The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

42

IT in general, IT security in particular, is an area where you should always learn. When you do not want to learn any further, then it is time to retire. Therefore, you should already be eager to learn TCP/IP, and your question should be: "do I learn TCP/IP first, or is there something more urgent ?" Knowing the internals of TCP/IP is an invaluable tool for ...


35

My 2cents here: While not technically illegal these companies have managed to develop malware and exploits, without anyone bugging them, because they sell them to governments, law enforcement agencies, secret services, organizations and, in case of some of the companies, to anyone else interested. Such companies include: VUpen Paladion More information ...


33

I can't comment on the actual job scene, but I do know a bit about the statistics of cybercrime. In terms of financial gain, the stats are quite interesting. In terms of profit, the top three are as follows: Pay-per-click advertising fraud - Wasn't so much of a profit-maker until recently, but blackhats seem to have focused on this method more intensely ...


26

There is no defined blueprint on what is the best language to learn. Therefor I would like to mention two good alternatives that I (and many otheres) think is a good languages to learn in computer security. LUA Explanation of Lua from wikipedia: Lua is a lightweight multi-paradigm programming language designed as a scripting language with "extensible ...


15

In my experience these are my following observations: Should it revolve around the ability to verbally explain attacks at a non-technical\technical level? Yes. Absolutely it should involve a technical level. Non-technical explainations are a bonus, you will, as a pen-tester be involved in meetings with people who know nothing about what you're doing ...


14

One option not mentioned here is espionage. Patriotism or corporate funding could be part of the reason you might end up in espionage. Corporate As a espionage contract worker you could charge a pretty high fee for doing any of a number of different black hat operations. Stealing, corporate information (design plans, blackmail, corrupting data, stealing ...


13

A Little Background Penetration testing probably feels like the sexiest part of security, but it is also a very small part. It's also exceptionally broad. The term "penetration test" is often used as an umbrella to mean any one of the following: Vulnerability Assessment Security Assessment Security Audit Penetration Test Social Engineering It could be ...


13

A penetration tester's job is to demonstrate and document a flaw in security. In a normal situation, a pen tester will perform reconnaissance to find some vulnerabilities, exploit those vulnerabilities to gain access, then possibly extract some small piece of data of value to prove that the system is not secure. The piece of data is often a part of the ...


12

The term cyber-security is large enough to represent many different sub-fields. As in many fields, there are theoretical approaches and more practical ones. For instance, I now work at the Center for Cybercrime and Computer Security, and within the same place, there are people working on cryptographic protocols (quite theoretical/maths), people working on ...


10

Welcome @AlanSimonin; good question. Another parallel question to this, on my way of thinking, is to ask: "What kind of jobs in IT Security are there?". Honestly I could not tell you all, but my approach to entering the industry (I am at an entry level too) was: I tried to find out what types of jobs there were at an entry level and compare/contrast them ...


10

There's no strict definition, and some organisations or recruiters will interchange the terms arbitrarily. Generally speaking, a security analyst will work more on the attack side, performing penetration tests and identifying security issues. A security engineer will work more on the defence side, building secure systems and resolving security incidents. ...


9

Anything in the consultancy side of the field will leave you at home some percent of the time. That favors jobs such as security audits/assessments, penetration testing, or security design work. When consulting, you'll spend some percent of your time at the client site and some amount of time in you home office. The trade-off is that travel to the client ...


9

Some parts of network security involve fiddling with the small details of TCP/IP packets as they are sent and received; to do that, you need to be able to intercept packets at a low level, and emit handcrafted packets as well (under Linux, for instance, this is known as using a SOCK_RAW socket). Not all programming languages provide usable API for that; ...


9

There is not that sort of connection between programming languages and security, what might be a better way of looking at it is to learn common languages (so java would be a reasonable starting point) as all languages have security problems - you might as well look at security problems on a wide range of web applications and platforms rather than something ...


