Re:Careers in security, ethical hacking and advice on where ...
by patcheudor on Tuesday December 20, 2016 @02:52PM
(#13223334)
I agree with you on your assessment, but those people you respect and inspired you are the one's who are already in the field. They already have accomplishments and have done things to earn that respect. I've found that it's near impossible to differentiate "posers" from actual security people when it comes to hiring someone without a long, formal, and vouched for by others security career. This is where bounties and ethical disclosure come into play. Also note the careful choosing of long, formal, and vouched for wording above. There are certainly people in our industry who are here because they are good at social engineering rather than here because of their technical skills or work ethic. Those individuals are very damaging to our field.
Re:Careers in security, ethical hacking and advice on where ...
by dsacco on Tuesday December 20, 2016 @03:05PM
(#13223445)
Can you clarify what you mean by "good at social engineering"? Do you mean they try to specialize in that and pass it off as actual security rigor ("hacking")?
Re:Careers in security, ethical hacking and advice on where ...
by patcheudor on Tuesday December 20, 2016 @04:07PM
(#13223982)
Exaggerating their skill-set, claiming to have skills when they don't. Yes, it could be the Dunning–Kruger effect in action but more than not I think there is careful plotting involved to deceive. It's actually odd if you think about it a bit. I've been going to DEFCON for the last 11 years, have done the CTF thing, the speaking thing, etc., and it strikes me in many ways as a tale of two cities. You've got your highly skilled and technical security professionals who are talking and sharing but then you have all of the roadies, the fans, the people who watched Hackers and want that lifestyle. We don't see this in any other technical field that I'm aware of - I mean I'm pretty sure there aren't blue-haired database administrator wannabe's showing up to DBCon, are there? What ends up happening is that people like the idea. They want to be a "hacker" but want it as a day job but don't have the technical skill so they must figure out ways to social engineer their way into the field.
The folks at Attrition tend to cover it a bit more when it comes to "security rockstars":
Re:Careers in security, ethical hacking and advice on where ...
by dsacco on Tuesday December 20, 2016 @05:28PM
(#13224826)
Yikes, what a list. I see your point though.
Re:Careers in security, ethical hacking and advice on where ...
by nommm-nommm on Wednesday December 21, 2016 @11:57AM
(#13230612)
Saw a talk about bug bounties that had some data. Bug bounties mainly go to people in so-called "third world" counties; those are the people who appear to be the ones most interested in them.
My best colleagues, the people I most deeply respect and the people who inspired me to work in this industry all neglect bug bounties. They mostly don't participate in them at all. Bug bounties are usually pursued by people who have the free time and bandwidth for them. For the most part, most security consultants and engineers do not actually engage in them because they are already highly paid. This is why you most frequently see bug bounty participants from countries other than the United States and Western Europe.
Those that do have a full-time position and also engage in bug bounties certainly have a commendable passion for the work (or sometimes more accurately a workable formula for getting to low hanging fruit in new programs first), but please don't expect all or even most skilled security talent to adhere to this rule. Many people enjoy being skilled without sacrificing work-life balance. Just as not every software engineer needs to contribute to open source or have a GitHub profile, not every security engineer needs to have badgers for every company they've hacked.