I'm a senior level security leader and hiring manager. I focus on software security. Ask me anything about what I see, or don't, in candidates.
Are you hiring? :)
in sfbay
Thinking of a Cybersecurity Career?
101–110 of 129 posts
Re: Thinking of a Cybersecurity Career?
#102Earlier quoted context omitted.
> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Funny enough, this thought process shows a failure to understand process and internal influencing. Quite often, the things found by a basic pen-test are known internally. Research will reveal long, boring discussions that end with someone like Bill dismissing things as not imp…
This is a really good point. I have actually seen that happen. I just wish we could get our own point across (at a level higher than myself) sometimes without having to do this :)
In that case, I have good news! Well, good-ish. If this happens often enough, higher-ups sometimes get sick of being blind-sided by it. They start being pro-active about addressing security issues and planning projects to pay down tech debt.
Doesn't always work, but it's more likely to work with a far-sighted exec than a quarterly-minded one.
Re: Thinking of a Cybersecurity Career?
#103Earlier quoted context omitted.
I notice in your other replies you have several interview questions that seem to be targeted at previous experience. What kind of side projects, cybersecurity or just programming related, do you find the most appealing in a candidate?
I love to hear about the tools people have created. There is almost always a good story about a problem and a solution. However, this is not really what I mean. If you are interviewing for a role in software security, you should be current on the industry and ready to talk sources and research. At a minimum, you should have areas of interest that you are passionate about discussing, even if you are still ignorant abo…
I think I've got a good example of a tool that I created that comes with a good story about a problem and a solution.
Would love your feedback as I'm a recent CS grad struggling along.
Re: Thinking of a Cybersecurity Career?
#104Very interesting article, but at the same time it depicts a very sad truth... [Disclaimer: also not a certified security professional, but I do follow the topic and practice it hands-on from time-to-time...] However I think there are multiple (sometimes non-overlapping) types of cyber-security professionals / roles: * the policy maker / enforcer -- which is what some companies want, and what the most well known peopl…
> * (many others that escape me at this moment...) * Threat hunting / attribution Familiarity with clustering incidents and pivoting between actors by attack signatures. Or before that, do you even know what an APT is? (Probably only a small percentage of CS grads.) * Malware re * Post incident forensics Random tools and skills that come up... SQL keeps coming up even though I try to avoid it. There's generally an "S…
> Or before that, do you even know what an APT is?
You mean that Linux command thing? ;)
Re: Thinking of a Cybersecurity Career?
#105CyberSecurity, the domain that doesn't recruit yet has a shortage. What cybersecurity is to most people is automated security scans. This can be done by interns with a week of training to run the tools. (Interpreting and remediating the findings is another matter). Besides that, security is mainly about authentication. That's done by setting up LDAP, active directory, openid connect and co, and integrating in applica…
> Besides that, security is mainly about authentication. That's done by setting up LDAP, active directory, openid connect and co, and integrating in applications.
You've phrased this to hit a pet peeve. A huge, ongoing security issue is people checking for authentication when they should be checking for authorization.
Re: Thinking of a Cybersecurity Career?
#106Earlier quoted context omitted.
> Be careful here. This is bordering on elitism. Be careful about the soft bigotry of low expectations. A generation has grown up thinking that skill/knowledge elitism is a real thing and that it's oppressive. Instead we should learn to identify people who do difficult things, recognise how they do difficult things well, systematically emulate their methods as we attempt difficult things, and constantly work at the e…
What part of my response led you to believe I inferred we shouldn't learn difficult things? I'm simply try to show that people who haven't mastered the industry are still valuable.
> What part of my response led you to believe I inferred we shouldn't learn difficult things?
The first sentence, and its emphasis on calling out elitism (and concomitant gate-keeping).
> I'm simply try to show that people who haven't mastered the industry are still valuable.
Despite your noble intentions, I don't think such comforting statements are useful, and they are probably harmful: On the one hand, the market will decide what skills and what level of skills it wants to pay for (and how brutal when, after often being comforted, consoled, and reassured, I find no one willing to pay me for my meagre skills), and on the other hand, there are more than enough people who are confidently happy to run metasploit and burp, shut their laptops, and demand a pay-cheque.
Re: Thinking of a Cybersecurity Career?
#107I think the cybersecurity (I hate the term cyber btw as it's usually used by people who don't know what they're talking about), is very focused on the 'think like a hacker' skillset right now. While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn't really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge…
> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Funny enough, this thought process shows a failure to understand process and internal influencing. Quite often, the things found by a basic pen-test are known internally. Research will reveal long, boring discussions that end with someone like Bill dismissing things as not imp…
[secexec here with F500 company.]
Over time every security executive learns that there’s only three important things in security:
- How big is our cyber policy?
- How do we make sure the insurance company pays out?
- Will our financial growth and policy offset the maximum potential losses if we decide not to roll out security tool X or patch Y?
That’s really it. When growth and insurance won’t cover it then you’re plugging holes until the equation balances itself out. Everything else is theater.
Doing anything other than the above ends your career...quickly.
Re: Thinking of a Cybersecurity Career?
#108Call me naive, but isn't simply completing every live hackthebox.eu box a good way to get some practice in to apply for certain security roles? Hacking 20 boxes on various levels to me seems that you have what it takes. The easy ones are Metasploit and so on. The medium ones are attacks like SQLi or injection into MongoDB. The hard ones are simply a chain of those things with a lot less intelligence to go on. The insane ones also put some binary analysis or C vulnerabilities in there (e.g. heap overflows or ROP attacks of stripped binaries).
Then again, I'm far too early in my career to know whether simply rooting all live boxes is good enough. Doing so myself has definitely helped me at my job as a full-stack developer to make the company I work at more secure.
Here's an example of an "insane" box: https://www.youtube.com/watch?v=p8XkVDRtTQg
And this is a "medium" one: https://www.youtube.com/watch?v=7QXzebQHEWA
Re: Thinking of a Cybersecurity Career?
#109Earlier quoted context omitted.
> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Funny enough, this thought process shows a failure to understand process and internal influencing. Quite often, the things found by a basic pen-test are known internally. Research will reveal long, boring discussions that end with someone like Bill dismissing things as not imp…
[secexec here with F500 company.] Over time every security executive learns that there’s only three important things in security: - How big is our cyber policy? - How do we make sure the insurance company pays out? - Will our financial growth and policy offset the maximum potential losses if we decide not to roll out security tool X or patch Y? That’s really it. When growth and insurance won’t cover it then you’re pl…
So what do you think about the Garmin hack? How did their secexec fail? Did they not follow this model?
Re: Thinking of a Cybersecurity Career?
#110Earlier quoted context omitted.
> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Funny enough, this thought process shows a failure to understand process and internal influencing. Quite often, the things found by a basic pen-test are known internally. Research will reveal long, boring discussions that end with someone like Bill dismissing things as not imp…
[secexec here with F500 company.] Over time every security executive learns that there’s only three important things in security: - How big is our cyber policy? - How do we make sure the insurance company pays out? - Will our financial growth and policy offset the maximum potential losses if we decide not to roll out security tool X or patch Y? That’s really it. When growth and insurance won’t cover it then you’re pl…
Naively, I would expect that an insurer is less likely to pay out if a basic pen-test suggests negligence on the part of the company.