Corporate Cybersecurity. Hackers vs Infosecnormies

I work in cybersecurity. I get paid decent money and have a good work-life balance. I recently have become frustrated with the corporate life and started to notice a trend. >>There are 2 types of people in cybersecurity. The hackers and the Infosecnormal people. The hackers are people who made a career out of having a genuine passion for computers and a curiosity for finding flaws or how things work. >>Comfortable in Linux. Use it outside of work >>Career and Hobbies are a blur, hard to tell them apart. >>Constantly learning, without doing it for "career reasons" >>Interest in FOSS, Research or privacy in general. >>Alt accounts to continue their community involvement outside eyes of their employers >>Involved in security groups or meetups >>Has gone to local hackergroups >>Owns multiple raspberry pis, used them for more than emulating games >>Weekends filled with side projects which to outsiders look like work The Infosecnormal people are the perfect corporate employee. They have made a career out of infosec because "the pay is good". >>Will not learn for sake of learning. Must be spoonfed. >>Certs are important. Sees the value of credentials over skill. >>No time spent outside of work hours on improving their skills. >>Unless it is for a cert. That they need. For their new job. >>Has never gone to a local meetup unless a corporate happy hour. >>Consumer tech on all their personal devices. >>Owns no soldering iron. I love being on keyboard but corporate culture does not feel compatible with hacking culture. The hacker types do not move up inside of corporate environments. They eventually get bored and move elsewhere. The following issues I have seen in corporate culture. It is detrimental to retaining talent and creates a bloated vertical of non technical managers and Infosecnormal people. >>Managerial roles are filled by Infosecnormal people >>Lacking technical skill Infosecnormal people are impressed by non technical products like reports and processes. >>Infosecnormal people managers give visibility to other Infosecnormal people. They showcase projects like latest meetings or non technical initiative. >>Infosecnormal people manager promotes other Infosecnormal people to help drive more Infosecnormal people initiatives. >>Infosecnormal people manager considers technical work a distraction from Infosecnormal people initiatives. >>Infosecnormal people advocate all corporate speak woke modern buzzwords. Diversity, inclusion and equity get mentioned more than technical terms. >>Infosecnormal people think in terms of frameworks. They memorize mitre numbers to throw up during presentations. Rely on cheatsheets printed on their desk for the steps in the killchain. >>Infosecnormal people overcompensate from their lack of technical knowledge by padding requirements on all projects with a focus on collaboration and reports. The moment big money was offered was the moment that the space was saturated by Infosecnormal people. There has been an acceleration of normal personness in infosec that has made it hard to enjoy. >>Hackercons are soy >>Infosecnormal people are watering down the talent pool. >>HRstacies can't tell apart hackers vs Infosecnormal people >>Infosecnormal people lack paranoia. Not schizo tier but basic security worries that comes with working in the field. >>Community centered around corporate sponsors. You leave you leave the community. >>Infosecnormal people managers focused on metrics which are extremely abstracted from value adding activities. >>Infosecnormal people view R&D as time wasting Anybody else frustrated with the state of infosec/corporate life ? What is the solution? Freelancing or starting your own company? I already spend a ton of my free time doing all the building / hacking I can. But it no longer fulfills me. I am starting to feel dread with my professional life. I want to hack and it is starting to turn into meetings and reports all day. Corporations hire you for your expertise but end up promoting for your non related skills. Any anons feel the same?

If infosecnormal people are so incompetent and lacking technical experience, then you should prey on them and their projects. There are three immediate benefits to this, pick which ones you like the most. >potential monetary gain from illegal activity >ruining reputation of the infosecnormal people >having evidence of infosecnormal person incompetence to show upper manageent

>>19596 I just recently started further getting into hacking and cybersec overall, just out of a general want to get into it and I have another friend who took a whole college course on it This said friend has zero interest in it and comes across as if he wanted it purely for a job, in the time I spent learning about these things, he was impressed with how much I knew from studying I'm still a fool, but idk, it surprises me I'm already like learning things like this just out of personal interest while he went to college for 4 years in cybersec

Your right op over the last 10 years hacking culture has changed into a corpo powerhour where all the fun and culture has been drained defcon has basically become blackhat that constantly invites feds. Even my local meet ups are just corporate meetings and "building connections", instead of people who are pushing the boundaries and doing fun and new things.

