3 ms·

Ask HN: Coding choices for a security professional

2 points by badrabbit 9y ago

Hi HN, I work in Cyber security. While my day to day work does not involve programming, I have been writing code since my teens. I learned C and X86 assembly so I can have a better understanding of how software vulnerabilities and exploits work. I also know python and I am currently a novice with golang. Since I don't write code for a living,I don't think it would benefit me much to learn a long list of languages. What programming related specializations,methodologies and topics would benefit someone pursuing a career in Cyber security? My goal more or less is to become good at bug hunting and maybe someday develop useful defensive security software.

nerdy 9y ago
It sounds like you're in search of a solution without a problem. Programming language for what exactly? When you know what the intended use case is, you'll probably have a reasonable idea of what you need. Some projects might warrant all kinds of different programming languages. If you're looking at server-side security for a website then maybe it's Python, PHP, or Ruby. Embedded systems are probably not running PHP. If you're talking about reverse engineering an application then maybe learning IDA's C-like scripting language is best. Being able to understand syntax and nuance of a language reasonably quickly are probably more important than programming in any specific language, unless you're pursuing a career specializing in one type of system. In that case you would likely know which programming languages are appropriate.
dgroves 9y ago
Perhaps you have heard of DevSecOps? This is cyber securities version of DevOps. (also sometimes called SecDevOps and a variety of other terms). As developers continue to move toward CI/CD (AI and ML) I believe that in the future many more Cybersecurity professionals will have to be fluent in a language as automation of detection, reaction, remediation will be required skills. And that is just for the 'testing' side of application security. Network security, has long ago had this automation with tools like Metasploit, Nmap and others which are getting chained together into very amazing automated attack platforms. Application security is catching up. Burp & OWASP Zap in particular and expanding feature sets to include automation as a core function. You can right click an attack in Burp to get the curl command for that attack to use in automation for example. Simon, Zaps lead developer, inventor and all round great community leader, was hired by Mozilla back in 2010 precisely to continue to improve Zaps automation to be able to automate the testing of Mozilla software. On a personal note, I recommend starting with Python - there are good books about hacking with python like "grey hat python, black hat python, violent python" that will get you started down a good path. Of course there are many disciplines in cyber security, reverse engineering, API Testing, IoT testing, Compliance, Governance, incident response, reverse engineering malware, to name just a few. I believe Spaf said that he identified 54 unique skills in our field in a conversation we had recently. Not all of those are going to require you to program, but if you do learn to program some of the more interesting and sexy jobs in cyber open up to you.

2 points by badrabbit 9y ago

nerdy 9y ago

It sounds like you're in search of a solution without a problem. Programming language for what exactly? When you know what the intended use case is, you'll probably have a reasonable idea of what you need. Some projects might warrant all kinds of different programming languages. If you're looking at server-side security for a website then maybe it's Python, PHP, or Ruby. Embedded systems are probably not running PHP. If you're talking about reverse engineering an application then maybe learning IDA's C-like scripting language is best. Being able to understand syntax and nuance of a language reasonably quickly are probably more important than programming in any specific language, unless you're pursuing a career specializing in one type of system. In that case you would likely know which programming languages are appropriate.

dgroves 9y ago

Perhaps you have heard of DevSecOps? This is cyber securities version of DevOps. (also sometimes called SecDevOps and a variety of other terms). As developers continue to move toward CI/CD (AI and ML) I believe that in the future many more Cybersecurity professionals will have to be fluent in a language as automation of detection, reaction, remediation will be required skills. And that is just for the 'testing' side of application security. Network security, has long ago had this automation with tools like Metasploit, Nmap and others which are getting chained together into very amazing automated attack platforms. Application security is catching up. Burp & OWASP Zap in particular and expanding feature sets to include automation as a core function. You can right click an attack in Burp to get the curl command for that attack to use in automation for example. Simon, Zaps lead developer, inventor and all round great community leader, was hired by Mozilla back in 2010 precisely to continue to improve Zaps automation to be able to automate the testing of Mozilla software. On a personal note, I recommend starting with Python - there are good books about hacking with python like "grey hat python, black hat python, violent python" that will get you started down a good path. Of course there are many disciplines in cyber security, reverse engineering, API Testing, IoT testing, Compliance, Governance, incident response, reverse engineering malware, to name just a few. I believe Spaf said that he identified 54 unique skills in our field in a conversation we had recently. Not all of those are going to require you to program, but if you do learn to program some of the more interesting and sexy jobs in cyber open up to you.