21–30 of 66 posts
Earlier quoted context omitted.
Because the appearance of security is better than actual security. - Every PCI Document Ever.
Ahh, PCI, the thing that tells you (told you?) you need to use AES and nothing more, so people use ECB. Great security theatre indeed.
Well, one role in this might be that a lot of cybersecurity jobs are complete bullshit, and or their certifications are. I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. Most of these "cybersecurity" jobs ar…
Well, one role in this might be that a lot of cybersecurity jobs are complete bullshit, and or their certifications are. I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. Most of these "cybersecurity" jobs ar…
Plenty of pen testing mega-mart consultancy jobs making 60-90K a year working 70 hours a week in Boston and other ungodly expensive cities though. Guessing all this news about the "shortage" in cyber is just more propaganda to further open up the H1B floodgates and drive salaries down.
Well, one role in this might be that a lot of cybersecurity jobs are complete bullshit, and or their certifications are. I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. Most of these "cybersecurity" jobs ar…
This is, unfortunately, selling the security industry short. In reality, and especially in cities like DC, the security industry is pretty competitive and the barrier to entry for even entry-level jobs is pretty high. Companies are looking for not just metasploit experience, but a more-than-surface-level understanding of things like networking, OS internals, programming, systems administration, critical thinking, and more. Then on top of that, one needs to be able to look at everything with "vulnerabilities" and "exploitation" in mind. It's not easy. Quite frankly, there is a lot of information that one needs to know, and know well, to be competitive in this field.
With that said, I 100% agree that the certifications are complete bullshit (including SANS). And sure, there are certainly fields that are definitely bullshit-y and mostly for compliance purposes (cough pentesting cough). But there is merit in the security field and it's not all bullshit.
Well, one role in this might be that a lot of cybersecurity jobs are complete bullshit, and or their certifications are. I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. Most of these "cybersecurity" jobs ar…
Well, one role in this might be that a lot of cybersecurity jobs are complete bullshit, and or their certifications are. I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. Most of these "cybersecurity" jobs ar…
I've been in the field for a couple of years. I work for a global corporation with 10k+ employees and most of our team members in the security department are judge on their skills and various other factors and we filter potential candidates with a small CTF. Certs have very little importance for us, but we're the exception. Most big compagnies require certifications and oddly they are the ones getting hacked.
In the field, we all know that EC-Council certs are bullshit. They are, at best, the laughing stock in infosec because their "Ethical Hacker" certification is a multiple choice answer and requires little technical knowledge and no hands-on.
However, there are a few certs out there that need a lot of work and technical knowledge to be learn for passing it, such as OSCP. It might be easy to get for someone with 10+ years but for relatively new comers, it's a really good challenge to tackle. I started with their lab, thinking it was going to be a piece of cake for me but it's more difficult than I expected, which is a good thing.
But I see your point and I mostly agree.
Care to explain why you think intrusion detection is bullshit?
Well, one role in this might be that a lot of cybersecurity jobs are complete bullshit, and or their certifications are. I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. Most of these "cybersecurity" jobs ar…
IT has a shortage of metasploit/burpscanner/nexpose/nessus jockeys and XYZ security appliance administrators at low salaries. The positions you're talking about are an incredibly difficult sell to companies. Top 10 companies have a few positions on hire at decent wages doing unique work but that's it. Some companies cyber defense strategy just involves buying a bunch of insurance. Plenty of pen testing mega-mart cons…
Sounds great. But how would I (software engineer) go about moving into those sorts of jobs? Do bug bounties until I make it?
Talk with ops guys and have a security guy (that typically is on that team) assign you things to fix. It’s a bull shit job, as far as software development goes. Sure, you’ll learn a bunch of hacks and ways to fix them and maybe pass cissp cert if you really don’t want to code anymore.
a. compliance
b. red teaming
c. actually trying to secure stuff
d. trying to find holes to exploit
e. etc. etc. etc.
1. This is written and published by Cyber Security Ventures. Their bias should be obvious. 2. The 3.5 million is a global number. India is projected to have 1 million of them. 3. The article seems to also try to drum up demand for Managed Security Service Providers, a service Cyber Security Ventures provides. 4. Many currently open Cybersecurity jobs pay less then what a tech minded person can get selling clicks or S…
fwiw I was once browsing jobs wondering why one in particular had such strange hours and requirements until I realized that the search had also returned results for what amounted to security guards