At Tyler Cybersecurity, our analysts and consultants are there for organizations like yours every day. Their jobs are to help protect and empower you while sharing their cybersecurity knowledge, so you can be well-informed and armed with necessary tools in the event of an incident.
We recently caught up with Andrew Sylvia and Josh Moss, two of Tyler Cybersecurity’s penetration testers, to learn more about how they help our clients and what their day-to-day life looks like. We hope that by highlighting them, you will learn why penetration testing (pen testing) is needed within your organization and encourage people with an interest in ethical hacking to pursue it themselves!
Andrew Sylvia, Sr. Cybersecurity Consultant & Josh Moss, Cybersecurity Consultant
Q: Why did you decide to pursue a career path in pen testing?
AS: Starting in middle school and high school, I developed a passion for computers, networking, and security. My dream job at the time was to be a member of a "tiger team," now known as a red team. After going to school for computer science, I progressed through jobs in IT, security monitoring, and finally pen testing. I have always been fascinated with the topic and I think it was a natural progression.
JM: I have always been interested in computers. I have been tinkering with hardware and software since I was a kid. I joined the Coast Guard and was working in the intelligence field when a solicitation to fill a special duty assignment at US Cyber Command came up. I applied for the position and got it. When I arrived at US Cyber Command I was immediately drawn to operations (military pen testing). I worked as hard as I could to get into an operator position and have loved it ever since!
Q: Walk us through a day in the life of a pen tester.
AS: We work with clients to understand scopes and get what we need to conduct testing. We perform reconnaissance and use scanning tools and manual techniques to understand the attack surface of our client's networks, devices, and applications. When vulnerabilities are discovered, we attempt to exploit them if possible and safe to do so. We then compile this information into reports for our clients. Reporting is not the most exciting part of the job but one of the most important, as this is one of the primary ways we can communicate our work and help clients improve.
JM: I passively and actively scope out our client’s internet presence by enumerating open source information about their employees, deployed software, subdomains, network devices, and software versions. I analyze this information to identify vulnerabilities in their systems which I then exploit to demonstrate business risk.
Q: What is your favorite part about your job?
AS: I love discovering interesting vulnerabilities and meeting the challenge of defeating security controls to demonstrate risks for our clients. I also enjoy helping to drive organizational change when it comes to security.
JM: I love it when “the lightbulb” goes off after wrapping my head around a hard challenge. It feels very rewarding to get a difficult exploit working.
Q: What certifications do you have, and which one are you most proud of?
AS: Offensive Security Certified Professional (OSCP), Offensive Security Certified Expert (OSCE), Offensive Security Exploitation Expert (OSEE), Offensive Security Wireless Professional (OSWP), GIAC Certified Web Application Penetration Tester (GWAPT), Certified Information Systems Security Professional (CISSP), and Security+. I am most proud of my Offensive Security certifications, especially the OSCP, OSCE, and OSEE. They really challenged me and forced me to grow my skills in multiple directions.
JM: My Offensive Security Certified Professional (OSCP), GIAC’s Advanced Penetration Tester and Exploit Researcher (GXPN), Web Application Penetration Tester (GWAPT), Network Penetration Tester and Ethical Hacker (GPEN), and Security+. I'm most proud of my OSCP. It’s a difficult certification that took a lot of time, discipline, and dedication to earn.
To learn more about obtaining Offensive Security certifications, click here.
Q: Why are certifications important to pen testing?
AS: It is important to development a baseline level of knowledge and skill so that testing can be performed competently and professionally. The process of attaining certifications, especially the more hands-on certifications, can speed up this process and fill in gaps in your knowledge.
JM: Certifications prove that you know a body of knowledge relevant to the field. Practical certifications like OSCP prove that you can apply hard skills “on-keyboard,” which matters in this hyper-technical job role. I do think that one can demonstrate this knowledge with a blog (such as Medium) or a well-kept GitHub repo as well. Certifications are NOT the end-all-be-all.
Q: Is there any advice you have for someone who may be looking to get into pen testing?
AS: Join security meetup groups and network with security professionals. Improving your knowledge is always good but try to get hands on experience as soon as you can. Consider setting up a home lab with virtual machines. The process of setting up various technologies can help you understand them better and will improve your mental models. Look into the OSCP certification if you have the time and inclination. Enjoy the process of learning and realize there is always more to learn. Stay legal!
JM: Take advantage of the oh-so-many free online resources out there and document your journey. I think that a candidate can do well for themselves to have a blog that shows what they’ve been doing and what they’ve learned. If you start a blog, you can also reference it in the future!
Q: Why is it important for organizations to do pen tests?
AS: Pen tests help organizations see the impact of various vulnerabilities being exploited in their environment and help them to understand realistically what an attacker may be able to achieve. Pen tests are a great way to demonstrate risks and drive change in organizations.
JM: You don’t know what you don’t know. A pen test provides a look at your organization from the context of a hacker who is aiming to do harm. We can find vulnerabilities that automated scanners aren’t going to find, and we are able to demonstrate the business risk of having these vulnerabilities exploited.
Be like Andrew and Josh and learn how to uncover your network vulnerabilities before an attacker does. Download our Guide to Penetration Testing to learn how to choose the right type of pen test for your organization, what makes an effective pen test, and see how you can reduce common vulnerabilities that may be found on your network.