5 ms·

Well, one role in this might be that a lot of cybersecurity jobs are complete bullshit, and or their certifications are. I won a free certification course as a

by lawl 9y ago

Well, one role in this might be that a lot of cybersecurity jobs are complete bullshit, and or their certifications are. I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. Most of these "cybersecurity" jobs are download Metasploit and run autopwn, install garbage antivirus everywhere. Maybe layer some more bullshit on top like network intrusion detection and web application firewalls. If you get still get owned talk some bullshit about how advanced the attack was and that there was nothing you could have done. The other option is to go and write exploits and sell these to government agencies. I don't really want to do either of those, so I'll stay far away from this field, even as an infosec enthusiast. I'm sure theres also some real infosec jobs, but i'd say they're pretty rare.

WrtCdEvrydy 9y ago
Because the appearance of security is better than actual security. - Every PCI Document Ever.
- lawl 9y ago
  Ahh, PCI, the thing that tells you (told you?) you need to use AES and nothing more, so people use ECB. Great security theatre indeed.
  - WrtCdEvrydy 9y ago
    My favorite one... Anti-Virus on Linux...
sheeshkebab 9y ago
Couldn’t agree more. Sure, it’s great to know about a lot of these hacks and ways to prevent them (and be on top of patching) - but unfortunately most of these full time sec jobs are just bull shit, made up for compliance purposes.
rhexs 9y ago
IT has a shortage of metasploit/burpscanner/nexpose/nessus jockeys and XYZ security appliance administrators at low salaries. The positions you're talking about are an incredibly difficult sell to companies. Top 10 companies have a few positions on hire at decent wages doing unique work but that's it. Some companies cyber defense strategy just involves buying a bunch of insurance. Plenty of pen testing mega-mart consultancy jobs making 60-90K a year working 70 hours a week in Boston and other ungodly expensive cities though. Guessing all this news about the "shortage" in cyber is just more propaganda to further open up the H1B floodgates and drive salaries down.
- greatamerican 9y ago
  This is the correct answer. An "unfilled" job is a misnomer. There is a market-clearing price for everything.
  - aianus 9y ago
    If refineries shut down and the price of gas goes to $10/gallon is that not a "real shortage" because there is still a market clearing price and I can still buy gas? I disagree. I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally.
    - user5994461 9y ago
      >>> I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally. Software engineers from a top school, who passed the most hardcore interviews in the most selective firms in the world, to live in the most expensive city on the planet where a single bedroom flat is $4k a month.
  - user5994461 9y ago
    I don't think so. There really are not 3 million jobs in cybersecurity. There is not much demand for people who can run a scanner or set up a firewall. Not to mention that a setup is a single day of work, it's not even close to a full time job. Maybe they are counting every guy who ever plugged a broadband modem as a security specialist.
j0hnml 9y ago
