Re:Infosec's Jerk Problem (2013)
by forgottenpass on Friday April 29, 2016 @10:54AM
(#11596094)
No, I mean to say that I'm on the boring side of the line.
But penetration testing is a job that exists. People are hired to do exactly that under contractual terms with the target. (And I don't mean to imply that's the only security job in the more-rewarding/fun category.)
Re:Infosec's Jerk Problem (2013)
by logfromblammo on Friday April 29, 2016 @11:34AM
(#11596369)
Rewriting someone else's code to eliminate the potential buffer overflows is a lot less glamorous and exciting than exploiting a buffer overflow to escalate user privileges, in the same way that watching a mason re-mortar an entire brick wall is less exciting than watching a ninja scale that wall, eliminate the guards in complete silence, steal the MacGuffin, and escape without a trace.
But it is steady, decently-paying work that will likely last until the singularity.
What do you mean it's an interesting claim? It makes perfect sense to me, and I'm just a regular old web developer.
Re:Infosec's Jerk Problem (2013)
by vox_mollis on Friday April 29, 2016 @10:51AM
(#11596074)
Penetration testing is legal.
Wow, this is an interesting claim. You do this work for a living? Are you ever concerned about getting caught? How do you get paid?
I'm assuming that covering your tracks is some sort of ever escalating cat-and-mouse-game. How do you find out about your adversaries' capabilities regarding investigation after the victim detects the problem?
EDIT: oh, oops. Double-misunderstanding. "that's what I do" meaning "harden,test,repeat" and of course some folks are legitimately paid to do pen testing.