Security work as a freelancer

Question

I am confined to a wheelchair (paralyzed) so I have very extensive care needs. I’m very interested in computer security, but I am not able to work a traditional 9-to-5 job onsite. Is it possible (how?) to become a security consultant that works freelance from home? What specialism (If any) would offer me the best chance?

Answer 1

Are you able to see people at your place? This might help lower the personal issues a customer could have about sharing security details with you. With a certain expertise and reputation it shouldn't be hard to even skip that part. I worked with many people I never met because they got recommended by someone I trust.

What do you mean with interested? No experience yet? If not, you can start look into securing servers, those are usually remote from the office too, so it doesn't really matter where you work. Then you need to decide which kind of servers you wanna specialize on, Linux, Windows, all. Get to know the basic tools like OpenVPN, SSH login with certificates, Firewall-Rules, SSL/Https in Webservers like Nginx and Apache, port blocking tools like fail2ban, maybe things like XSS and SQL injections, depending what kind of security you prefer. From there your interests will take you in the right direction.

Start training on an own server, either as a VM or a real one at a provider, help friends look into their setups, and so on. To really consult people you should know what you are talking about in general. You don't need to know all specific commands and it's okay to learn during the job. Security is more about planning ahead and preventing problems than actually dealing with live hacks, so you are not really on a hot schedule.

You should have a broad knowledge of all possible security threats and either know how to handle those or who to use for subtasks you are not familiar with.

For "on-site" working there are tools like remote desktop in the windows world or on linux you open a terminal anyway. That's not really an issue if the client trusts you.

Answer 2

I'm biased.

If I were hiring a security consultant, the first thing I'd have to recognize for myself is the fact that for my business, there are resources available:

1. In-the-office for inside use only (no remote access)
2. In-the-office with remote access as an option
3. External facing stuff (i.e. websites) where this is the original intention

It's going to be hard to make the first two items above available for someone who doesn't work in the office. Additionally it will be super difficult to share the "tribal knowledge" about such systems. Personally, I wouldn't want to share even login and password information with someone remote, as it's very, very vulnerable.

The skill you're proposing to utilize touches very, very private information within a business. I'm sure there's training for it somewhere but you must consider the practical social limitations of a client's willingness to hand you the keys to the entire kingdom, sight unseen. Usually a consultant in this situation would be paired with someone from the inside, for balance's sake.