5 ms·

Please read "the security mindset" by Bruce Schneier: https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html https://www.schneier.com/blog/archi

• adrianmonk 7y ago
  Perhaps I was taking "adversarial" too literally, but to me it normally suggests an antagonistic or hostile attitude toward the other side. For example, if two next door neighbors don't get along and one of them reports any little infraction to their homeowners' association, they are adversarial. It's sort of the opposite of cooperative. And this is not how I see the motivation and attitude of most security people. For them it is mostly about the satisfaction of (or other inclination toward) understanding how and where something might be vulnerable to exploit. It is a particular type of thinking related to creativity, thinking outside the box, and seeing things from a different perspective. (So basically what Schneier's essay says. Which fits with my point.) There is nothing sophisticated or clever about a neighbor calling the homeowners' association. What they're interested in is the effect their actions will have on their adversary. But a security researcher doesn't usually care to actually exploit vulnerabilities. Or if they do, it is only to prove that the vulnerability exists, not to gain from it. So, getting back to the original point, I just don't follow the reasoning that security researchers would prefer to avoid finding holes in their own employer's systems. If they viewed everything as us vs. them, then yes, they would want to take sides and protect their employer. Instead, I think that because what they really care about is understanding vulnerabilities, they would want to understand them wherever they see them, own employer's systems included.