Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thinking of a Cybersecurity Career?

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 129 posts

Re: Thinking of a Cybersecurity Career?

#111

Post by all_blue_chucks »

7174n6 wrote: post #65
GekkePrutser wrote: post #21

I think the cybersecurity (I hate the term cyber btw as it's usually used by people who don't know what they're talking about), is very focused on the 'think like a hacker' skillset right now. While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn't really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge…

The term "cyber" has been part of the information security lexicon and if you work in the industry you accept it as reality. Especially if you work for government or a government contractor. Claiming that people who use the word cyber don't know what they are talking about is just ignorance at this point.

It's called "infosec" in the private sector and "cybersecurity" in the public sector (and adjacent).

"Cyber" can have negative connotations in the private sector only because, well, the best people in this business would never pass a security clearance so the public sector can only hire the leavings...

Re: Thinking of a Cybersecurity Career?

#112

Post by [deleted] »

GekkePrutser wrote: post #21

I think the cybersecurity (I hate the term cyber btw as it's usually used by people who don't know what they're talking about), is very focused on the 'think like a hacker' skillset right now. While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn't really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge…

[deleted]

Re: Thinking of a Cybersecurity Career?

#113

Post by jollofricepeas »

Kalium wrote: post #110
jollofricepeas wrote: post #107

Earlier quoted context omitted.

[secexec here with F500 company.] Over time every security executive learns that there’s only three important things in security: - How big is our cyber policy? - How do we make sure the insurance company pays out? - Will our financial growth and policy offset the maximum potential losses if we decide not to roll out security tool X or patch Y? That’s really it. When growth and insurance won’t cover it then you’re pl…

Naively, I would expect that an insurer is less likely to pay out if a basic pen-test suggests negligence on the part of the company.

Sort of.

Pentests are a joke - a compliance activity and nothing more. As the client I get to pick the vendor, determine scope and influence the criticality of findings in the final report.

Insurers don’t care about anything until you have a breach and a claim. They look to see whether you have the controls mandated in the policy and...

Whether your attacker used a nation-state toolkit if so then they don’t have to pay.

Most cyber policies will not protect against “acts of god” or “acts of war” without paying top dollar and having a cap on damages.

Re: Thinking of a Cybersecurity Career?

#114

Post by ozim »

movedx wrote: post #92
ozim wrote: post #75

Earlier quoted context omitted.

Decent sysadmin should be able to setup automated scanning, know about OWASP, keep systems patched. That should be absolute baseline for sysadmin work. Checking for yesterdays hacks is valuable but that is called auditing and you should have checklist for that. Pentesting should be focusing on hacking and uncovering stuff that was not in audits like making custom exploits on the spot. Problem is that running scanners…

> Pentesting I think I see the problem. You're assuming several things here. Firstly you're assuming that pentesting is the definition of cyber security when in fact it's one aspect of a huge area. Secondly you're implying that everyone wants to be a pentester. And finally I feel like you read the article and came to the conclusion it was only about becoming a pentester, when in fact it was about getting into a much…

System administrator should be main actor in security. Thing is no one wants to be system administrator now, everyone wants to be "cybersecurity expert/ethical hacker". Which in my opinion "ethical hacker" should be something that we call pentesters and we don't need system administrators to be "ethical hackers".

I do not equate pentesting with all security, it is that people don't want to do boring job of sysadmins. People don't want to spend all day going through logs, going through alerts and sorting out false positives. Which is real job there and is boring and that is not what "hackers do".

If that article would have title "How to become system administrator" no one would read it or comment it.

Pentesting is really small part of security that should be an elite, because most of the work is in system administration.

Re: Thinking of a Cybersecurity Career?

#116

Post by user5994461 »

jollofricepeas wrote: post #113
Kalium wrote: post #110

Earlier quoted context omitted.

Naively, I would expect that an insurer is less likely to pay out if a basic pen-test suggests negligence on the part of the company.

