Thinking of a Cybersecurity Career? • Hacker News Board

Re: Thinking of a Cybersecurity Career?

#71

Post by bawolff » Sat, Jul 25, 2020, 9:02 PM UTC

beardedwizard wrote: post #49

allanbreyes wrote: post #40

Earlier quoted context omitted.

Can you talk about your interview process? e.g. types of interviews, screens vs. on-sites, distributions, etc. What are the shortcomings that keeps a candidate from an offer in the final steps, e.g. the candidate passes screening interviews, but falls short on an on-site interview. What are the indicators you observe that differentiate a senior candidate? How do you go about evaluating entry-level and junior candidat…

We do a few screens, starting with general security discussion - something like: intro, light tech/coding - just to make sure we aren't completely wasting our time The main interview centers on software security, and is focused on real world scenarios. We avoid "explain this OWASP top 10 blah blah blah" kind of questions. The goal is to see if you can reach the outcomes we expect, regardless of how you may approach t…

> I don't care if you can explain SQLi to me

Huh interesting. I work in infosec (but not a hiring person). I would normally rank this as an important skill. Not because i actually care about getting an explanation but because half the job is getting non security devs to care about security issues/fix them/not make them in the future. In my experience it is really difficult to do that if you can't explain the vulnerability to them.

Re: Thinking of a Cybersecurity Career?

#72

Post by noch » Sat, Jul 25, 2020, 9:03 PM UTC

movedx wrote: post #25

GekkePrutser wrote: post #21

I think the cybersecurity (I hate the term cyber btw as it's usually used by people who don't know what they're talking about), is very focused on the 'think like a hacker' skillset right now. While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn't really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge…

> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Be careful here. This is bordering on elitism. Having someone come into a business and check for "yesterday's hacks" is better than no one doing any checks at all, therefore such skills are still valuable and worthwhile. In learning how networking works; how operating systems…

> Be careful here. This is bordering on elitism.

Be careful about the soft bigotry of low expectations.

A generation has grown up thinking that skill/knowledge elitism is a real thing and that it's oppressive. Instead we should learn to identify people who do difficult things, recognise how they do difficult things well, systematically emulate their methods as we attempt difficult things, and constantly work at the edge of our ability.

The only thing that happens if we don't do difficult things is that we become people who can't do difficult/valuable things.

Re: Thinking of a Cybersecurity Career?

#73

Post by [deleted] » Sat, Jul 25, 2020, 9:11 PM UTC

[deleted]

Re: Thinking of a Cybersecurity Career?

#74

Post by bawolff » Sat, Jul 25, 2020, 9:12 PM UTC

So this article is not what i expected.

I agree that hands on skills are important. And i agree that candidates often lack them.

But im not sure that the skills in the article are really hands-on skills.

For example, the article talks about picking up a book on tcp/ip. That's not hands-on, that is theory. I also question what type of cybersecurity degree program this is, where you don't learn how the internet works?

All the things in the article sound like stuff i would expect a "cybersecurity" degree to cover. They don't sound like things that need to be taught practically.

Re: Thinking of a Cybersecurity Career?

#75

Post by ozim » Sat, Jul 25, 2020, 9:20 PM UTC

movedx wrote: post #25

GekkePrutser wrote: post #21

I think the cybersecurity (I hate the term cyber btw as it's usually used by people who don't know what they're talking about), is very focused on the 'think like a hacker' skillset right now. While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn't really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge…

> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Be careful here. This is bordering on elitism. Having someone come into a business and check for "yesterday's hacks" is better than no one doing any checks at all, therefore such skills are still valuable and worthwhile. In learning how networking works; how operating systems…

Decent sysadmin should be able to setup automated scanning, know about OWASP, keep systems patched. That should be absolute baseline for sysadmin work. Checking for yesterdays hacks is valuable but that is called auditing and you should have checklist for that.

Pentesting should be focusing on hacking and uncovering stuff that was not in audits like making custom exploits on the spot.

Problem is that running scanners and checking basic stuff should be an audit but that does not sound as cool as "pentest" and "white hat hacker"/"cybersecurity specialists" sounds way cooler than auditor.

Re: Thinking of a Cybersecurity Career?

#76

Post by lormayna » Sat, Jul 25, 2020, 9:28 PM UTC

In my opinion (working as security architect for an US Fortune500) technical skills are mandatory, but they are not enough for a successful career on cybersecurity. You need to have great communication skills (writing a great pentest report is probably the most important and difficult part), negotiation and persuasive abilities (sometimes you have to accept risks against budget, deadlines and business requirements). In the cybersecurity community I see a certain degree of elitism (don't use Kali, don't use Metasploit, etc.), but we need to understand that they are just tools, so anyone is free to use the tool that is more confident and more appropriate for the tasks.

Re: Thinking of a Cybersecurity Career?

#77

Post by ozim » Sat, Jul 25, 2020, 9:31 PM UTC

q3k wrote: post #44

GekkePrutser wrote: post #43

Earlier quoted context omitted.

Which is exactly why I was saying pentesters should be more inventive :) The level of external pentesters I've seen, has not exceeded the "scriptkiddie" level.

> The level of external pentesters I've seen, has not exceeded the "scriptkiddie" level. You get what you pay for. I've taken part in security audits that delivered 0days - but they weren't cheap.

Scriptkiddie level people should just be honest that they are doing checklist audits to see if administrators are doing their job.

But unfortunately we are on the hype train where everyone needs to be "cybersec/offensive/pentester/ethical hacker". In the end, cannot really blame them entirely because otherwise CEO and CFO types are not going to hire them and they won't earn money.

Re: Thinking of a Cybersecurity Career?

#78

Post by lormayna » Sat, Jul 25, 2020, 9:38 PM UTC

beardedwizard wrote: post #27

I'm a senior level security leader and hiring manager. I focus on software security. Ask me anything about what I see, or don't, in candidates.

Are you hiring? :)

Re: Thinking of a Cybersecurity Career?

#79

Post by PenguinCoder » Sat, Jul 25, 2020, 9:45 PM UTC

dx87 wrote: post #13

cyberbanjo wrote: post #2

That's surprising to someone not in CyberSec that so few can do basic tasks of their job. I wonder how they declare the bar for basic or not.

I used to do interviews for pentesters at an old job, and I was suprised as well. I think it's because CyberSecurity is relatively new, so companies have no idea how to hire for it, and end up hiring whoever can talk the best. I interviewed a lot of people with titles like "Senior Cybersecurity Engineer" who had no security knowledge beyond how to run an automated scan against an IP range, and put the findings it pri…

And yet here I am with half a decade actual experience in 'Cyber Security', can write passable Golang, C, C++, Python, hands on, real world knowledge and experience of threat actors and APT TTPs, for Blue team threat hunting, IDS/IPS signature creation, incident response... etc.

And I can't even get a callback from any other company, because I don't check the "Bachelor degree required" box.

Fucking, awesome.

Re: Thinking of a Cybersecurity Career?

#80

Post by celticninja » Sat, Jul 25, 2020, 9:53 PM UTC

movedx wrote: post #25

GekkePrutser wrote: post #21

I think the cybersecurity (I hate the term cyber btw as it's usually used by people who don't know what they're talking about), is very focused on the 'think like a hacker' skillset right now. While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn't really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge…

> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Be careful here. This is bordering on elitism. Having someone come into a business and check for "yesterday's hacks" is better than no one doing any checks at all, therefore such skills are still valuable and worthwhile. In learning how networking works; how operating systems…

The majority of hacks that companies suffer will be 'yesterdays' hacks. No one is wasting a zero day to get the droneparts.com database.