Learning Cybersecurity in the Age of AI

Cybersecurity used to be a slow-moving field. You learn the rules, the threats are somewhat predictable, and a couple of decades of hands-on experience keeps you sharp. That has quickly changed, however.

AI is now used to create convincing malware, launch phishing campaigns to fool thousands, and generally automate and improve attacks that used to require an entire team to pull off.

At the same time, however, AI provides opportunities for defenders to learn and adapt quicker and find weaknesses in potential attacks before they even happen.

If you are looking to get into the field, or keep up-to-date with what you already know, it is important to look into ways of learning that reflect this change and prepare you for both sides: using or defending against AI. Here are some ways you can do that.

You Need to Master the Fundamentals First

Before introducing any AI tools, it is essential to study the basic concepts of encryption, firewalls, authentication methods, and the language and procedures of network protocols. Unfortunately, these topics will not be forgotten or blocked by advanced attackers.

The critical error that a newbie admin can make is to skip the hard part of the learning process. While a chatbot will explain the required concepts in sufficient detail, it will not help form long-term memory or stimulate recall when needed.

This is where spaced repetition software comes in useful as an everyday learning tool. Using such a helpful tool, a person can create lasting memories of the information studied, attack patterns, and how specific protocols work.

Therefore, the first few months of preparation should not be filled with tool exploration but rather devoted to building a solid foundation of network security knowledge. After several months of preparation, the necessary facts will become automatically retrievable when needed most.

You Should Guard Your Own Privacy While You Study

Once you begin doing real research on the threats online, you enter slightly more dangerous territory.

Malicious websites, hacker forums, and threat intelligence feeds often log visitors' data, and you don't want your personal research habits to be tied back to your home network or real-life address.

That's the perfect time to begin developing an identity-hiding habit of using a trusted VPN/proxy to hide your IP address.

It's a good idea to get into the habit of masking your traffic with a trusted third party when getting on unfamiliar sites to investigate them.

It's almost what the professionals in the industry do when they research sketchy websites, download malware samples from dark web marketplaces, or hang around malicious forums to observe and document their activity.

Security experts learn good security habits that stick with them long after their professional career begins.

You Should Understand How AI Is Reshaping Threats

AI has not so much changed the nature of traditional threats but rather their efficiency and scale.

The attackers are now using language models to compose phishing e-mails, create voice recordings for use in scams, and perform reconnaissance tasks that previously required hours or days of manual research on the target.

Understanding how to spot such attacks is crucial since the conventional advice (such as checking the e-mail address for typos) may no longer be sufficient to protect one from a scam.

In particular, one should review how modern AI has reduced the barrier to launching an attack, thus allowing less experienced and unskilled individuals to do what previously required a team of professionals.

It is also helpful to read the latest reports on actual incidents and research papers on the state-of-the-art cybersecurity threats to have a more realistic idea of what to watch out for than old classroom materials.

You Can Train Yourself to Spot AI-Crafted Phishing

One of the most important skills to develop before encountering AI deception is learning how to spot it and prevent being deceived.

The phishing emails of the past often had typos or easily identifiable grammar mistakes, but nowadays, they appear much more realistic, personalized, and precise, using information harvested from social media, company websites, and data breaches.

Therefore, it is crucial to develop awareness about what an AI would attempt to do in an email before clicking on any suspicious links.

Asking oneself whether the message requests any sensitive information or action that seems unusual for the contacted company and checking if the language and context match familiar patterns would be helpful in distinguishing phishing emails from legitimate ones.

To help develop such skills, one should practice spotting deception in test phishing emails designed by security companies and learn common behaviors and contexts that AIs tend to use in such scams rather than focusing on superficial details like grammar or spelling.

You Should Practice in Safe, Controlled Environments

Reading about attacks can get you only so far – you need a safe environment to experiment and make mistakes without damaging any production systems, which is why it is essential to set up your own virtual labs and test new things on them.

Tools that allow you to create isolated network environments and stand-alone virtual machines can be used to design safe and controlled network ecosystems in which you can experiment with different tools.

Trying out a virtual machine with a vulnerable host and a few attack tools can be a great way to learn the process, from initial access all the way to covering tracks.

Making mistakes during such an exercise will not damage anything – after all, it is only a virtual machine. However, the confidence gained from practicing in such a controlled environment is invaluable and will help you immensely in the future during actual red team operations.

The calmness and precision learned during a well-practiced CTF or other competition translate into positive qualities during an actual incident involving a real network and system.

You Need to Get Hands-On With the Tools Defenders Use

Security analysts increasingly rely on automated processes to help sift through the huge quantity of alerts, identify truly anomalous activities, and summarize relevant information about the incidents in a fraction of the time it would take a human analyst to do alone.

Take time to understand what makes these systems arrive at their conclusions, what kind of data they were trained on, and what sorts of information they are most likely to overlook or misunderstand.

Trusting an automated system without question is dangerous, and your job as a student analyst is to learn how to work around these tools to double-check their work, rather than accept the answers they give you at face value.

Becoming proficient at evaluating the actions of automated security systems is quickly becoming one of the most crucial parts of a security analyst's skill set.

You Should Study Real Breaches to Learn From Them

When analyzing the cases of major companies being hacked, an amateur researcher may notice that such events have certain common patterns. These may include an unaddressed software vulnerability, a security breach due to a single point of failure, or an employee’s negligence or deception.

By researching and comparing several cases, one would be able to go through all the stages of hacking from initial exploitation to the point when the breach is discovered and the company cleanses its data.

Such analysis will inherently allow one to identify the precursors of a problem that would be difficult to learn in another way.

In the long run, this type of practical experience will be more beneficial to the researcher than a classroom, as it teaches them to think in real-time and recognize potential issues during audits.

You Should Learn How Networks and IP Addresses Actually Work

At some point, while learning about the security field, one is going to have to understand how data circulates within the online environment, which can be critical to understanding many security-related concepts.

For instance, any given device is going to have an IP address, which serves as its digital “return address” that designates what network and, usually, approximately what physical location the device is associated with.

Understanding how and why these addresses are assigned, how hijacking or spoofing can occur, and similar topics can greatly simplify some of the concepts that may seem unclear or overly complex at first.

The concept is critical to any given online activity, and by understanding it, one is going to have an easier time comprehending a variety of topics that may have seemed confusing or unrelated prior to gaining the new insight.

You Should Stay Current With Rules, Ethics, and Community Knowledge

Finally, be sure not to attempt to learn any of this in a vacuum, because the field is too dynamic and fast-moving to allow for that. Cybersecurity evolves at a pace that makes it impossible for any single course or certificate to keep you perpetually up-to-date on its own.

Seek out communities of people actively working in the field who share cutting-edge research, and subscribe to analysts' newsletters on new attack methods in an accessible way, and keep generally abreast of shifting regulations around data privacy, and the use of AI in your area of practice.

Set aside some time to read something new and unfamiliar with each week, and keep your education as a living, breathing process that never ends, rather than a discrete and completed task that can be quietly abandoned once it's done.