>>19596 You're kinda right with your issues with infosecnormal people, their incompetence with actual security and technology lead to most modern day leaks.

>>19596 Do u think about to be on black hat side? Or its no benefits? Because no much money, fed can catch u etc

>>19606 Very good blackhat groups act as a business too, I believe as all techies instead of normal people, but with very malicious intent and hostage recruitment.

You have only brought up problems, no solutions. You still have a lot to learn.

>>19598 On paper, fall under the cybersecnormey category. But technically my job does not involve cybersec at all. In fact, I got a bunch of cybersec certs so I could make money, but then I realized I didn't want to do anything in the field, so I used it on a resume to get a decent job managing inventory and finances for an IT department. I actually dislike IT for what it's worth, and I don't really care about computers or hacking as a hobby. On the other hand, I am way overqualified given my current position (Finance and business management). Unfortunately that means that a great deal of my job is covering for the incompetent cybersec people at my company. At this point, I am the reason that multiple hacks have been averted, and I don't even get paid to do the job. I just figure out what to do when the office wageslaves spill starbucks or soidrink on their computers. Most of my coworkers are old school hackers too, and one of them started autistically screeching at one of the new IT hires because they were creating so many risks to the company. If you think things are bad in the cybersec world, just think about how bad things are in the normal white collar world. I have already gotten a few ITs fired for throwing hard drives with confidential data into the trash, really amazes me what these idiots "learn" these days. If any of you have control of HR and hiring, I would recommend screening people to make sure they actually know what they are doing, maybe even set up a qualification process internally to make sure people can do their jobs. Some companies require continued education in the field to make sure they keep getting better.

>>19610 The real issue is that people that do know their job don't have control over hiring. Even smaller yet, they don't have control over projects in their companies. So what happens? Overzealous managers that don't know what is happening or how to change things for the better make life miserable for those that actually want to work, they lose initiative and desire to work (at least on the job) and then company flops over because they hire normíes whom they will "teach".

>>19596 You can generalize this. There are the people who aspire and work towards mastery of their craft, and the majority that just want to follow orders and hang out with friends on the weekend.

>>19610 HR is inherently incompetent. People with no technical skills are tasked with judging the technical skills of people who are usually smarter than them. You'd probably stand a better chance of having some basic heuristic and flipping coins. OP sounds quite asocial. At the end of the day, you are working with people, not twining cord; your output does not stand on its own, it only matters in relation to people. Our infosec guys are a great bunch. I think they see the huge issues with the situations of how hard we're being tracked and our privacy invaded, but conceded that there is little one can do without sacrificing things that may impact their bottom line. If you are having bad connections at a job, that's never a bad reason for leaving it. We're genetically identical to tribal cavemen - if your tribe isn't with you, you need to fix that.

>>19596 Why does anyone give a fuarrrk what the twitter "hacker" normans are doing? Just do cool soykaf, that's the whole point. >>19609 /thread

>>19596 Hello. I am the non-hacker normal. >need job out of college >apply for 3 months straight to development jobs >recruiter gets me an interview at big cyber security company >actually manage to get the job despite having zero practical haxoring experience >as in, didn't even know what most vulnerabilities were >learn on the job >other employees are hardcore haxors that are consistently honing their skills with things like Hack The Box, Try Hack Me, etc >constantly asks if I want to join a CTF team with them >often discuss different things in the cybersec sphere >Spend nearly all their time hacking or learning for hacking I am here because I was having a lot of trouble getting a development job. I can learn the material and do the work well, but have almost zero interest in hacking outside of how it would benefit my work. I do not join the CTF team because I would much rather be focusing on my own personal projects and improving my skill in programming. I have found this job to be very educational, as I have learned how to use various tools that I had not touched before. It has also given me a great view into how I can frame my programming in the future to avoid these vulnerabilities. Like most jobs, a majority of info sec jobs do not require masters of their craft. Programming is the same. I respect you for attempting to become a master of your craft, but you must understand that people have things they are pursuing. I believe that starting your own business/group would be beneficial to you valuing skill over all else. Looking into the inner workings of my company, individuals are highlighted for their skill, but not promoted. Certain individuals have been highlighted both inside and out of the company recently, yet they stayed in the same position making the same pay.

