10 ms·

Can I ask what you're losing faith in? I've just joined the infosec workforce but it's been a hobby of mine for awhile(22 y/o). I've already become jaded and bi

Can I ask what you're losing faith in? I've just joined the infosec workforce but it's been a hobby of mine for awhile(22 y/o). I've already become jaded and bitter at this industry. I just see the industry being pillaged by profiteers at a detriment to the health of the industry.

hluska 8y ago
I'm not the person you're replying to, but I'm 41 and understand the notion of losing faith in the security world. I'm not losing faith with the profiteers because, if I look back at my career with open, honest eyes, I can see points where I was a profiteer and a detriment to the industry as a whole. Instead, I'm losing faith because it seems like the attacks keep getting more sophisticated, yet it's getting harder to operate as a white hat. I can't count how many times in the last year that I have suggested that researchers be incredibly careful about how they report bugs or if they should even report at all. Nor can I can count how many stories I've heard where white hats submit really juicy bugs, only to be screwed over on bounties, threatened with prosecution under the CFAA, or otherwise maligned. I can't believe that I can truthfully say this, but I feel like we have reached a point where being a white hat is too much trouble for too few potential rewards.
Rjevski 8y ago
My problem with security is that attacks get more and more advanced but users are just as clueless as ever, so we’re headed towards doom.
- eaandkw 8y ago
  I think it would be more accurate to say that users are fatigued and worn out. Password fatigue is a thing. The updated password guidelines from NIST are a good start. Or the users are negligent rather than clueless. Look at the DNC hacks of Podesta.
  - Rjevski 8y ago
    Password fatigue is easily mitigated by password managers. The issue is that users are too stupid and don't care to spend the time/money to do things the right way, and instead keep on reusing the same password everywhere.
    - magduf 8y ago
      No, claiming password managers will solve everything is rather clueless. Password manager don't work across multiple systems. How am I supposed to log into some website from my work computer when the password is on the password manager on my home computer? Or what about my cellphone? (And no, my IT department would not allow me to install a password manager that syncs.) In a typical workday, I use 4 different computers, plus several VMs and other work accounts, all with their own passwords. Password managers aren't possible on my work computers and VMs. I reuse passwords as much possible.
eaandkw 8y ago
To quote a tweet from Brian Krebs, "Being in infosec for so long takes its toll. I've come to the conclusion that if you give a data point to a company, they will eventually sell it, leak it, lose it or get hacked and relieved of it. There really don't seem to be any exceptions, and it gets depressing." [1] Sometimes I feel like to only way to win is to not play the game. I believe that is another quote from the movie Wargames. [1] https://twitter.com/briankrebs/status/1045091640480804864 https://twitter.com/briankrebs/status/1045091640480804864
- elliekelly 8y ago
  Or perhaps we can change the rules of the game? It's noteworthy that he doesn't consider the possibility that a company delete/destroy the data. As it stands now, its a no-brainer for companies to save as much information as they can about a person because there's almost no down side. The risk of a data breach to the individual(s) far exceeds the risk of a breach to the corporation. The incentives are massively misaligned. I'm cautiously optimistic that GDPR (with all of it's many flaws) could mark the beginning of slow a transition from corporate data hoarding to minimalism. You heard it here first: Corporate KonMari Consultant will be the trendy Gen Z career.
  - eaandkw 8y ago
    I doubt that Brian Krebs hasn't considered that. He works in information security and I would assume he is not on any corporate boards. I would however agree that even though I am not normally in favor a regulations this would be a good place to have something similar to the GDPR. There should be a balance between data being an asset vs. a liability. Right now it is only viewed as an asset so there isn't enough emphasis on security.
    - elliekelly 8y ago
      Apologies for the confusion. I simply meant that particular quote hadn't contemplated destruction. And with good reason, there's virtually no incentive for businesses to destroy data they collect. I'm certain he has given quite a lot of thought to data destruction as it relates to data security. I was trying to point out that it was conspicuously absent in his tweet.

hluska 8y ago

I'm not the person you're replying to, but I'm 41 and understand the notion of losing faith in the security world. I'm not losing faith with the profiteers because, if I look back at my career with open, honest eyes, I can see points where I was a profiteer and a detriment to the industry as a whole. Instead, I'm losing faith because it seems like the attacks keep getting more sophisticated, yet it's getting harder to operate as a white hat. I can't count how many times in the last year that I have suggested that researchers be incredibly careful about how they report bugs or if they should even report at all. Nor can I can count how many stories I've heard where white hats submit really juicy bugs, only to be screwed over on bounties, threatened with prosecution under the CFAA, or otherwise maligned. I can't believe that I can truthfully say this, but I feel like we have reached a point where being a white hat is too much trouble for too few potential rewards.

Rjevski 8y ago

My problem with security is that attacks get more and more advanced but users are just as clueless as ever, so we’re headed towards doom.

eaandkw 8y ago
I think it would be more accurate to say that users are fatigued and worn out. Password fatigue is a thing. The updated password guidelines from NIST are a good start. Or the users are negligent rather than clueless. Look at the DNC hacks of Podesta.
- Rjevski 8y ago
  Password fatigue is easily mitigated by password managers. The issue is that users are too stupid and don't care to spend the time/money to do things the right way, and instead keep on reusing the same password everywhere.
  - magduf 8y ago
    No, claiming password managers will solve everything is rather clueless. Password manager don't work across multiple systems. How am I supposed to log into some website from my work computer when the password is on the password manager on my home computer? Or what about my cellphone? (And no, my IT department would not allow me to install a password manager that syncs.) In a typical workday, I use 4 different computers, plus several VMs and other work accounts, all with their own passwords. Password managers aren't possible on my work computers and VMs. I reuse passwords as much possible.

eaandkw 8y ago

To quote a tweet from Brian Krebs, "Being in infosec for so long takes its toll. I've come to the conclusion that if you give a data point to a company, they will eventually sell it, leak it, lose it or get hacked and relieved of it. There really don't seem to be any exceptions, and it gets depressing." [1] Sometimes I feel like to only way to win is to not play the game. I believe that is another quote from the movie Wargames. [1] https://twitter.com/briankrebs/status/1045091640480804864 https://twitter.com/briankrebs/status/1045091640480804864

elliekelly 8y ago
Or perhaps we can change the rules of the game? It's noteworthy that he doesn't consider the possibility that a company delete/destroy the data. As it stands now, its a no-brainer for companies to save as much information as they can about a person because there's almost no down side. The risk of a data breach to the individual(s) far exceeds the risk of a breach to the corporation. The incentives are massively misaligned. I'm cautiously optimistic that GDPR (with all of it's many flaws) could mark the beginning of slow a transition from corporate data hoarding to minimalism. You heard it here first: Corporate KonMari Consultant will be the trendy Gen Z career.
- eaandkw 8y ago
  I doubt that Brian Krebs hasn't considered that. He works in information security and I would assume he is not on any corporate boards. I would however agree that even though I am not normally in favor a regulations this would be a good place to have something similar to the GDPR. There should be a balance between data being an asset vs. a liability. Right now it is only viewed as an asset so there isn't enough emphasis on security.
  - elliekelly 8y ago
    Apologies for the confusion. I simply meant that particular quote hadn't contemplated destruction. And with good reason, there's virtually no incentive for businesses to destroy data they collect. I'm certain he has given quite a lot of thought to data destruction as it relates to data security. I was trying to point out that it was conspicuously absent in his tweet.