Professional development

Ongoing training is crucial for your career, says Infosec Skills author Manuel Leos Rivas

As a 20-year IT and security professional, Infosec Skills author Manuel Leos Rivas knows the importance of ongoing skills development, but finding quality training resources related to web server security was difficult.

“A lot of the information you find online isn’t the best or it’s outdated,” Manuel said. “There are some trainings available — but they’re either very generic or very specific — so I liked the idea of creating something more comprehensive.”

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Manuel has been focused on web server and web application security since 2012 when his role shifted to include tasks such as configuring web application firewalls and hardening systems. 

“Now I’m in a more operational position focused on cloud environments,” Manuel said. “I'm actively looking at attacks on our web servers, defending them and implementing countermeasures to make sure everything is okay.”

He used that job experience when structuring the new courses in his Web Server Protection Learning Path.

“I asked myself, ‘If I were to hire someone, what would I want them to be proficient in and what hands-on tasks would I want them to perform,” Manuel said. “Then I put those in my courses.”

 

Learning web server security

 

Manuel’s Web Server Protection Learning Path focuses on foundational web server security concepts and tools that apply to a variety of situations and technologies.

“It provides a quick start into web server and application security,” Manuel said. “It gives you the tools you need to do something usable and an understanding of where to go next. From there it's just about practicing different types of scenarios.”

The path includes a skill assessment, nine courses and a hands-on project covering topics such as:

• Hardening networks, hosts, web servers and applications
• Implementing web server controls
• Using command-line utilities to test web servers and extract logs
• Maintaining an efficient web application firewall configuration
• Deploying active defense mechanisms

“These courses will help anybody that has to manage a web server or a web application,” Manuel said. “Ideally, you should have a basic understanding of security along with some IT experience so you don’t struggle in the beginning.”

“For advanced students, there are additional challenges within the Web Server Protection Project,” Manuel said. “I leave it up to them to see how far they can go — what's the highest percentage of compliance or hardening they can implement without breaking it.”

 

Keeping cybersecurity skills relevant

 

Cybersecurity professionals need to refresh their skill sets every two or three years at most, Manuel said. Otherwise, you risk falling behind.

“There's always new technology coming out,” Manuel said. “Attacks are evolving every day. We’re introducing more content into web applications. There are many different frameworks working together. It creates a broader area that has to be protected.”

But that’s part of the fun of being a cybersecurity professional, Manuel said.

“I like it. I like playing with new toys, seeing what they're capable of doing and implementing new ways of keeping everything secure.”

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Check out Manuel’s new Infosec Skills courses below:

 

See Manuel's courses

About Manuel Leos Rivas

Manuel earned a bachelor’s degree in Business Administration and Computer Systems Engineering at the Universidad Autonoma de Nuevo Leon in Mexico and a Master of Sciences in Information Security Engineering with focus on Incident Response at the SANS Technology Institute. He holds around 40 cybersecurity-related certifications.

He started working full-time in the information security field in early 2000. Since 2012, Manuel has worked as a security expert, including supporting over a thousand WAFs to protect a variety of web applications. Starting in 2016, Manuel committed part of his personal time to improve the OWASP ModSecurity Core Rule Set, becoming an active rule developer. Since then he has contributed numerous new rules, fixed false positives and false negatives and assisted with many other improvements.