4 ms·

> Folks who work at NSA (and all the other places that don't get so much press) read xkcd religiously, they go to DEF CON, they have Linux and math t-shirts, th

by Kalium 12y ago

> Folks who work at NSA (and all the other places that don't get so much press) read xkcd religiously, they go to DEF CON, they have Linux and math t-shirts, they read HN, they are reading this thread right now, and all the other threads. I know some. I called them coworker and in some cases still call them friend. A feel sorry for a great many of them. They are highly skilled network attack specialists, with basically no way to apply their skills other than working for the NSA. Even if they want out, they have no viable alternative. It's terrible.

totalrobe 12y ago
Pen testing not a viable alternative?
- Kalium 12y ago
  Pen testing is a viable alternative in the same way that driving a car is an alternative to designing an engine. When your specialty is in finding novel exploits, there's not much of a market for you outside the government-o-sphere. In practical terms, pen tests are typically not focused on finding novel exploits. Nevermind the vast difference in career expectations between salaried government work and consulting.
  - totalrobe 12y ago
    That is a good point. Ex military often have trouble finding jobs that match their skillsets as well. Not many civilian jobs encourage you to annihilate the denizens of under-developed, resource rich regions.
    - Kalium 12y ago
      There's actually quite a lot of value in finding and fixing exploits. It's just that many companies prefer the illusion that $1k is a reasonable bounty for SQLi.
- count 12y ago
  In the same way that being a local cop is an alternative to being in the Special Forces.
tikums 12y ago
> They are highly skilled network attack specialists, with basically no way to apply their skills other than working for the NSA. Why is commercial "cyber" security industry not a viable option? It pays well, there's currently a notable skill shortage and they can work in "pen-testing", "red teaming" and "exploit development" areas.
- Kalium 12y ago
  I will copy/paste from the other answer I gave to this same question: > Pen testing is a viable alternative in the same way that driving a car is an alternative to designing an engine. "Red teaming" is little different. Further, much of the commercial world is thinly veiled NSA work. Who do you think the biggest clients of Reversing Labs, for instance, are? They're not just any commercial firms. They're commercial firms providing services to the NSA. Bug bounties and HackerOne are sick jokes compared to what governments pay.
  - tikums 12y ago
    > much of the commercial world is thinly veiled NSA work While security agencies of various governments are on the buy-side on the "zero day" vulnerability market, majority of commercial "cyber" security companies are not dealing in "cyber weapons" and are not involved with NSA. There are plentiful examples of successful "white hats": H. D. Moore, Dan Kaminsky, Tavis Ormandy, Michał Zalewski, even our own Colin Percival and tptacek etc. You don't have to do work for government to play in this area.
    - Kalium 12y ago
      It's less of an excuse and more of a statement about the current state of reality. Are there examples and counter-examples and so on? Absolutely. Do any of them change the state of reality by existing? No. Is a very sizable portion of private-sector work today paid for by the NSA, directly or otherwise, including both defensive and offensive capabilities? You bet. As a result, saying people should go to the commercial world isn't actually much of a change. It's not an alternative to the current reality because it is the current reality. It's worth remembering that you probably don't hear about the big players very much in places like this. Endgame, MITRE, Leidos, etc. They tend to stay out of the limelight while still employing substantial numbers of people.
kbenson 12y ago
That seems ripe for the usual government work to consultant career path. Then again, maybe what you're referring to is that their knowledge falls along the lines of state secrets, and pedaling their skills outside the NSA could be considered treason?
- Kalium 12y ago
  Actually, most of the people in question are already well along that career path and working for contracting firms. It's just not a career path that that lets them leave direct or indirect government work. Who, other than a government, is going to pay you well to find vulnerabilities in popular software? Google's Project Zero belongs to the incredibly small set of programs in that area that isn't a joke.
  - kbenson 12y ago
    I read "network attack specialist" as more general than that. I imagine there's a lot of demand for network penetration testing. When it gets down to individual programs, such as email clients, etc, (this is what I think you are implying above) then yes, I agree that it's likely harder to sell the idea of those skills being useful in a consulting context to companies. In that case, I would guess your best path would be to join an established security firm, but I imagine that market is small and highly competitive.
    - Kalium 12y ago
      Oh. I see. Sorry, hash collision. I'm talking about the people who perform tasks like exploit discovery and development. You're talking about the people who take that work and run it in script form. Perhaps a better analogy would be that asking "Why not pen testing?" is like asking why gun designers don't find new jobs as infantry. Established security firms often focus on business with... guess who? Governments. The NSA employing people directly is not really much different from the NSA hiring contractors who employ people directly.
      - 12y ago

by Kalium 12y ago

totalrobe 12y ago

Pen testing not a viable alternative?

