Security
• CCIE Security
• ASA Specialist
• Firewall Security Specialist
• IOS Security Specialist
• IPS Specialist
• Network Admission Control Specialist
• VPN Security Specialist
• Security Sales Specialist (Reseller Specialization not relevant to the enterprise infosec role)

As you can see Cisco is not only represented with actual security products, but also offers a wealth of security certifications and specializations. However, Cisco isn’t the only security vendor in the security arena. From a security perspective, I consider Cisco a network security vendor. There are other network security vendors who have security certification programs. Examples of these are PaloAlto Networks and Juniper. There are also security certification vendors that do not have an affiliation with specific product vendors. For example, ISC2 offers the CISSP certification and SANS has a variety of information security certifications.

General Security

When I think about information security, I think about data and technology. What can we do to efficiently and effectively protect these resources? A three letter acronym is often used to describe three areas of data protection— Confidentiality, Integrity, and Availability (aka CIA). Obviously this is only one viewpoint or dimension of data protection, but those key points must be maintained across critical systems and corporate data. There are actually several different types of roles that encompass these concepts and different types of people to fill the roles.

Roles

The first security role that I must mention is everyone else. Everyone else is actually everyone in the organization that does not have the word “security” in his or her title. How “everyone else” is used will largely determine the security posture of an organization. Furthermore, if you are reading this article and have the desire to get into security position, you are most likely part of “everyone else”. Security leaders who are reading this article realize that creating a security ecosystem is much easier if "everyone else" is working with you instead of against you.

So what can and should this group of employees do for security? First and foremost, they can familiarize themselves and follow the organizations policies. Possibly even more importantly, they can familiarize themselves with the norm. This will vary widely from position to position, but when someone notices a deviation from the norm, it could be a red flag that something is going on. Good security managers realize that they should never make someone feel unwelcome to bring forth such concerns.

Security Centric Roles

Now let’s talk about the positions in the organization that are security centric. These positions fall into a few categories. The first major category that I would mention is what I call operational security. Later we will also discuss audit and compliance, penetration testers, and security management (a subset of which can also be integrated into any of these roles).

Information Security Roles

When dealing with information security and security in general, operational security personnel are those who have day to day jobs that directly configure, monitor and otherwise maintain the systems that are responsible for the security of corporate data. I often find that security operations is further broken down, into network security, application security and general security operations. In my experience, it is actually difficult to find a single individual who is an experts in all of these areas.

Network Security Roles

Of these three subcategories, Cisco is obviously more prevalent in the network security. Network Security, or netsec, involves securely configuring and monitoring network devices and protocols, building appropriate security boundaries, and configuring secure connections. This infrastructure is then utilized to provide a secure and reliable connectivity for systems and applications. Netsec individuals will likely be responsible for one or more of the following:

• Firewalls
• IPS/IDS
• Router Security
• Switch Security
• Network Monitoring System
• Security Information and Event Management (SIEM)
• Network Protocol Security
• Virtual Private Networks (VPNs)

The environment that a network security individual works in (or desires to work in), influences what certifications he or she might have or be seeking. As you can see from the list above, Cisco is well integrated into this area of information security. The depth and breadth an individual is responsible for might also influence the certifications he or she might choose to pursue. For example, someone who is only making day to day firewall changes in a Cisco environment might pursue the Cisco Firewall Specialist. Someone who is making regular ASA Firewall and VPN changes might pursue the Cisco ASA Specialist certification.

If this individual is promoted (or desires to be promoted) from a firewall administrator to a firewall architect or engineer, he or she might pursue the CCNP Security or CCIE Security certification. Typically a person in this field of work who is an engineer or an architect has a broader and deeper knowledge. This person has very likely performed advanced work in many or all of these key netsec areas. Additionally, this senior person will likely manage and/or mentor those who work in their respective areas so they can gain a deep knowledge of the components they are responsible for and how they affect other areas of netsec and the organization holistically.

Application Security Roles

The next key area of information security is application security. Honestly if application security could always be solid, netsec professionals would only need to secure the underlying infrastructure and protocols. Since application security is often overlooked, netsec professionals make an effort to augment the shortcomings. So why is application security such an issue? My opinion is that most developers are naturally focused on providing functionality. Even though they may have concerns about security, it is usually not the primary concern. As a result, a lot of software bugs and vulnerabilities exist. From a netsec perspective, firewall administrators typically permit or deny traffic based on IP addresses, protocols and ports. As a result it is difficult for a firewall to detect anomalous traffic that is potentially malicious against a service that is provided by vulnerable software. This is especially true when the applications perform some type of encryption to further hide conversation details from network security professionals.

