Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did you get started in Network Security/Penetration Testing?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 69 posts

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#51

Post by agumonkey »

dguido wrote: post #26
agumonkey wrote: post #24

Earlier quoted context omitted.

reminds me that my first programming project was an msdos resident fake virus in assembly

I love it when cool teachers sneak projects like these into their classwork. I had a computer architecture class that had labs to write exploits in MIPS assembly. I'd say 19 out of 20 people didn't even know they were exploits while we were writing them. :>

slight precision, it wasn't a school project, just me and a buddy that wanted to use computers and mess with a paranoid teacher with a harmless scary message.

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#52

Post by sebcat »

mkhpalm wrote: post #48

I got started for personal entertainment in darker corners of the internet. That ultimately evolved into me writing some of the tools people used in the industry. Eventually that developed into some SaaS products and 2 companies that we ended up selling. My advice to you if you are just getting started in the infosec world is... don't do it! Short of the increased attention to encryption and various better authz/auth…

> 9 times out of 10 the only reason they'll resort to testing anything is to cross off a corp checkbox somewhere

Can confirm.

The way it usually works is that Company X has N dollars allocated for security. Company X (or rather, a person or a team at Company X, with his/her/their own internal and external priorities and motivations) buys a service - recurring automated tests/assessments/pentests &c. This is where the usual corporate bullsh*t kicks in. If they want to show that they've done a good job in securing something, they buy a pentest over a short duration for a minor thing and then they claim " said we were secure". If they want more money, they obtain data to show that. The infosec companies has a "customer is always right" mind-set. It's business.

You can probably get good cash just for telling people to use TLS. Green padlocks and all that.

EDIT: also, to differentiate infosec from regular security, don't forget to prepend "cyber" to everything.

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#53

Post by vmarquet »

A way to validate that you're genuinely interested in penetration testing and to learn is to do challenges on sites like https://www.root-me.org/ for example. It's not necessarily realistic challenges, meaning there can be challenges on vulnerabilities you're very unlikely to see in real life, but you'll always learn something If the challenge does not teach you on some kind of vulnerability, at least it will teach you about how to think and do research, which is the most valuable.

I've seen companies filter candidates based on their score on such platforms. For example, for a junior position in penetration testing, they asked for at least 3000 points on root-me (but it was a few years ago, the number of challenges on the site has increased so it would make sense if they had increased their minimum points requirement).

Compared to certifications, it has two enormous advantages: it's fun, and it's free. I've started that way and never regretted it. I've not needed a certification to land a penetration testing job in a serious company (this was in France though, I don't know much about practices in other countries).

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#54

Post by raesene9 »

sillysaurus3 wrote: post #32
Eridrus wrote: post #30

Earlier quoted context omitted.

I've heard a lot of managers complaining that it was hard to find security people who could code well, so while getting a generic web dev job may be hard due to bias, it should be relatively easy to get a security engineering position where you write security-related code, as long as you're good at the writing code part.

Sure, but that still makes you a security lifer.

You say that like it's a bad thing!

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#55

Post by raesene9 »

sillysaurus3 wrote: post #39
Eridrus wrote: post #34

Earlier quoted context omitted.

I didn't really find it that difficult to move from security consulting/research/code audits => dev/researcher at security vendors => machine learning engineer. So I don't know how we decide whose anecdote wins here :p

Simple. If you value your career as a dev, you won't become a pentester. :) There's no upside except intellectually. Being a dev pays more and gives you more options going forward. That's a harsh way to frame it, but it's also accurate. (I'm speaking from experience FWIW.) In other words, you could have become an ML engineer anyway. No reason to risk it by becoming a pentester.

One thing to note is Dev paying more than security is a bit geographically dependent.

I know dev salaries in the US are very high, but in other countries (e.g. the UK) security posts can pay pretty well relative to many development posts.

In terms of options, there's a fair number of options available after pentesting, although most of them revolve around security in one guise or another. On top of the obvious moves into IT/Infosec management, there are new fields in security which open up alongside tech.

Recently there's been an expansion with fields like malware analysis, blue teaming, incident response and red teaming showing quite good expansion.