A major(?) issue is that most really advanced skills are locked behind a cert tree, and there's a certain gatekeeping/i-paid-for-this-so-you-should-too culture around maybe post-CISSP cert knowledge, and most learning resources are more interested in marketing themselves as anonamoose mr robot for a 15 minute video than in actually teaching (instead of showing). I often compare this to the "LEO/MIL ONLY" tag on shooting courses. Anything actually useful is locked away. I guess ""infosec"" stuff is more accesible because you can pony up the 6k for the certs you need and just grab the materials, instead of having to bend backwards with sketchy contractors to get cqb training.

>>19598 I agree that the lack of proper skills in the field are a huge opportunity for getting ahead in the space. Going fully independent might be the right play for me. There seems to be more money in being a contractor than there is in traditional employee hires. I am under the impression that upper management usually gets to be upper management because they did very well for themselves on the non technical portions of their job. This makes them hyper-focus on the parts they understand, which is the non technical parts of the job. >>having evidence of infosecnormal person incompetence to show upper manageent This would have to be covert, as overt evidence would be seen as being a negative team player. >>19599 >I'm still a fool, but idk, it surprises me I'm already like learning things like this just out of personal interest while he went to college for 4 years in cybersec There is a lot of highly paid infosec professionals in the field who would feel very uncomfortable setting up their own linux server. The amount of practical know how is very limited to a specific scope that is filled with industry jargon to mask their lack of knowledge. >>19600 >over the last 10 years hacking culture has changed into a corpo powerhour This part kills me. It was acceptable when I first started as there was still plenty of cool people in the field. Now corporate culture has fully domesticated the security teams to nothing more than npcs who go against the point of having the security team in the first place. Defcon felt very cringe the last time I went. What was at one point group that regarded free speech has become a overly sensitive safe space of corporate commercialization with a cool HR friendly hacker aesthetic. >>19601 >You're kinda right with your issues with infosecnormal people, their incompetence with actual security and technology lead to most modern day leaks. I've beat my head against the wall explaining threats that happen in the wild, but management considers it a waste of time. They focus on threat modeling with MITRE to the point we miss very obvious gaps that would be obvious if they zoomed out and understood the big picture. If it isn't a technique on that list good luck having it modeled. >>19606 >Do u think about to be on black hat side? Or its no benefits? Because no much money, fed can catch u etc Too much added paranoia for not much more $$$ than a 9-5 offers when discounted for risk you are taking. The big players make a lot, but there is a ton more of low end skiddies playing fraud games which I would have a moral problem with. The real sick part is the amount of overlap between covert gov ops and blackhat. I would also have moral issues with that. Working for the glowies is like working for a crime family. You do fuarrrked up soykaf and can't really ever leave. >>19608 >I believe as all techies instead of normal people Some of the threat actors have really weird hierarchies full of incompetent people. I've seen a lot of them sound even more ridiculous than the people detecting them in corporations. There are a lot of groups using affiliates, which end up being the fall guy for when the op gets busted. Many of the initial access of these big groups is paying for access from disgruntled employees or social engineering a victim to run a payload. There are so many low hanging fruits in the world that it is very easy for many actors to find some target. I don't mind the side I play but I do enjoy being on keyboard more than the company politics than it is helping them secure soykaf. I hit roadblocks pushing initiatives as it seems like I am rocking the boat. >>19609 >You have only brought up problems, no solutions. 1 - Hop to different companies to keep getting the lateral promotion. Repeat before the momentum is lost. 2- Create own company. Grind it out getting initial contracts. Leverage highly technical skills into higher pay as a contractor than an employee. >>19610 >If you think things are bad in the cybersec world, just think about how bad things are in the normal white collar world I cringe how often many small businesses open macro enabled docs from unknown people. >>19610 >I would recommend screening people to make sure they actually know what they are doing, maybe even set up a qualification process internally to make sure people can do their job Usually they require a technical interview which helps weed out the people who don't know anything in the space. The problem is eventually there is enough NPCs in the company that the interviews are conducted by NPC who see NPC traits as a good thing. Most of the questions are easily memorized and can be gamed to get hired in most places. It isn't like they give you a list of ips and tell you you have 24 hours to come back with findings.