Kalium 12y ago
Pen testing is a viable alternative in the same way that driving a car is an alternative to designing an engine. When your specialty is in finding novel exploits, there's not much of a market for you outside the government-o-sphere. In practical terms, pen tests are typically not focused on finding novel exploits. Nevermind the vast difference in career expectations between salaried government work and consulting.
- totalrobe 12y ago
  That is a good point. Ex military often have trouble finding jobs that match their skillsets as well. Not many civilian jobs encourage you to annihilate the denizens of under-developed, resource rich regions.
  - Kalium 12y ago
    There's actually quite a lot of value in finding and fixing exploits. It's just that many companies prefer the illusion that $1k is a reasonable bounty for SQLi.
count 12y ago
In the same way that being a local cop is an alternative to being in the Special Forces.

tikums 12y ago

> They are highly skilled network attack specialists, with basically no way to apply their skills other than working for the NSA. Why is commercial "cyber" security industry not a viable option? It pays well, there's currently a notable skill shortage and they can work in "pen-testing", "red teaming" and "exploit development" areas.

Kalium 12y ago
I will copy/paste from the other answer I gave to this same question: > Pen testing is a viable alternative in the same way that driving a car is an alternative to designing an engine. "Red teaming" is little different. Further, much of the commercial world is thinly veiled NSA work. Who do you think the biggest clients of Reversing Labs, for instance, are? They're not just any commercial firms. They're commercial firms providing services to the NSA. Bug bounties and HackerOne are sick jokes compared to what governments pay.
- tikums 12y ago
  > much of the commercial world is thinly veiled NSA work While security agencies of various governments are on the buy-side on the "zero day" vulnerability market, majority of commercial "cyber" security companies are not dealing in "cyber weapons" and are not involved with NSA. There are plentiful examples of successful "white hats": H. D. Moore, Dan Kaminsky, Tavis Ormandy, Michał Zalewski, even our own Colin Percival and tptacek etc. You don't have to do work for government to play in this area.
  - Kalium 12y ago
    It's less of an excuse and more of a statement about the current state of reality. Are there examples and counter-examples and so on? Absolutely. Do any of them change the state of reality by existing? No. Is a very sizable portion of private-sector work today paid for by the NSA, directly or otherwise, including both defensive and offensive capabilities? You bet. As a result, saying people should go to the commercial world isn't actually much of a change. It's not an alternative to the current reality because it is the current reality. It's worth remembering that you probably don't hear about the big players very much in places like this. Endgame, MITRE, Leidos, etc. They tend to stay out of the limelight while still employing substantial numbers of people.

kbenson 12y ago

That seems ripe for the usual government work to consultant career path. Then again, maybe what you're referring to is that their knowledge falls along the lines of state secrets, and pedaling their skills outside the NSA could be considered treason?

Kalium 12y ago
Actually, most of the people in question are already well along that career path and working for contracting firms. It's just not a career path that that lets them leave direct or indirect government work. Who, other than a government, is going to pay you well to find vulnerabilities in popular software? Google's Project Zero belongs to the incredibly small set of programs in that area that isn't a joke.
- kbenson 12y ago
  I read "network attack specialist" as more general than that. I imagine there's a lot of demand for network penetration testing. When it gets down to individual programs, such as email clients, etc, (this is what I think you are implying above) then yes, I agree that it's likely harder to sell the idea of those skills being useful in a consulting context to companies. In that case, I would guess your best path would be to join an established security firm, but I imagine that market is small and highly competitive.
  - Kalium 12y ago
    Oh. I see. Sorry, hash collision. I'm talking about the people who perform tasks like exploit discovery and development. You're talking about the people who take that work and run it in script form. Perhaps a better analogy would be that asking "Why not pen testing?" is like asking why gun designers don't find new jobs as infantry. Established security firms often focus on business with... guess who? Governments. The NSA employing people directly is not really much different from the NSA hiring contractors who employ people directly.
    - 12y ago