4 ms·

Most security jobs require almost no creativity or thought though, most of them are looking at the outputs of some commercially available AV/EDR/IDS in a commer

by c0pium 3y ago

Most security jobs require almost no creativity or thought though, most of them are looking at the outputs of some commercially available AV/EDR/IDS in a commercially available SIEM/case management tool and doing the same thing hundreds of other people have done with those same tools. If you work in research maybe you’re on, but if you work tickets you should learn how to do something else.

ofjcihen 3y ago
No, what you’re describing is what gets filtered to the people in charge of the SOAR who then automate those outcomes. Even with the top tools and detection you still absolutely need knowledgeable people to decide whether an alert is a false or true positive and then you absolutely need humans in the mix to decide what the next steps are. When you say “most security jobs” maybe you mean first tier SOC for a vendor? But I’ve never worked for one and as far as I know they’re universally seen as just above useless by anyone without a financial incentive to employ them.
- c0pium 3y ago
  So you think that you know a lot about security but not only do you not know the difference between SIEM and SOAR you think that most security jobs aren’t dealing with incidents? Fascinating. It’s not an uncommon problem though I guess, I’ve worked with a lot of people who think they’re doing novel work discovering that you can use regex to find spam or inventing a DGA detector.
  - ofjcihen 3y ago
    I’m not sure why you seem so agitated suddenly. As you know I’m sure, a SOAR is meant for automation. The simple tasks with simple decision making are piped to the SOAR. Additionally there’s a lot of work that goes into the space between “something has alerted” and “this is an incident”. Also, just as an aside, I’m not sure where you’re getting mixed up about SIEM/SOAR?
    - c0pium 3y ago
      I’m loving the eternal September of constantly watching people totally misunderstand the industry. Since you aren’t following the conversation, I’ll break it down for you into smaller chunks. First, most places don’t use SOAR (you can see this in the marketing or sales numbers) as they don’t have the technical maturity or budget to leverage it. Bringing it up is pointless. Most jobs (see any of the usual industry survey results or do some analysis of posted jobs) are basic SOC-monkey positions looking at a SIEM (as I previously said) and doing basic research and response. Get alert, google signature, update ticket, interview user, remediate/slick the box, repeat. Throw in complaining about the lack of tooling to make their lives better, a good bit about how the desktop/server/dev team should really work on standardization so everything isn’t a one-off and you have most person-days at most f1000 shops.
      - ofjcihen 3y ago
        From what you’re saying it sounds like we just have different experiences. The companies I’ve worked for have respect for security and invest heavily in it. Before the days of SOARs we made an effort to script our own automation using Python/Bash/etc. But to your point, these companies that you work for that don’t invest in security and instead use outdated methods: why would they suddenly pay what I assume would be top dollar for AI when they’ve gotten along fine using ticket monkeys so far? Seems like they would continue while the far more efficient ones that take advantage of things like SOARs and already have those positions at a bare minimum would be the ones to invest the money.

by c0pium 3y ago

ofjcihen 3y ago

No, what you’re describing is what gets filtered to the people in charge of the SOAR who then automate those outcomes. Even with the top tools and detection you still absolutely need knowledgeable people to decide whether an alert is a false or true positive and then you absolutely need humans in the mix to decide what the next steps are. When you say “most security jobs” maybe you mean first tier SOC for a vendor? But I’ve never worked for one and as far as I know they’re universally seen as just above useless by anyone without a financial incentive to employ them.

c0pium 3y ago
So you think that you know a lot about security but not only do you not know the difference between SIEM and SOAR you think that most security jobs aren’t dealing with incidents? Fascinating. It’s not an uncommon problem though I guess, I’ve worked with a lot of people who think they’re doing novel work discovering that you can use regex to find spam or inventing a DGA detector.
- ofjcihen 3y ago
  I’m not sure why you seem so agitated suddenly. As you know I’m sure, a SOAR is meant for automation. The simple tasks with simple decision making are piped to the SOAR. Additionally there’s a lot of work that goes into the space between “something has alerted” and “this is an incident”. Also, just as an aside, I’m not sure where you’re getting mixed up about SIEM/SOAR?
  - c0pium 3y ago
    I’m loving the eternal September of constantly watching people totally misunderstand the industry. Since you aren’t following the conversation, I’ll break it down for you into smaller chunks. First, most places don’t use SOAR (you can see this in the marketing or sales numbers) as they don’t have the technical maturity or budget to leverage it. Bringing it up is pointless. Most jobs (see any of the usual industry survey results or do some analysis of posted jobs) are basic SOC-monkey positions looking at a SIEM (as I previously said) and doing basic research and response. Get alert, google signature, update ticket, interview user, remediate/slick the box, repeat. Throw in complaining about the lack of tooling to make their lives better, a good bit about how the desktop/server/dev team should really work on standardization so everything isn’t a one-off and you have most person-days at most f1000 shops.
    - ofjcihen 3y ago
      From what you’re saying it sounds like we just have different experiences. The companies I’ve worked for have respect for security and invest heavily in it. Before the days of SOARs we made an effort to script our own automation using Python/Bash/etc. But to your point, these companies that you work for that don’t invest in security and instead use outdated methods: why would they suddenly pay what I assume would be top dollar for AI when they’ve gotten along fine using ticket monkeys so far? Seems like they would continue while the far more efficient ones that take advantage of things like SOARs and already have those positions at a bare minimum would be the ones to invest the money.