Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Cyber Security Body of Knowledge

cybok.org

Post reply on HN
Print view View original

11–20 of 20 posts

Re: The Cyber Security Body of Knowledge

#11

Post by Daycrawler »

all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

In web dev there is the OWASP top 10, which is made of relatively old but still widespread vulnerabilities, right?

Re: The Cyber Security Body of Knowledge

#12

Post by dsr_ »

all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

In the immortal words of the sadly departed J.D. Falk: "Nothing is cooler because it is cyber."

Re: The Cyber Security Body of Knowledge

#13

Post by foo101 »

all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

> Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very few such people with "cyber" on their resumes are hired where I work.

Sounds like a workplace one should avoid. It seems quite petty that one would consider a harmless and a completely acceptable word to be a reason to look at a potential candidate with a negative bias.

Maybe I should start including the word "cyber" in my resume going forward to filter out petty employers like yours.

Re: The Cyber Security Body of Knowledge

#14

Post by herghost »

all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

I feel like your second paragraph is getting the focus of everyone's ire, whilst your first point is being missed (and is a much better one):

>I have to say that by the time anyone has infosec written down and categorized it is obsolete

It's a worthy goal for CyBoK to try to write this down, but having skimmed over the AppSec one it immediately feels like it's something that will get finished one day, and then people will get round to reading it one day by which point it will be little more than an academic curiosity.

My first impression is that it is broadly an academic exercise and not a practical one. This type of knowledge needs to be documented in more dynamic format if it is to stand any chance of being relevant, let alone remaining relevant. It needs the funding and the community support, but on top of academics cogitating over it, it needs real-world, real-time input, maintenance, and updates.

Re: The Cyber Security Body of Knowledge

#15

Post by 0xfffff »

all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

I think your organization might suffer from groupthink and it might healthy to hire someone with a different viewpoint. Just because someone uses a certain word, like cyber, doesn't imply they are not qualified.

Also, there are hardly any novel new attack techniques, its all just old basic concepts applied to new technologies. Being in the industry for 15 years should allow to put things into perspective.

Re: The Cyber Security Body of Knowledge

#16

Post by ConfusedDog »

all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

Ouch. Doing cyber related software for years, can't really avoid the word. Though I don't think it's different from safety, reliability in the sense of good engineering goals. I wasn't expect being judged for using a word. Sadly, many engineers are quite biased, so don't beat yourself up.

Re: The Cyber Security Body of Knowledge

#17

Post by DiffEq »

all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

The principles of security have not changed in thousands of years(Least Privilege, fix vulnerabilities/gaps, understand methods of attack...) as those principles apply to the world of IT they have not changed since IT happened. Specific events and vulnerabilities may have come and gone but the principles of design, and all such like things, have not changed at all. What has changed about trying to maintain Confidentiality, Integrity, Availability, Accountability, etc.?

Re: The Cyber Security Body of Knowledge

#18

Post by all_blue_chucks »

foo101 wrote: post #13
all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

> Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very few such people with "cyber" on their resumes are hired where I work. Sounds like a workplace one should avoid. It seems quite petty that one would consider a harmless and a completely acceptable word to be a reason to look at a potential candidate with a negative bias. Maybe I should start…

It's not the use of the word, it's the background that comes with it. Seeing "cyber" all over a resume usually means the candidate has been a contractor for some government agency where they run a vuln scanner and deliver the reports to someone, but don't really have any understanding of the results, or any real responsibility at all, usually.

Re: The Cyber Security Body of Knowledge

#19

Post by Kalium »

all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

> Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very few such people with "cyber" on their resumes are hired where I work.

You said the word! Take a shot!

Re: The Cyber Security Body of Knowledge

#20

Post by jiveturkey »

phaus wrote: post #7
all_blue_chucks wrote: post #4

As someone who has been in this game for 15 years, I have to say that by the time anyone has infosec written down and categorized it is obsolete. The CISSP, for example, bombards you with questions about thoroughly obsolete attacks. I let mine expire and allow my resume to speak for itself. Furthermore, after a couple hundred interviews over the course of my career, use of the term "cyber" is a huge red flag. Very fe…

I'm not Internet famous like some of the security guys around here, but I'm good enough to get a job nearly anywhere I want. I wouldn't want to work for a place that harbors illogical grudges against benign words that over time have become used by almost everyone working in the industry. It makes me wonder what other petty things the company would be needlessly elitist and toxic about. I've only been conducting inter…

In all my years I’ve never seen a single resume using the word cyber. But I wouldn’t hold it against anyone. that’s silly
Post reply on HN