>>19611 >The real issue is that people that do know their job don't have control over hiring. Even smaller yet, they don't have control over projects in their companies. So what happens? Overzealous managers that don't know what is happening or how to change things for the better make life miserable for those that actually want to work, they lose initiative and desire to work (at least on the job) and then company flops over because they hire normíes whom they will "teach". You have described my biggest disillusionment in my corporate position. Management is unbearable and seems to reward the most mundane work while stopping any valuable initiative. There is an obsession with metrics since it helps them justify themselves to higher ups. Problem is the metrics are inherently a bunch of wasted effort on non value adding work. The normal people love those type of projects as it lets them turn basic findings into an hour long meeting with redundant reports and support tickets cut. This bloat then looks like "productivity" to the managers. Drives me crazy. There has to be a way to short circuit those type of managers right? How can so much of the work be bloat? >>19617 >You can generalize this. There are the people who aspire and work towards mastery of their craft, and the majority that just want to follow orders and hang out with friends on the weekend. I agree that that is a super high level view. But I think within the security field there has been a massive shift in the culture. Many specialty security teams always existed as small group isolated from the corporate culture. Those too close to the culture won't find the issues in it. There has been a watering down of the talent pool, those people quickly moved up. Before long most of the leadership roles were filled by incompetent cybersecurity people. They shape the organization around a focus on non value adding activities while punishing anybody who doesn't fall in line. This ends up pushing away good talent and recruiting bad talent. >>19621 >Why does anyone give a fuarrrk what the twitter "hacker" normans are doing? Just do cool soykaf, that's the whole point. Because good paying jobs where I contributed my skillset towards improving the security of a big company quickly turn into a terrible work environment where I spend more time in meetings than I do in a terminal. This is a problem with corporate culture but it destroys divisions and forces you to look elsewhere. I am not disagreeing with your point of building cool soykaf outside of the normal people. But there also should be a decent place to leverage skills for a decent career. This is the part I was trying to solve. Corporate culture enabling bad managers to destroy teams and creating an exodus in talent.