Sort of. Pentests are a joke - a compliance activity and nothing more. As the client I get to pick the vendor, determine scope and influence the criticality of findings in the final report. Insurers don’t care about anything until you have a breach and a claim. They look to see whether you have the controls mandated in the policy and... Whether your attacker used a nation-state toolkit if so then they don’t have to p…

They will also look for gross negligence. The worm hit out-of-support Windows XP machines that the company couldn't bother to upgrade in the past 10 years. No compensation.

Re: Thinking of a Cybersecurity Career?

#117

Post by user5994461 »

bawolff wrote: post #71
beardedwizard wrote: post #49

Earlier quoted context omitted.

We do a few screens, starting with general security discussion - something like: intro, light tech/coding - just to make sure we aren't completely wasting our time The main interview centers on software security, and is focused on real world scenarios. We avoid "explain this OWASP top 10 blah blah blah" kind of questions. The goal is to see if you can reach the outcomes we expect, regardless of how you may approach t…

> I don't care if you can explain SQLi to me Huh interesting. I work in infosec (but not a hiring person). I would normally rank this as an important skill. Not because i actually care about getting an explanation but because half the job is getting non security devs to care about security issues/fix them/not make them in the future. In my experience it is really difficult to do that if you can't explain the vulnerab…

In my experience it's too complicated to explain or they don't want to understand (the software has to ship yesterday). Have to show them.

    api.example.com/;SELECT * FROM customers
See. This is allowing anybody to dump all customers or delete customers (show the next query). Developers understand that this is not an intended feature.

Re: Thinking of a Cybersecurity Career?

#118

Post by user5994461 »

staticassertion wrote: post #82
PenguinCoder wrote: post #79

Earlier quoted context omitted.

And yet here I am with half a decade actual experience in 'Cyber Security', can write passable Golang, C, C++, Python, hands on, real world knowledge and experience of threat actors and APT TTPs, for Blue team threat hunting, IDS/IPS signature creation, incident response... etc. And I can't even get a callback from any other company, because I don't check the "Bachelor degree required" box. Fucking, awesome.

That's very surprising. I don't have a degree and at Dropbox, the last company I worked for, dropouts were more common than those who held a bachelors. Maybe there's something else going on?

Location most likely.

Search cyber security jobs on indeed in London and there is hardly anything coming up. I can't imagine what it's like in a small city.

Re: Thinking of a Cybersecurity Career?

#119

Post by beardedwizard »

bawolff wrote: post #71
beardedwizard wrote: post #49

Earlier quoted context omitted.

We do a few screens, starting with general security discussion - something like: intro, light tech/coding - just to make sure we aren't completely wasting our time The main interview centers on software security, and is focused on real world scenarios. We avoid "explain this OWASP top 10 blah blah blah" kind of questions. The goal is to see if you can reach the outcomes we expect, regardless of how you may approach t…

> I don't care if you can explain SQLi to me Huh interesting. I work in infosec (but not a hiring person). I would normally rank this as an important skill. Not because i actually care about getting an explanation but because half the job is getting non security devs to care about security issues/fix them/not make them in the future. In my experience it is really difficult to do that if you can't explain the vulnerab…

I think you misunderstood. Almost anyone can tell you what sqli is, few can demonstrate an exploit. You need to be much closer to the latter than the former.

Re: Thinking of a Cybersecurity Career?

#120

Post by nogbit »

jollofricepeas wrote: post #107
Kalium wrote: post #83

Earlier quoted context omitted.

> Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's. Funny enough, this thought process shows a failure to understand process and internal influencing. Quite often, the things found by a basic pen-test are known internally. Research will reveal long, boring discussions that end with someone like Bill dismissing things as not imp…

[secexec here with F500 company.] Over time every security executive learns that there’s only three important things in security: - How big is our cyber policy? - How do we make sure the insurance company pays out? - Will our financial growth and policy offset the maximum potential losses if we decide not to roll out security tool X or patch Y? That’s really it. When growth and insurance won’t cover it then you’re pl…

Some companies care about their brand and how a breach can negatively impact that, add this to your list and now you have four things.
Post reply on HN