4 ms·

You should be satisfied with the results of a pen test if you can get a real hacker to do it for you. Finding real white hat hackers is hard, but they are out t

by _wldu 6y ago

You should be satisfied with the results of a pen test if you can get a real hacker to do it for you. Finding real white hat hackers is hard, but they are out there. Most 'security guys' are not hackers. They do not have CS degrees and are not curious at all. Rather, they are 8 to 5 office workers that are compliance and risk oriented. They run automated vulnerability scanners (that are largely useless and filled with false positives based on the version string of Apache). They submit reports to management where they discuss how to make the 'red' things 'green' to impress the Board. Real hackers are very curious about technology and like to see how they can break things or make things do something that they were not intended to do. That's how they find bugs. Two totally different worlds. One is focused on 'compliance and risk and loss prevention insurance policies' (basically CYA) while the other is focused on actually being technically secure by trying to break things before the bad hacker comes along and does so.

dx87 6y ago
I agree with all of that, except for the part about a CS degree. When I was in the military, a General was talking to us about the officers that they had doing pentesting, and they said that the people with CS and other tech degrees were usually outperformed by the people with degrees in things like political science. From their experience, the people with technical degrees would often get hung up on a problem if it didn't have a provably right/wrong answer, while the people with degrees in "soft" subjects were able to think through a problem and provide a "best" answer.
- _wldu 6y ago
  CS/EE degrees are optional. Many hackers do not have them. It's just an indicator that they probably know the basics (bits, bytes, systems, etc.) but certainly not required. Some of the best hackers I have worked with had dropped out of (very difficult CS/EE programs) and never finished college.

by _wldu 6y ago

dx87 6y ago

I agree with all of that, except for the part about a CS degree. When I was in the military, a General was talking to us about the officers that they had doing pentesting, and they said that the people with CS and other tech degrees were usually outperformed by the people with degrees in things like political science. From their experience, the people with technical degrees would often get hung up on a problem if it didn't have a provably right/wrong answer, while the people with degrees in "soft" subjects were able to think through a problem and provide a "best" answer.

_wldu 6y ago
CS/EE degrees are optional. Many hackers do not have them. It's just an indicator that they probably know the basics (bits, bytes, systems, etc.) but certainly not required. Some of the best hackers I have worked with had dropped out of (very difficult CS/EE programs) and never finished college.