> Most of these "cybersecurity" jobs are download Metasploit and run autopwn This is, unfortunately, selling the security industry short. In reality, and especially in cities like DC, the security industry is pretty competitive and the barrier to entry for even entry-level jobs is pretty high. Companies are looking for not just metasploit experience, but a more-than-surface-level understanding of things like networking, OS internals, programming, systems administration, critical thinking, and more. Then on top of that, one needs to be able to look at everything with "vulnerabilities" and "exploitation" in mind. It's not easy. Quite frankly, there is a lot of information that one needs to know, and know well, to be competitive in this field. With that said, I 100% agree that the certifications are complete bullshit (including SANS). And sure, there are certainly fields that are definitely bullshit-y and mostly for compliance purposes (cough pentesting cough). But there is merit in the security field and it's not all bullshit.
itronitron 9y ago
I have NEVER heard a useful description by a cybersecurity analyst (i.e. detecting intrusions and exfiltration) on how they do their work, despite being in a position where they should have been able to do so. Usually I just get shrugged shoulders.
- quotheth 9y ago
  I can't tell what this post is implying - that sec analysts are like... a fake job? Can you please elaborate?
  - itronitron 9y ago
    Apologies for being unclear, to elaborate ... IMHO cyber-security analysts could do much better in defining how they do their job in order to give people that are interested a path forward in developing the needed skills. To be clear, I'm not talking about the larger cyber-security profession that is mostly focused on setting and enforcing rules.
- tptacek 9y ago
  I have no trouble conjuring a job description for a "cybersecurity analyst"; I assume their job consists of: 1. Staffing an event management system (probably something with a pretty console that is 1/5th as powerful as an ELK deployment but that costs 10x as much because Security) and investigating alerts. 2. Kicking off routine scanning processes and reviewing the results generated by them. 3. Responding to requests to let this application or that host through some perimeter firewall.
  - deleted 9y ago
    [deleted]
tr4cefl0w 9y ago
> I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. I've been in the field for a couple of years. I work for a global corporation with 10k+ employees and most of our team members in the security department are judge on their skills and various other factors and we filter potential candidates with a small CTF. Certs have very little importance for us, but we're the exception. Most big compagnies require certifications and oddly they are the ones getting hacked. In the field, we all know that EC-Council certs are bullshit. They are, at best, the laughing stock in infosec because their "Ethical Hacker" certification is a multiple choice answer and requires little technical knowledge and no hands-on. However, there are a few certs out there that need a lot of work and technical knowledge to be learn for passing it, such as OSCP. It might be easy to get for someone with 10+ years but for relatively new comers, it's a really good challenge to tackle. I started with their lab, thinking it was going to be a piece of cake for me but it's more difficult than I expected, which is a good thing. But I see your point and I mostly agree. Care to explain why you think intrusion detection is bullshit?
- lawl 9y ago
  >Care to explain why you think intrusion detection is bullshit? If they're signature based they're not better than antivirus. I have zero faith in signature based systems. For the stuff that uses machine learning, I have to admit, I have no idea how that stuff performs. But in general I wouldn't trust a machine learning model to not be fooled. Edit: Add to that HTTPS, I don't buy any claim that they can spot malware traffic from malware that isn't dumb, and I don't think MITMing all traffic is an acceptable solution.
  - tptacek 9y ago
    Anomaly detection doesn't do much better than signature systems do. It finds real stuff, but it "finds" so much garbage that the signal is swamped by it.
    - 9y ago