>>19622 >I believe that starting your own business/group would be beneficial to you valuing skill over all else. Looking into the inner workings of my company, individuals are highlighted for their skill, but not promoted. Certain individuals have been highlighted both inside and out of the company recently, yet they stayed in the same position making the same pay. The promotion scheme seems to favor the managing skills rather than the technical initiatives. I think you have a point and I am starting to think I need to look to a future where I go on my own since I can specialize and get paid more directly for my expertise than as a corporate role. >>19622 >Like most jobs, a majority of info sec jobs do not require masters of their craft. Programming is the same. I respect you for attempting to become a master of your craft, but you must understand that people have things they are pursuing. I agree a lot of roles don't require a masters of craft. I don't want to doxx myself too much but my role is a very technical one that requires some very in depth knowledge about a lot of different aspects of hacking. It usually relies on being able to show results as an attacker. The problem is that corporate rating of what success or failure is varies on manager. Imagine finding a bunch of critical findings one day and your manager gives you great scores. Then a new manager comes along, now looking for findings is now a "waste of time". The focus become number of tests ran. It is a quantifiable number but it missed the point completely. >>19622 >I am here because I was having a lot of trouble getting a development job. I can learn the material and do the work well, but have almost zero interest in hacking outside of how it would benefit my work. I do not join the CTF team because I would much rather be focusing on my own personal projects and improving my skill in programming. Your passion might not be in hacking, but you certainly seem to be motivated in being a better developer. You are still progressing at improving you skill and I hope that you keep getting better and better. This is not a bad strategy to help get you were you want to go. >>19622 >Hello. I am the non-hacker normal. But you are on lainchan. I am sure no other coworker in my last 3 companies even knows about this place. I think you are correct that I should pursue my own business. I have been contemplating it for a long time and it makes the most sense. My professional career in a corporate landscape might be better as a contractor. Then I am more in control of my future. >>19623 >A major(?) issue is that most really advanced skills are locked behind a cert tree, and there's a certain gatekeeping/i-paid-for-this-so-you-should-too culture around maybe post-CISSP cert knowledge, and most learning resources are more interested in marketing themselves as anonamoose mr robot for a 15 minute video than in actually teaching (instead of showing). The training side is sometimes super strange. The certs for a lot of stuff feel very impractical. I have known people in the field who try and get every cert under the sun. Their actual ability was like 0 outside of a lab environment. Some of the trainings are outdated and are very expensive. It is a bit prohibitive and tends to just be purchased as a corporate expense. There are some good trainings I've had but it has been big corporations setting it up and paying for it. Most of my "training" happens on my own time in my own lab. The hardest part is access to the EDR that is used in some of the bigger environments. >>19623 > guess ""infosec"" stuff is more accesible because you can pony up the 6k for the certs you need and just grab the materials The hardest part is getting your foot in the door. I've seen many people move around without many certs. I think the only people who keep emphasizing certs are the people who don't have a lot of confidence in their skillset. That and HR, they love to ask about certs since they are trying to qualify someone on a skillset they know nothing about. >>19623 >I often compare this to the "LEO/MIL ONLY" tag on shooting courses. Anything actually useful is locked away. I am curious about these type of courses. Do they not allow non LEO/MIL to take certain tactical shooting courses? I know some "hacking tools" creators worry about being liable for their tools being used in the field. (Think about cobalt strike being used by ransomware gangs for example)

>>19627 >Because good paying jobs where I contributed my skillset towards improving the security of a big company quickly turn into a terrible work environment where I spend more time in meetings than I do in a terminal. This is a problem with corporate culture but it destroys divisions and forces you to look elsewhere. >I am not disagreeing with your point of building cool soykaf outside of the normal people. But there also should be a decent place to leverage skills for a decent career. This is the part I was trying to solve. Corporate culture enabling bad managers to destroy teams and creating an exodus in talent. Very good points. We have to make a living, after all. >I spend more time in meetings than I do in a terminal fuarrrk I feel this. >Corporate culture enabling bad managers to destroy teams and creating an exodus in talent. Pick any major consultancy and I know someone who can attest to this happening there.

>>19628 >I am curious about these type of courses. Do they not allow non LEO/MIL to take certain tactical shooting courses? I haven't seen it for training in a long time. Certain types of shooting certs are locked behind police academy attendence (but in most cases, those certs are only useful if you intend on being a cop), but you can find tactical rifle and move and shoot training everywhere. Between private security and IPSC type customers, there's a lot of providers who offer tactical courses to the public, though, so it's not as common to see LEO-only anymore, at least for training. where you really see it is with product vendors. stuff like simunition, for example, is not sold by the vendor to non LEO customers, but it's not usually a problem.

>why is life not like my movies where I am invited into a group of talented people possessing unique knowledge where everyone cares about their job despite being put in a meat grinder of a public space corporate machine (apparently everyone must mix their passion with their employment) >why is my purely corporate field that is entirely based on scam certification issued by the same corporations is so corporate >why do people not care about their corporation's profits and are not truly passionate to make a corporation even more powerful and rich (finds out some people want to grind and retire) >why is corporate environment turning people into petty (a)pathetic drones (Pandora's box of a question) >why is corporate environment so cyberhumped and full of leeches (add this one to the Pandora's box) >why do managers fight for their position by killing competition from below (you could only wonder) >why does life work that way that the actual soykaf gets done by using communication skills and likability and not just pure solo l33t haxxor skillz (finds out pure talent is useless when you smell and turn people off) OP post smells penises and that aura of a "20-something year old junior developer". The solution is quite simple. That you have a passion is a good thing. Now stop thinking that your company and the society are your friends or are part of your family, or someone who should care/be taken care of, and that they are required to behave exactly the way that you think they must. When you are put in a place full of drones, retards and "space fillers" that are there just to exist with few skilled people it means exactly that. World is a mean place that does not conform to your expectations of the reality and will break your spine just as you decide it was time to relax. Feel welcumed. And if you want to stick to the skilled people instead of said retards sooner or later you will have to learn communication skills and start getting in touch with people instead of just letting them go and expecting things to magically fix themselves with "freelance" or "starting a company". That's called networking.

