4 ms·

This is a bad bad article, the advice is dated and the counter-arguments are well known and oft-discussed by anyone who's actually in the security community. T

This is a bad bad article, the advice is dated and the counter-arguments are well known and oft-discussed by anyone who's actually in the security community. The author / website does seem to be offering services in the security industry, but they seem compliance-focused rather than security-focused (compliance is a component of security). So likely offering legal & administrative expertise rather than technical.

hn_throwaway_99 4y ago
On reflection, I think this article is why I find it extremely difficult to hire qualified security experts. The vast majority of "security experts" I find tend to be "box tickers", who can require lots of rules like this ("don't use the built in password manager"), but whose advice is worse than useless because they don't understand the actual threat models. I know great security people exist, but in my experience I wasn't able to find them, and instead just decided to learn the most important things myself (I'm an application engineer who felt I had a good grasp of things around application security, but less so around infrastructure and corporate IT security).
- kaoD 4y ago
  I used to develop custom Node+React web apps for an org that required security audits. I was happy to get my code audited for vulnerabilities, but when the audit came it was just a bunch of boxes ticked for Drupal/WordPress/etc. vulns.
- WhyNotHugo 4y ago
  I feel that it's also very hard for people who understand security to put themselves out there. For people who actually care about security and not just compliance, there's no real job market at all. Companies never hire for this kind of role. So I think they're hard to find because there's no real market for them, there's little point in announcing themselves and their expertise since there's really [almost] nobody interested in hiring that. It's a sad reality, tbh.
  - jjav 4y ago
    > For people who actually care about security and not just compliance, there's no real job market at all. Companies never hire for this kind of role. Can't agree more! This is the sad truth as you say. This is the space I work in and to find a team who actually cares about building a secure product against reasoned threat models is as rare as winning the lottery. Roles with great pay are easy to find in the policy and process side of security though.
GekkePrutser 4y ago
Their site seems focused on CISOs which in my experience lack serious technical skills. In fairness this is part of their job, but it is sometimes annoying when they refuse to recognise real risks and just focus on stuff that's just show. Like bitsight scores. In our case they don't reflect our actual environment at all (they don't recognise 99% of our traffic), but the CISOs love bitsight because our score is an A.
throwaway81523 4y ago
It would also be great if someone could get the author a Twitter account. I usually hate twitter but this seems like a 2000+ word article that could have been stated in a couple of tweets.
- kurupt213 4y ago
  I always upvote the random maligning of Twitter

hn_throwaway_99 4y ago

On reflection, I think this article is why I find it extremely difficult to hire qualified security experts. The vast majority of "security experts" I find tend to be "box tickers", who can require lots of rules like this ("don't use the built in password manager"), but whose advice is worse than useless because they don't understand the actual threat models. I know great security people exist, but in my experience I wasn't able to find them, and instead just decided to learn the most important things myself (I'm an application engineer who felt I had a good grasp of things around application security, but less so around infrastructure and corporate IT security).

kaoD 4y ago
I used to develop custom Node+React web apps for an org that required security audits. I was happy to get my code audited for vulnerabilities, but when the audit came it was just a bunch of boxes ticked for Drupal/WordPress/etc. vulns.
WhyNotHugo 4y ago
I feel that it's also very hard for people who understand security to put themselves out there. For people who actually care about security and not just compliance, there's no real job market at all. Companies never hire for this kind of role. So I think they're hard to find because there's no real market for them, there's little point in announcing themselves and their expertise since there's really [almost] nobody interested in hiring that. It's a sad reality, tbh.
- jjav 4y ago
  > For people who actually care about security and not just compliance, there's no real job market at all. Companies never hire for this kind of role. Can't agree more! This is the sad truth as you say. This is the space I work in and to find a team who actually cares about building a secure product against reasoned threat models is as rare as winning the lottery. Roles with great pay are easy to find in the policy and process side of security though.

GekkePrutser 4y ago

Their site seems focused on CISOs which in my experience lack serious technical skills. In fairness this is part of their job, but it is sometimes annoying when they refuse to recognise real risks and just focus on stuff that's just show. Like bitsight scores. In our case they don't reflect our actual environment at all (they don't recognise 99% of our traffic), but the CISOs love bitsight because our score is an A.

throwaway81523 4y ago

It would also be great if someone could get the author a Twitter account. I usually hate twitter but this seems like a 2000+ word article that could have been stated in a couple of tweets.

kurupt213 4y ago
I always upvote the random maligning of Twitter