4 ms·

To this point, bug bounties, bug bounties, bug bounties. If someone is applying to be a security developer, consultant, or anything beyond a security help desk

To this point, bug bounties, bug bounties, bug bounties. If someone is applying to be a security developer, consultant, or anything beyond a security help desk operator my expectation is that they can tell me about bounties they've collected. In lieu of that, I'll accept them telling me about their ethical disclosures. Also playing CTF's, even without winning is a good sign. It shows passion and that's what matters at this point as we need people in security not because of the money, but because they passionately want to make the world a safer place and enjoy the work as a bonus.

dsacco 10y ago
I want to push back against this a bit because you used the word "expectation." Yes, I strongly agree that bug bounties are one way to achieve and demonstrate a certain level of expertise in information security, especially if you are trying to break in. However, don't make it more than a job for people who just want to do the job, and don't arbitrarily make it the whiteboard of the security industry. My best colleagues, the people I most deeply respect and the people who inspired me to work in this industry all neglect bug bounties. They mostly don't participate in them at all. Bug bounties are usually pursued by people who have the free time and bandwidth for them. For the most part, most security consultants and engineers do not actually engage in them because they are already highly paid. This is why you most frequently see bug bounty participants from countries other than the United States and Western Europe. Those that do have a full-time position and also engage in bug bounties certainly have a commendable passion for the work (or sometimes more accurately a workable formula for getting to low hanging fruit in new programs first), but please don't expect all or even most skilled security talent to adhere to this rule. Many people enjoy being skilled without sacrificing work-life balance. Just as not every software engineer needs to contribute to open source or have a GitHub profile, not every security engineer needs to have badgers for every company they've hacked.
- patcheudor 10y ago
  I agree with you on your assessment, but those people you respect and inspired you are the one's who are already in the field. They already have accomplishments and have done things to earn that respect. I've found that it's near impossible to differentiate "posers" from actual security people when it comes to hiring someone without a long, formal, and vouched for by others security career. This is where bounties and ethical disclosure come into play. Also note the careful choosing of long, formal, and vouched for wording above. There are certainly people in our industry who are here because they are good at social engineering rather than here because of their technical skills or work ethic. Those individuals are very damaging to our field.
  - dsacco 10y ago
    Can you clarify what you mean by "good at social engineering"? Do you mean they try to specialize in that and pass it off as actual security rigor ("hacking")?
    - patcheudor 10y ago
      Exaggerating their skill-set, claiming to have skills when they don't. Yes, it could be the Dunning–Kruger effect in action but more than not I think there is careful plotting involved to deceive. It's actually odd if you think about it a bit. I've been going to DEFCON for the last 11 years, have done the CTF thing, the speaking thing, etc., and it strikes me in many ways as a tale of two cities. You've got your highly skilled and technical security professionals who are talking and sharing but then you have all of the roadies, the fans, the people who watched Hackers and want that lifestyle. We don't see this in any other technical field that I'm aware of - I mean I'm pretty sure there aren't blue-haired database administrator wannabe's showing up to DBCon, are there? What ends up happening is that people like the idea. They want to be a "hacker" but want it as a day job but don't have the technical skill so they must figure out ways to social engineer their way into the field. The folks at Attrition tend to cover it a bit more when it comes to "security rockstars": http://attrition.org/errata/charlatan/ http://attrition.org/errata/charlatan/
      - dsacco 10y ago
        Yikes, what a list. I see your point though.
- nommm-nommm 10y ago
  Saw a talk about bug bounties that had some data. Bug bounties mainly go to people in so-called "third world" counties; those are the people who appear to be the ones most interested in them.
debatem1 10y ago
CTFs and bug bounties are good. Better is when people have broken something for themselves, and best is when they've made money doing it. I trust that those people know how to think like the attackers I should be really worried about.

dsacco 10y ago

I want to push back against this a bit because you used the word "expectation." Yes, I strongly agree that bug bounties are one way to achieve and demonstrate a certain level of expertise in information security, especially if you are trying to break in. However, don't make it more than a job for people who just want to do the job, and don't arbitrarily make it the whiteboard of the security industry. My best colleagues, the people I most deeply respect and the people who inspired me to work in this industry all neglect bug bounties. They mostly don't participate in them at all. Bug bounties are usually pursued by people who have the free time and bandwidth for them. For the most part, most security consultants and engineers do not actually engage in them because they are already highly paid. This is why you most frequently see bug bounty participants from countries other than the United States and Western Europe. Those that do have a full-time position and also engage in bug bounties certainly have a commendable passion for the work (or sometimes more accurately a workable formula for getting to low hanging fruit in new programs first), but please don't expect all or even most skilled security talent to adhere to this rule. Many people enjoy being skilled without sacrificing work-life balance. Just as not every software engineer needs to contribute to open source or have a GitHub profile, not every security engineer needs to have badgers for every company they've hacked.

patcheudor 10y ago
I agree with you on your assessment, but those people you respect and inspired you are the one's who are already in the field. They already have accomplishments and have done things to earn that respect. I've found that it's near impossible to differentiate "posers" from actual security people when it comes to hiring someone without a long, formal, and vouched for by others security career. This is where bounties and ethical disclosure come into play. Also note the careful choosing of long, formal, and vouched for wording above. There are certainly people in our industry who are here because they are good at social engineering rather than here because of their technical skills or work ethic. Those individuals are very damaging to our field.
- dsacco 10y ago
  Can you clarify what you mean by "good at social engineering"? Do you mean they try to specialize in that and pass it off as actual security rigor ("hacking")?
  - patcheudor 10y ago
    Exaggerating their skill-set, claiming to have skills when they don't. Yes, it could be the Dunning–Kruger effect in action but more than not I think there is careful plotting involved to deceive. It's actually odd if you think about it a bit. I've been going to DEFCON for the last 11 years, have done the CTF thing, the speaking thing, etc., and it strikes me in many ways as a tale of two cities. You've got your highly skilled and technical security professionals who are talking and sharing but then you have all of the roadies, the fans, the people who watched Hackers and want that lifestyle. We don't see this in any other technical field that I'm aware of - I mean I'm pretty sure there aren't blue-haired database administrator wannabe's showing up to DBCon, are there? What ends up happening is that people like the idea. They want to be a "hacker" but want it as a day job but don't have the technical skill so they must figure out ways to social engineer their way into the field. The folks at Attrition tend to cover it a bit more when it comes to "security rockstars": http://attrition.org/errata/charlatan/ http://attrition.org/errata/charlatan/
    - dsacco 10y ago
      Yikes, what a list. I see your point though.
nommm-nommm 10y ago
Saw a talk about bug bounties that had some data. Bug bounties mainly go to people in so-called "third world" counties; those are the people who appear to be the ones most interested in them.

debatem1 10y ago

CTFs and bug bounties are good. Better is when people have broken something for themselves, and best is when they've made money doing it. I trust that those people know how to think like the attackers I should be really worried about.