5 ms·

This is why I don't want to work in cyber security. You are dealing with dangerous people.

• dominojab 3y ago
  [dead]
• deleted 3y ago
  [deleted]
• wkat4242 3y ago
  Meh. The same goes for police work and even more so for military. And cyber is a very wide range. A lot of roles are simply about training personnel in security principles and procedures, implementing data classification etc. Not everyone deals directly with attacks. Most of the work is preventative. In our company probably less than 20% of people who technically work in cyber, although that's in part because our SOC is outsourced.
  • nicce 3y ago
    > Most of the work is preventative. Current work culture is bizarre in cyber security. I am not personally very fan of it. Nobody wants to work on defensive side. You are not getting either fame or money if you do your work well. The expectation is that you do your work perfectly. There is no actually measurements in place to prove that your good code prevented 100 data breaches! But on the other hand, if you are on offensive side, sometimes find cool bugs, you get fame and money. Does not matter if there is a long break sometimes. Your goodness is measures based on how much money you got. What does it mean? People start doing bug bounties. They hoard tools only for themselves to make more money, instead of releasing them to improve general security. They keep small bugs themselves so that they can be used in exploit chains to get bigger bounties. If the reputation of the company is based on the participations of the bug bounty program, they start doing less and less in-house engineering and outsource the cyber security testing for bug bounty platforms. And vicious cycle starts.
    • rompledorph 3y ago
      Your view on cyber security seems to be painted by bug bounty programs. But I agree that the offensive side is more sexy than the defensive side, but it easy to forget that in the end, we are all really working on defense
    • saagarjha 3y ago
      Plenty of people working on the defensive side are famous, sometimes even more famous than those who do offensive work. Take, for example, Google Project Zero, or the numerous people on “infosec Twitter” who are almost invariably doing defensive work. People who do exploit development tend to be a lot more quiet about what they do and where they work.
      • kevinbowman 3y ago
        I think Project Zero would count as offensive work in this regard; they are actively trying to find problems in other systems, rather than trying to stop other people trying to find problems in their systems.
        • saagarjha 3y ago
          Project Zero is an offensive team doing defensive work.
          • nicce 3y ago
            But their work is essentially penetration testing and exploit development. That usually counts as offensive side. They are not designing and building secure-by-design stuff, for example. They are known for breaking stuff, and everyone wants to be the same. Goal might be defensive in everything cyber security researchers do, but that was not my point.
      • hashstring 3y ago
        Project Zero is not defensive. Infosec Twitter has both sides. I do agree with you that defense is a large part of the industry. My perspective is even that most organizations are looking for “defense” roles. The field is very wide (e.g., folks working on cryptography to sec ops).
  • snotrockets 3y ago
    Police tends to avoid dealing with dangerous people, unless you mean cops themselves.