(Long) Fine/gross perspectives of starting InfoSec business?

[fyrewyr]

Greetings,

Introduction: This is my very first post -- please bear with me. Summary: I'm digging for "starting a new security business" perspective, and member advice / experiences.

I have (if you count starting off in the 5th grade), 19 years of technical experience (8 OTJ). I got through school and started working a few years early, and I've done everything under the sun, as much as a medium business, and a fairly good salary, can provide, but I've been treading water for a very long time. I've got to do something about being under stimulated way, way past tears.

Scope: I live in a community of 10k. The nearest communities of similar size are 30 miles in every direction. The larger market University-style cities are 1 and 1.5 hours away. Embarassingly, I've managed not to network well while I've been here, instead staying pretty much under the horizon. A lot of contacts have sat on the back burner for far too long.

A year or so ago, I started to feel out the "IT consulting" niche...flipping through the yellow pages, visiting store wallboards, looking at competition. Hordes of tech retail sales, handy-guys, installation, support, ISPs, everything but InfoSec.

So I took a SBA kickstart; left feeling empowered, then discouraged as the excitement died. I have some ideas, but I'm threatened, e.g., by unearthing more experienced competition...and a naysayer who "nays" a lot.

While this is a small town, we have an inordinate number of businesses with IT departments. One idea is snagging the free library room, then contacting IT people for a town / region "IT security forum".
My dream is that we'd be able to discuss certain solutions, say, I want to buy NAV CE, who here has had experience with it...or a place to discuss "real threats"...or provide a group "reporting system" to report sanitized (anon) incidents to law enforment...or a mailing list where we all support each other for "area" advice.
Could this be "invitation only"? Would a NDA on meeting topics to "non-members" be appropriate?

Another idea is to write for the local papers; a weekly column, for free (they say no budget), to address the general population's concerns.

Or, simply start advertising a security consultancy, and try to take the jobs as they come. Some services...e.g., drop boxes for shreddable material or magnetic media, which I would then certify was appropriately destroyed. But a business feels the most like hanging the goods out for a thrashing.

Concerns:
1) Previous lack of networking
a) if you were contacted to meet with peers in an "area" security focus group, what would be the best approach for you, what would pique your interest / make it credible, and what would make you come back again?

2) Confidence: Doubting myself
a) My chain of supervisors have iterated that they think I still have some work to do. In contrast, I do a damn good job despite that; but like high school reputation, it's hard to shake - and after a few years, so is the impression it leaves on me - a beast all by itself. In a clean slate, aside from knowing the subject, and liking your job, what foundation best creates, and maintains, a healthy business perspective?

3) Credibility: Lack of funds to certify (SANS, CISSP)
a) Can you make a security company without certs? Does it bring in that much more business if you do? Would it be necessary for personal growth?

4) The day job. Information Security is a 24-hour business, and I can't just quit my paycheck. Who hires an evening or weekend security professional, right?

I've run on a long time. Does anyone have experience running, or working for, a fledgling IT security firm? How did you get started (trickle, deluge, ingenuity)? How did you survive? What would you feel addresses the needs of a small town, extended to outlying areas? For example, is reselling (say, NAV) worth the effort?

- Thank you very much -

 

[SgtB]

Well, I'm not running any Security firm, but I can touch on a couple of points you made.
First is your idea of a local "focus group". I really don't think folks would go for it. For one, there are plenty of security forums on the internet, that have a lot more people and input than a room at the library. Granted when security lectures come to town its nice to sit in sometimes, but then again the rooms is filled with all sorts of security people. Either way, you'll get more info chatting/posting on boards such as this, than you would in a focus group environment.
Second, is the question of credibility. I'm a network administrator, and I get contacted regularly by security firms/consultants that want my business. Granted I'd never hire them as I do that stuff myself, but let's just say I was going to... If they didn't advertise their certs (CISSP,GIAC,etc) I wouldn't let them in the door so to speak. I'd simply go to another company that had certified technicians. Now you might be better the 10 of these certified techs, but as a consumer I don't know that. In the end I think you'll be beaten by rivals with certs. Know what I mean?
Third, (I know I only said two, but I thought of another) Who hires a weekend security guy? Nobody that's right! I would need my consultants available if we were to have an emergency. So here's what you do....Work FOR a security firm. Try getting certs like the new S+ by CompTIA, it might be enough to get you an entry level position. Then learn and grow with that company, and who knows, maybe they'll even end up paying for your certs! (maybe even training too!) It would be better to work for a business then later on run your own. This is only my opinion on the subject, and others may refute my statement with success stories, but oh well.

Either way, this is all just opinion! I wish you the best of luck and welcome to Tek-Tips!
________________________________________
Check out

http://www.security-forums.com

 

[SgtB]

Should have used more empty lines in that post of mine...thats iritating to read!
Sorry!

Need an EDIT button!
________________________________________
Check out

http://www.security-forums.com

 

[Grenage]

I agree with SgtB here, when it comes to security the consumer won't know if it has been done properly or not until it is too late. Basically meaning they will hire the most qualified looking person they can find (within budget).

 

[Psychoid]

Hi.
This is probably going to be something that you don't want to hear, but you asked for honest opinions.

I'm a consultant/network engineer who works in the network services & security department of a large consulting company.

My observation is that most companies really don't want to deal with security; they'd rather duck behind their firewall and hope for the best. I think that their hesitance is based upon two factors:
1. Security costs money and doesn't provide a tangible return on investment
2. Security is not politically acceptable; it is restrictive and authoritarian. The result is that executives and normal users start to despise the IT staff.

I have worked in this industry for over 6 years and have only seen ONE company who asked for a proper security evaluation. As I said, most just don't want to deal with it.

Don't lose heart, though. Because we all know that security is important, we make it an intregal part of each project and that's where we make an impact.

So, my recommendation to you is to find ways to use technology to solve business problems for clients & roll security into the whole package. This will allow you to provide companies with secure environments, while also allowing you to have a more lucrative engagement with them.

Good luck ------------
Bill
Consultant / Network Engineer
CNE, CCNA

 

[fyrewyr]

Thank you, everyone, for your feedback; it is very much appreciated.