9

To become a security researcher (or any kind of researcher) you choose a security topic and master it. Learn everything about this topic, and if you explore this topic far enough will find something new. To get a job as a penetration tester you need to prove that you can in fact break software. How I did this was by obtaining CVE numbers and putting that ...


9

A security researcher does research, and that's a wide term. One side of research is academics. Go to a university, study, study more, do a PhD, and voila! you are a researcher. Academic studies are, well, academic, which means that they are not necessarily practical; but knowing how to do research means that you know how to learn, and you can then catch on ...


9

Generally speaking, to be a good pentester you have to master some of the skills that are required to be a good programmer. Solid development experience about possible programming mistakes is very helpful, because a lot of pentesting is about finding corner cases that the programmer did not think of -- i.e., bugs. This goes both way: a good developer should ...


8

Security engineer in a broad spectrum defines several responsibilities and roles.To have a bird's eye view there are several categories that exists.It can be broadly classified as developers-one who develop security tools and analysts-who use these security tools to measure security. Cryptography:It is involved with writing cool algorithms that has to do ...


8

"Cybersecurity" is both an awfully hyped term, and a very large field. One part of IT Security is on the construction side of things; you design system architectures in order to fulfill some security characteristics. For that you have to understand what attacks do and how they work; being able to actually run them is not that important (i.e. knowing what a ...


7

Note: I realized this is very biased towards systems and away from generic security. Security is a process and involves more than technology. There are two routes you can choose from and unfortunately (IMHO) neither include Java. C is a very good systems language. You can work with unix and linux and dig down close to the metal -- system calls, kernel ...


7

Like NlightNFotis's answer, there are a number of companies writing legal malware for governments, which are vendors at the ISS World Training. I documented them here: http://0xdabbad00.com/2011/12/10/legal-malware/


7

The term 'analyst' is a very, very broad term that can cover very basic and very advanced tasks. In short, there is no way for us to tell you what you will be doing or how to prepare for it. Your company and your boss will define your responsibilities and job description. Also, the term "Information Security" is a very broad term. It could cover secure ...


7

Many people, including many security professionals, see security in binary terms: we are either secure or we are not. This is a ludicrous perspective from all sides. Security is about understanding, measuring, and managing risk. To put this in terms of your proposed lens of 'success': Have we been unsurprised by a threat and the impact that materialised? ...


6

You really can't learn languages in order to learn security. Most security problems are much more subtle than that. The one exception to this is SQL queries: at some point, you really need to understand the difference between combining strings and parameterized queries. But SQL queries are built using another language, whether Java, PHP, Ruby, and so forth. ...


6

I would imagine most of the money would be in organized crime rings, operating botnets to distribute malware. From there they can attack individual bank customers to steal money or setup mule accounts. They could also rent out their botnets to others do to distributing computing. Probably a lot of spyware is still out there, maybe you inject your affiliate ...


6

Very deep? Assuming that means reading and understanding the entire RFC then no. What you need to understand in IT security is what happens to data end to end from when it is accessed by an application, to being transmitted over a network or the internet, to when it is re-assembled and used by an application on another system wherever that is in the world. ...


6

When a company hires someone, it is the company which takes a risk. The employee might turn out to be a lamer. If the company is so ELITE then they already know it. If they want to hire you then it is their problem. If you choose to specialize in an area which, one day, goes out of fashion, then you'll have to learn a new craft. Or simply shrivel up and die....


6

The only situation where such a citizenship requirement would typically apply was if the SE position was with a Federal Government contractor, and the position required a USG security clearance. Since those are granted to US citizens, a non-US citizen would be ineligible for it. That being said, in the private sector, I know of no such requirement, other ...


6

As a developer of 15 years who has moved into a pen-test role, I can say that yes there are many transferable skills, some of which will put you at and advantage to testers who came from a pure security background. Firstly and foremostly you understand the developer mindset, this means that you probably understand why a developer chose a particular ...


Only top voted, non community-wiki answers of a minimum length are eligible