Within "pentesting" there's areas like IoT, Automotive, maritime etc which can offer moves for people wanting to move on from more trad. pentest roles.

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#57

Post by user5994461 »

the_cyber_pass wrote: post #18
sillysaurus3 wrote: post #15

Just to clarify for everyone: Be careful switching your career to netsec/pentesting. If that's your thing, great. But you're likely to be a "lifer" because no one will want to hire you anymore for webdev. It's not quite as clear-cut as that, but if you're out of the game for N years, it's really hard to get back into it. Especially when you're not younger than 30. Ageism is a real thing.

As someone who has tried a couple times to jump the other way I can attest to this. Completely stonewalled for full stack developer positions. I have found exploits by knowing the quirks of all sorts of libraries and I have to be able to understand how things work on a deep level. But because a lot of the job is tracing other peoples work and finding gaps in their logic, you don't have as much 'dev' time in the tradi…

By your text, you're a random senior developer. It shouldn't be too hard to get a position, as long as you live in one of the active tech locations.

It looks like you and the parent poster are facing the usual company that is looking to hire a cheap 20 year old web dev with little experience. Not a good fit for you.

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#58

Post by bostik »

sillysaurus3 wrote: post #32
Eridrus wrote: post #30

Earlier quoted context omitted.

I've heard a lot of managers complaining that it was hard to find security people who could code well, so while getting a generic web dev job may be hard due to bias, it should be relatively easy to get a security engineering position where you write security-related code, as long as you're good at the writing code part.

Sure, but that still makes you a security lifer.

To echo a sibling - that's not a bad thing. But let's add some context.

Security is one of the few fields that can truly benefit from a holistic approach. Really good QA people who can code and work directly with both marketing and engineering can lay the same claim to their field.

Once you have enough experience in development AND security, it's easy to add product life-cycle[0] considerations into the mix. When you get that far, you're expanding into architecture and workflow engineering. And this is where it gets interesting...

If you end up being responsible for security matters as part of engineering workflow, you will find yourself also deeply involved in compliance. People who have solid background in development, work on architecture or product life-cycle, focus on practical security, care about engineering workflow -- and can tie all this together to satisfy compliance requirements are rare. Very rare.

Not to mention employable.

The ability to meet ever-changing compliance requirements WHILE maintaining sanity, engineering workflow and development velocity is already in high demand. It can be very satisfying too, because you end up covering architecture, production systems, development and business needs, all together. The approach has to be holistic, because nothing else works.

The common wisdom is that security is a process. It's also a mindset. And a mindset can be taught...

0: Magic acronym is "PDLC" - Product Development Life Cycle

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#59

Post by brightball »

anon_dev_123456 wrote: post #14

I can tell you how not to do it. I'll never forget the funniest interview I ever had. I interviewed with this company called Deja vu Security. http://www.dejavusecurity.com/ I explicitly told them, via email, I have ZERO experience pen testing, or anything related to hacking. I'm a terrific software engineer looking to pivot into this market, would take a salary cut to get my feet wet and be mentored. Would this be p…

Communications breakdowns like that are funny. I remember communicating with a recruiter one time years ago that I'd be happy to do a part time contract to fill a need that I had a lot of experience with. He calls me up and immediately starts talking salary and full time so I had to re-explain everything that was in the email conversation as if he'd never seen it.

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#60

Post by brightball »

Txmm wrote: post #40
igolden wrote: post #2

I’ve been a professional software developer for the last 4-5 years, but never took security serious until iot took off. Get some raspberry pis, install kali Linux on a VM or spare computer, and go to work! It’s just so easy and cheap to setup a pen test lab. I’d recommend every dev have a few attack machines for fun. That’s how I got started . It’s also a huge field. Try checking out security in your current discipli…

"It’s also a huge field. Try checking out security in your current discipline." I'm actually 15 at the moment with basically no experience besides messing around with kali tools like a script kiddie. Got any tips for programming languages to learn/where to learn? I appreciate the post!

For some interesting reading, go pick up a Kevin Mitnick book like Art of Intrusion. It's not a technical how-to but a collection of social engineering stories that are fun reads. Gives you a lot more insight into where the real vulnerabilities are.
Post reply on HN