3 ms·

Doing social engineering / penetration testing for a living sounds like a great gig. I've been day dreaming about working for or starting a company like that. D

Doing social engineering / penetration testing for a living sounds like a great gig. I've been day dreaming about working for or starting a company like that. Didn't realize it was a booming industry for companies that also do physical penetration which is normally going to be the weakest link.

babuskov 12y ago
Depends on your definition of "great". If you are really good at it there are a lot of things that might give you prolonged periods of stress. I'd pick a comparatively more boring career any time. Things that can happen: - you manage to break some stuff during pen test that nobody expects and learn things that make you become a liability for that company - you might learn some things about company whose stock price can drasticaly change and you will need to answer questions to SEC (or a similar institiution) - if you are really good, it's quite possible that government agencies will try to recruit you, and if you say YES, it's a one way street. - you may learn some things about world you wish you never learned about, and you wouldn't be able to watch the world with the same eyes ever again - even if you wish you could
- sporkenfang 12y ago
  > if you are really good, it's quite possible that government agencies will try to recruit you, and if you say YES, it's a one way street. This is the most terrifying item on your list. Saying no, however, is generally the best way to avoid such a one-way street ;)
  - bitexploder 12y ago
    It really isn't a one way street. People of people come from TLA and go on to work in the private industry as information security consultants. I have many friends that have taken this path.
    - sporkenfang 12y ago
      Yup. In fact, that's more or less what I have done. I think by one-way street OP meant foreign governments as opposed to U.S. governments, though.
- quesera 12y ago
  Those are all implausible movie plot scenarios. When a TLA offers you a job, or a contract, you can decline. There are no hard feelings.
- bitexploder 12y ago
  I have been doing this for 8 years. I have found plenty of things like that and none of those scenarios have come up. I have compromised very large organizations as deeply as you can imagine, easily covering things that would permit insider trading etc. The truth is we operate at the highest levels of discretion and it just isn't an issue. The SEC is very far from my radar, and, like anyone else with privileged knowledge about things a company might due that would impact their stock price, you just don't act on it. It really isn't hard to avoid. Government agencies will not beat down your door, but they will definitely hire you if you have the right skills. It isn't a one way street, though you can encumber yourself. (For reference, look at famous guys like Charlie Miller, who came from the NSA). You don't learn one thing about the world. You learn how brittle software is and how terribly insecure most things are. And along the way, if you let it, this can make you a bit cynical. Breaking software becomes like breaking a child's toy in many cases. It is still a lot of fun to break things.
bitexploder 12y ago
I run a small information security consulting shop. I went from full time software developer to information security consultant about 8 years ago and I have not looked back. Consulting in particular is very challenging, and fun. We don't focus as much on physical penetration testing, but if it has bits, we will assess it and break it. Good software developers make the best information security consultants. I have conducted a couple of physical pen tests. It is a mixed bag. It is more liberating in some ways than banging bits, but it is also a little more boring for me. It is almost too easy once you get down to it, there isn't a lot of challenge in it like banging bits with big rocks :) (We are also, almost always, interviewing people for jobs as consultants, if you are really interested).
- darrelld 12y ago
  Actually...I really am interested. It's kinda been echoing around my head all day. Do you have an email address I can ping you at?

babuskov 12y ago

Depends on your definition of "great". If you are really good at it there are a lot of things that might give you prolonged periods of stress. I'd pick a comparatively more boring career any time. Things that can happen: - you manage to break some stuff during pen test that nobody expects and learn things that make you become a liability for that company - you might learn some things about company whose stock price can drasticaly change and you will need to answer questions to SEC (or a similar institiution) - if you are really good, it's quite possible that government agencies will try to recruit you, and if you say YES, it's a one way street. - you may learn some things about world you wish you never learned about, and you wouldn't be able to watch the world with the same eyes ever again - even if you wish you could

sporkenfang 12y ago
> if you are really good, it's quite possible that government agencies will try to recruit you, and if you say YES, it's a one way street. This is the most terrifying item on your list. Saying no, however, is generally the best way to avoid such a one-way street ;)
- bitexploder 12y ago
  It really isn't a one way street. People of people come from TLA and go on to work in the private industry as information security consultants. I have many friends that have taken this path.
  - sporkenfang 12y ago
    Yup. In fact, that's more or less what I have done. I think by one-way street OP meant foreign governments as opposed to U.S. governments, though.
quesera 12y ago
Those are all implausible movie plot scenarios. When a TLA offers you a job, or a contract, you can decline. There are no hard feelings.
bitexploder 12y ago
I have been doing this for 8 years. I have found plenty of things like that and none of those scenarios have come up. I have compromised very large organizations as deeply as you can imagine, easily covering things that would permit insider trading etc. The truth is we operate at the highest levels of discretion and it just isn't an issue. The SEC is very far from my radar, and, like anyone else with privileged knowledge about things a company might due that would impact their stock price, you just don't act on it. It really isn't hard to avoid. Government agencies will not beat down your door, but they will definitely hire you if you have the right skills. It isn't a one way street, though you can encumber yourself. (For reference, look at famous guys like Charlie Miller, who came from the NSA). You don't learn one thing about the world. You learn how brittle software is and how terribly insecure most things are. And along the way, if you let it, this can make you a bit cynical. Breaking software becomes like breaking a child's toy in many cases. It is still a lot of fun to break things.

bitexploder 12y ago

I run a small information security consulting shop. I went from full time software developer to information security consultant about 8 years ago and I have not looked back. Consulting in particular is very challenging, and fun. We don't focus as much on physical penetration testing, but if it has bits, we will assess it and break it. Good software developers make the best information security consultants. I have conducted a couple of physical pen tests. It is a mixed bag. It is more liberating in some ways than banging bits, but it is also a little more boring for me. It is almost too easy once you get down to it, there isn't a lot of challenge in it like banging bits with big rocks :) (We are also, almost always, interviewing people for jobs as consultants, if you are really interested).

darrelld 12y ago
Actually...I really am interested. It's kinda been echoing around my head all day. Do you have an email address I can ping you at?