So what can an application security professional do? The answer to that really depends on the type of environment that he or she is working in. In some cases, an organization develops their own software, or software for other organizations to use. In those cases, the application security professional might oversee a secure development process. In other organizations, only commercial software may be used. In those cases, an application security professional would need follow various bugtrack sites and understand the ramification of vulnerabilities that have been found in the software used by their organization. In my personal experience, it is difficult to find a single person who is strong in both application security and network security. SANS offers certifications and training that are fairly relevant to application security.

General Operation Security Roles

In the operational security category, there is one more group or type of individual. This position might be simply called operation security (even though it is a subset of the operational security category that I initially mentioned), or something similar. This crucial position or discipline is interested in how an organization processes interact with one another as well as interact with the network and applications securely. Even if an organization has a relatively secure network with relatively secure applications, the methods in which the systems and technology are used can leave the organization very vulnerable. Additionally, a single process may not have any apparent risks. However when that process is combined with other processes in an organization, the risks may be exponential.

A person in this general security position should understand the interaction between systems and processes, making the organization fully aware of operation risks. In a smaller organization, this may be part of the role of the CSO or CISO. This category of individual would benefit from knowledge gained in appsec and netsec as well as understanding the business process that make up their organization. Since these processes vary so widely from organization to organization, certifications may be less relevant. A certification program that provides a broad scope, such as ISC2’s CISSP, may be beneficial though.

Audit and Compliance Roles

I grouped the last three categories of security professionals into one major group that I called operation security. Audit and Compliance is typically a separate group but most work closely with other areas of security. One reason for the separation is to avoid conflicts of interest. This area must be intimately familiar with the ins and outs of all applicable regulatory guidelines. They must work with the respective individuals to establish how each of the guidelines are being met. If there are shortcomings or inadequacies, audit and compliance professionals may further educate the nonconforming area of the regulatory requirements. Although InfoSec is a major component of audit and compliance, it is not the only area of concern.

Penetration Testers:

Earlier I mentioned that it is difficult to find someone who has solid expertise in application security, network security and general operational practices. Penetration Testers, or pen testers, must have expertise in all of these areas. These professionals are individuals who break into systems for fun and profit. The purpose is not to humiliate those responsible for inadequate controls, but to educate the organization regarding weaknesses in their systems.

Penetration testing should be done to some degree by the individual network and application security professionals. This would to test the adequacies of the controls they configured. However, penetration testing that is to be reported to a CEO, board of directors, or other responsible or certifying party, should be performed by an independent third party that has no conflicting interest. It certainly makes little sense for the person who designed and configured a firewall to be the person who is reporting to the board of directors how secures the implementation is. If security is important, an independent assessment should be done. Furthermore, a pen test should go beyond just a firewall, but test the processes and the security posture holistically.

Responsibility

Thus far we have talked about different roles that are actively involved in security. We have also discussed roles that confirm that the organization is compliant with any regulatory mandates. Additionally, we have touched on the role of a pen tester, who can also look for vulnerabilities that may have otherwise been missed. Now we need to talk about responsibility. Responsibility can be assigned at almost any point in the organization. In all actuality, everyone is responsible for their own actions. However, the person I am now talking about is likely an officer in the corporation. When something happens, this is the person that will have to answer the tough questions and explain how this could have happened (given the investment that the company has already made [or thinks it has] in security).

In a larger organization, this person may be the CIO (Chief Information Officer), CISO (Chief Information Security Officer) or CSO (Chief Security Officer. The CIO is typically the person that is responsible holistically for the information systems and data. The CSO and CISO are more focused on security. CSO is more generically related to security, where CISO is focused on information security. Organizations can have any or all of these roles. The CIO often reports directly to the CEO or in some cases, directly to the board of directors. A CISO or CSO may report to the CIO, another member of executive management or directly to the board.

Physical Security

The final thing that should be mentioned about security is that we must not forget about physical security. So those individuals in the organization who are responsible for physical security are very relevant to information security as well. We can install the best firewalls, anti-virus and use the strongest possible encryption. If someone can walk through the front door and carry out a storage enclosure, our information security was all for naught. Hopefully we had full drive encryption, but we are still taking an outage (and that is the third component of CIA).

Conclusion

Security is a constantly evolving area. Specifically with information security, new vulnerabilities are found daily. New threats are coming from some of the least suspecting sources. Like other areas of technology, my advice is to always gravitate toward areas that interest each person individually. If you enjoy deep and broad research and application of technology, information security might be a good career choice.

Ref:
Security Roles