T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their Security Is Awful’

Re:T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their S... by secuthro22 on Thursday August 26, 2021 @02:12PM (#28318458)

One of the biggest problems in the security industry is a misconception that security and computer science are the same. They aren't at all.

If you're doing low level design of crypto algorithms, you need to know math. If you're doing appsec reviews or pentests, then a background in software development might help (but is not required).

But there is an entire world of security roles out there that are essential to implementing security that have nothing to do with math or compsci. The security industry right now has a huge problem with gatekeeping, where they think you can't even begin to think about security unless you're already a top-tier principal engineer, and it's led to a huge drought of talent in security roles across the board.

[ Parent | on HN ]

Re:T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their S... by ddng on Thursday August 26, 2021 @02:30PM (#28318712)

So true. When I was a student, I aced most of my classes from math theories to ee. But took one cryptography class and everything went over my head.

To this day, its hard for me to tell during hiring what makes a good security hire.

[ Parent | on HN ]

Re:T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their S... by BenjiWiebe on Thursday August 26, 2021 @03:19PM (#28319333)

And yet, (correct me if I'm wrong), a good security person does not need to understand cryptography. He should have some basic understanding of how to apply it, but the knowledge of it's internals and the math behind it is pretty much useless.

[ Parent | on HN ]

Re:T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their S... by granshaw on Thursday August 26, 2021 @05:25PM (#28321018)

Yeah from the outside looking in, to me the biggest requirement is one of mindset, thinking like an attacker, thinking of all the possibilities… in that sense very much like the qualities for a good QA person

[ Parent | on HN ]

Re:T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their S... by ddng on Thursday August 26, 2021 @11:07PM (#28323882)

true, crypto(graphy - wow, been so long since i've typed it that I've just realized crypto has now been bogarded for something else). theory vs applied but I think its still true the mindset of a hacker is still very different. ie similar to the whole IT vs dev

[ Parent | on HN ]

Re:T-Mobile Hacker Who Stole Data on 50M Customers: ‘Their S... by staticassertion on Thursday August 26, 2021 @04:01PM (#28319870)

I don't really agree with "they aren't at all". If anything, engineering skills are extremely undervalued in infosec.

[ Parent | on HN ]