5 ms·
> I spent from 2005 until ~last year running pentest engagements, for what it's worth. [1h ago https://news.ycombinator.com/item?id=27494895 https://news.ycombi
by lucb1e 5y ago
> I spent from 2005 until ~last year running pentest engagements, for what it's worth. [1h ago https://news.ycombinator.com/item?id=27494895 https://news.ycombinator.com/item?id=27494895]
> I don't know, [...] I work primarily in software security and vulnerability research, and not IT security. [52m ago, parent post]
Umm, so do you think IT security (I'd say pentests fall well within IT security, let me know if that's where you disagree) is within your competency or not?
- tptacek 5y agoIT security is a different specialization than any sense of the term "pentesting". IT security people engage pentesters, in the same sense that pentesters engage IT infrastructure in order to, like, send emails and stuff.
- lucb1e 5y agoInteresting, I do penetration tests as my day job and would therefore say that means I'm working in IT security. But also I'm not a native english speaker so I might just be wrong. Just to make sure, what you call IT security is the securing of IT infrastructure, and what penetration testers do is, well, the testing thereof?
- tptacek 5y agoIT security is desktop and corporate infrastructure server security (file servers, email, directory), usually along with corporate network security (very big companies sometimes have distinct network security teams, but if you don't have that, IT security owns network security --- the wifi access points, the access routers, any weird 8021x-type stuff you're doing, etc). As soon as you move into prod servers you're typically talking about cloud/infrasec people, who are distinct from IT security people. Infrasec: IAM; IT Security: Active Directory. As soon as you move to actual code that the corporation writes/maintains, you're in appsec. If your IT security group owns appsec, you're not doing appsec.
- galacticaactual 5y agoLol.