by lawl 9y ago

WrtCdEvrydy 9y ago

Because the appearance of security is better than actual security. - Every PCI Document Ever.

lawl 9y ago
Ahh, PCI, the thing that tells you (told you?) you need to use AES and nothing more, so people use ECB. Great security theatre indeed.
- WrtCdEvrydy 9y ago
  My favorite one... Anti-Virus on Linux...

sheeshkebab 9y ago

Couldn’t agree more. Sure, it’s great to know about a lot of these hacks and ways to prevent them (and be on top of patching) - but unfortunately most of these full time sec jobs are just bull shit, made up for compliance purposes.

rhexs 9y ago

IT has a shortage of metasploit/burpscanner/nexpose/nessus jockeys and XYZ security appliance administrators at low salaries. The positions you're talking about are an incredibly difficult sell to companies. Top 10 companies have a few positions on hire at decent wages doing unique work but that's it. Some companies cyber defense strategy just involves buying a bunch of insurance. Plenty of pen testing mega-mart consultancy jobs making 60-90K a year working 70 hours a week in Boston and other ungodly expensive cities though. Guessing all this news about the "shortage" in cyber is just more propaganda to further open up the H1B floodgates and drive salaries down.

greatamerican 9y ago
This is the correct answer. An "unfilled" job is a misnomer. There is a market-clearing price for everything.
- aianus 9y ago
  If refineries shut down and the price of gas goes to $10/gallon is that not a "real shortage" because there is still a market clearing price and I can still buy gas? I disagree. I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally.
  - user5994461 9y ago
    >>> I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally. Software engineers from a top school, who passed the most hardcore interviews in the most selective firms in the world, to live in the most expensive city on the planet where a single bedroom flat is $4k a month.
- user5994461 9y ago
  I don't think so. There really are not 3 million jobs in cybersecurity. There is not much demand for people who can run a scanner or set up a firewall. Not to mention that a setup is a single day of work, it's not even close to a full time job. Maybe they are counting every guy who ever plugged a broadband modem as a security specialist.

j0hnml 9y ago

> Most of these "cybersecurity" jobs are download Metasploit and run autopwn This is, unfortunately, selling the security industry short. In reality, and especially in cities like DC, the security industry is pretty competitive and the barrier to entry for even entry-level jobs is pretty high. Companies are looking for not just metasploit experience, but a more-than-surface-level understanding of things like networking, OS internals, programming, systems administration, critical thinking, and more. Then on top of that, one needs to be able to look at everything with "vulnerabilities" and "exploitation" in mind. It's not easy. Quite frankly, there is a lot of information that one needs to know, and know well, to be competitive in this field. With that said, I 100% agree that the certifications are complete bullshit (including SANS). And sure, there are certainly fields that are definitely bullshit-y and mostly for compliance purposes (cough pentesting cough). But there is merit in the security field and it's not all bullshit.

itronitron 9y ago

I have NEVER heard a useful description by a cybersecurity analyst (i.e. detecting intrusions and exfiltration) on how they do their work, despite being in a position where they should have been able to do so. Usually I just get shrugged shoulders.

quotheth 9y ago
I can't tell what this post is implying - that sec analysts are like... a fake job? Can you please elaborate?
- itronitron 9y ago
  Apologies for being unclear, to elaborate ... IMHO cyber-security analysts could do much better in defining how they do their job in order to give people that are interested a path forward in developing the needed skills. To be clear, I'm not talking about the larger cyber-security profession that is mostly focused on setting and enforcing rules.
tptacek 9y ago
I have no trouble conjuring a job description for a "cybersecurity analyst"; I assume their job consists of: 1. Staffing an event management system (probably something with a pretty console that is 1/5th as powerful as an ELK deployment but that costs 10x as much because Security) and investigating alerts. 2. Kicking off routine scanning processes and reviewing the results generated by them. 3. Responding to requests to let this application or that host through some perimeter firewall.
- deleted 9y ago
  [deleted]

tr4cefl0w 9y ago

> I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time. I've been in the field for a couple of years. I work for a global corporation with 10k+ employees and most of our team members in the security department are judge on their skills and various other factors and we filter potential candidates with a small CTF. Certs have very little importance for us, but we're the exception. Most big compagnies require certifications and oddly they are the ones getting hacked. In the field, we all know that EC-Council certs are bullshit. They are, at best, the laughing stock in infosec because their "Ethical Hacker" certification is a multiple choice answer and requires little technical knowledge and no hands-on. However, there are a few certs out there that need a lot of work and technical knowledge to be learn for passing it, such as OSCP. It might be easy to get for someone with 10+ years but for relatively new comers, it's a really good challenge to tackle. I started with their lab, thinking it was going to be a piece of cake for me but it's more difficult than I expected, which is a good thing. But I see your point and I mostly agree. Care to explain why you think intrusion detection is bullshit?

lawl 9y ago
>Care to explain why you think intrusion detection is bullshit? If they're signature based they're not better than antivirus. I have zero faith in signature based systems. For the stuff that uses machine learning, I have to admit, I have no idea how that stuff performs. But in general I wouldn't trust a machine learning model to not be fooled. Edit: Add to that HTTPS, I don't buy any claim that they can spot malware traffic from malware that isn't dumb, and I don't think MITMing all traffic is an acceptable solution.
- tptacek 9y ago
  Anomaly detection doesn't do much better than signature systems do. It finds real stuff, but it "finds" so much garbage that the signal is swamped by it.
  - 9y ago