<story><title>Thinking of a Cybersecurity Career?</title><url>https://krebsonsecurity.com/2020/07/thinking-of-a-cybersecurity-career-read-this/</url></story><parent_chain><item><author>movedx</author><text>&amp;gt; Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday&amp;#x27;s hacks, not tomorrow&amp;#x27;s.&lt;p&gt;Be careful here. This is bordering on elitism.&lt;p&gt;Having someone come into a business and check for &amp;quot;yesterday&amp;#x27;s hacks&amp;quot; is better than no one doing any checks at all, therefore such skills are still valuable and worthwhile.&lt;p&gt;In learning how networking works; how operating systems are designed and implemented; why and how the OWASP Top Ten work; and knowing solutions to these problems is still a valuable skill set.&lt;p&gt;What you&amp;#x27;re suggesting is everyone has to be willing and able to write fresh exploitation on the spot when they&amp;#x27;re testing a client&amp;#x27;s network when in fact there&amp;#x27;s a lot that can be discovered (and resolved) with basic scans and simple questions based off of Security+ grade knowledge.</text></item><item><author>GekkePrutser</author><text>I think the cybersecurity (I hate the term cyber btw as it&amp;#x27;s usually used by people who don&amp;#x27;t know what they&amp;#x27;re talking about), is very focused on the &amp;#x27;think like a hacker&amp;#x27; skillset right now.&lt;p&gt;While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn&amp;#x27;t really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge of the platform used (e.g. Microsoft) and internal processes are more important. After all, most companies already fail at the &amp;#x27;fix the obvious&amp;#x27; stage, it&amp;#x27;s not necessary to go looking for clever ways in when there are many doors left open.&lt;p&gt;Just to elaborate: A lot of discussions go like this. A pentest or random scan finds obvious issue. Ticket is raised to the security team. They go like &amp;quot;WTF why do we still have Windows 95?? Kill it.&amp;quot;. Then their boss goes like &amp;quot;Sorry, Bill the manufacturing VP lobbied with the CEO, we have to leave that one alone&amp;quot;. Of course when it actually gets hacked, Bill is nowhere to be found. This is why internal influencing skills are so important in real everyday security jobs.&lt;p&gt;Of course in the pentesting role this kind of thinking is absolutely necessary. However even there the kind of training given right now is too much in the realm of &amp;#x27;scriptkiddie&amp;#x27;ism. Hacking is about inventing and true mastery of technology, not about using the tools everyone uses. Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday&amp;#x27;s hacks, not tomorrow&amp;#x27;s.</text></item></parent_chain><comment><author>noch</author><text>&amp;gt; Be careful here. This is bordering on elitism.&lt;p&gt;Be careful about the soft bigotry of low expectations.&lt;p&gt;A generation has grown up thinking that skill&amp;#x2F;knowledge elitism is a real thing and that it&amp;#x27;s oppressive. Instead we should learn to identify people who do difficult things, recognise how they do difficult things well, systematically emulate their methods as we attempt difficult things, and constantly work at the edge of our ability.&lt;p&gt;The only thing that happens if we don&amp;#x27;t do difficult things is that we become people who can&amp;#x27;t do difficult&amp;#x2F;valuable things.</text></comment>
<story><title>Thinking of a Cybersecurity Career?</title><url>https://krebsonsecurity.com/2020/07/thinking-of-a-cybersecurity-career-read-this/</url></story><parent_chain><item><author>movedx</author><text>&amp;gt; Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday&amp;#x27;s hacks, not tomorrow&amp;#x27;s.&lt;p&gt;Be careful here. This is bordering on elitism.&lt;p&gt;Having someone come into a business and check for &amp;quot;yesterday&amp;#x27;s hacks&amp;quot; is better than no one doing any checks at all, therefore such skills are still valuable and worthwhile.&lt;p&gt;In learning how networking works; how operating systems are designed and implemented; why and how the OWASP Top Ten work; and knowing solutions to these problems is still a valuable skill set.&lt;p&gt;What you&amp;#x27;re suggesting is everyone has to be willing and able to write fresh exploitation on the spot when they&amp;#x27;re testing a client&amp;#x27;s network when in fact there&amp;#x27;s a lot that can be discovered (and resolved) with basic scans and simple questions based off of Security+ grade knowledge.</text></item><item><author>GekkePrutser</author><text>I think the cybersecurity (I hate the term cyber btw as it&amp;#x27;s usually used by people who don&amp;#x27;t know what they&amp;#x27;re talking about), is very focused on the &amp;#x27;think like a hacker&amp;#x27; skillset right now.&lt;p&gt;While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn&amp;#x27;t really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge of the platform used (e.g. Microsoft) and internal processes are more important. After all, most companies already fail at the &amp;#x27;fix the obvious&amp;#x27; stage, it&amp;#x27;s not necessary to go looking for clever ways in when there are many doors left open.&lt;p&gt;Just to elaborate: A lot of discussions go like this. A pentest or random scan finds obvious issue. Ticket is raised to the security team. They go like &amp;quot;WTF why do we still have Windows 95?? Kill it.&amp;quot;. Then their boss goes like &amp;quot;Sorry, Bill the manufacturing VP lobbied with the CEO, we have to leave that one alone&amp;quot;. Of course when it actually gets hacked, Bill is nowhere to be found. This is why internal influencing skills are so important in real everyday security jobs.&lt;p&gt;Of course in the pentesting role this kind of thinking is absolutely necessary. However even there the kind of training given right now is too much in the realm of &amp;#x27;scriptkiddie&amp;#x27;ism. Hacking is about inventing and true mastery of technology, not about using the tools everyone uses. Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday&amp;#x27;s hacks, not tomorrow&amp;#x27;s.</text></item></parent_chain><comment><author>ozim</author><text>Decent sysadmin should be able to setup automated scanning, know about OWASP, keep systems patched. That should be absolute baseline for sysadmin work. Checking for yesterdays hacks is valuable but that is called auditing and you should have checklist for that.&lt;p&gt;Pentesting should be focusing on hacking and uncovering stuff that was not in audits like making custom exploits on the spot.&lt;p&gt;Problem is that running scanners and checking basic stuff should be an audit but that does not sound as cool as &amp;quot;pentest&amp;quot; and &amp;quot;white hat hacker&amp;quot;&amp;#x2F;&amp;quot;cybersecurity specialists&amp;quot; sounds way cooler than auditor.</text></comment>