5 ms·
Similar skillset, but as a pentester you need to be an expert in both offense and defense. So the cybercriminal side is much easier.
by J5892 6y ago
Similar skillset, but as a pentester you need to be an expert in both offense and defense.
So the cybercriminal side is much easier.
- Nextgrid 6y agoWhat do you mean by defense? Covering your tracks? In this case I'd argue it's the opposite - in pentesting the worst that can happen if you get spotted is a failed test, while in real crime this could be the difference between freedom and jail.
- bluGill 6y agoYou are generally hire to fix problems which means you need to close the holes you find.
- c22 6y agoTo be fair, many cybercriminals do this too, to lock out their competition.
- ssklash 6y agoI'm a pentester, you generally don't fix the issues you find so much as provide guidance and references on how it might be done. The defenders/app developers are in a much better position to fix most issues, they generally either weren't aware of that class of vulnerability or unaware of a specific method of exploiting the issue. Most web devs, if you tell them you found an XSS, would know what you meant and basic prevention, but maybe not the specific way you exploited it. But I don't go tweak their whitelist or implement better output encoding for them. That said, you do have to know the defensive side well, even if you don't implement it yourself.
- TheOtherHobbes 6y agoIn real crime the worst that can happen is some unpleasant people decide to kill you because reasons. That's rarely a problem with authorised white hat work.