>>19596 OP is where I want to be. I have a lot of health problems, plus I'm high-functioning autistic. I have a passion for technology, for learning how things really work under the surface. My health problems are bad enough that I wasn't able to work for a while, and my social worker told me to apply for the neetbux--getting them took almost three years, but now I have a tiny, objectively soykafty little guaranteed income, I guess. But I don't want to live like this. People keep saying "infosec is the Big New Thing." The Department of Labor paid for me to take classes as "vocational rehabilitation." I got a package of four certs: A+, Network+, Security+, CASP. I can't get a job parking cars. You cannot, CANNOT get into infosec if you don't have a degree and you're not a veteran. Everybody wants a "current active security clearance," including private companies. All i get is emails and the occasional random phone call from thick-accented Indian IT recruiters, offering me helldesk jobs in an ultraviolent soykafhole city that's an hour and a half away. fuarrrk that. I don't want to work in a place where I might get stomped to death by niggers in the parking lot in broad daylight. I don't want to spoonfeed belligerent retards who lied about knowing Excel during the interview and want to be taught how to set up pivot tables, right fuarrrking now, for the big presentation that's due in forty-five minutes. I did that for six years. fuarrrk those people, fuarrrk that. I thought these certs would get me a job where I could read router logs all day. fuarrrk my life. At least I have the neetbux and food stamps, so that I am no longer in immediate danger of ending up homeless again.

>>19628 >I agree a lot of roles don't require a masters of craft. I don't want to doxx myself too much but my role is a very technical one that requires some very in depth knowledge about a lot of different aspects of hacking. It usually relies on being able to show results as an attacker. The problem is that corporate rating of what success or failure is varies on manager. Imagine finding a bunch of critical findings one day and your manager gives you great scores. Then a new manager comes along, now looking for findings is now a "waste of time". The focus become number of tests ran. It is a quantifiable number but it missed the point completely. can you ignore what the new manager wants and focus on what you enjoy? think about it as social engineering them, would they really try to get you fired when you are so skilled and they dont really offer anything? i think if you told them "no number of tests run is insignificant busy work and i'm going to find deep vulnerabilities and theres nothing you can do about it" i mean just become more chad i guess.

>>19596 >Any anons feel the same? You summed it up pretty well. It also applies for software engineering jobs. >>19910 Why don't you get >>>/out/ then? Imagine being in infosec and not knowing Linux.

>>19626 >but there is a ton more of low end skiddies playing fraud games which I would have a moral problem with. Do you have a moral problem with the company you work for now? If you start your own business would you be worried that you're making companies that exploit user's information and do other bad things more secure and powerful? In that case wouldn't it be more moral to try to protect those things in a blackhat-esque way?

Corporate culture kill us. That is why I made the choice of take my passion for computers as a hobby, and thanks to that, I have time to learn what is necessary to do what must be done.

We've talked about this at my job before. One of the big problems is corp just sees depts like cyber sec as a black hole on accounting spreadsheets and doesn't want to invest anymore money into training or encouraging side projects. The people with actual skills bail out to actual sec companies that encourage their growth leaving the rest of us where all there is to do is read email alerts and sift through splunk dashboards because that's all they want to pay for. They only plus side is its slowly motivated me to try and teach myself more and hopefully get into something better. End of the day so many corps don't want to pay for cyversec people anymore they want a help desk with sec+ certs

>>19596 Bruh. Have you been fired? Don't worry, you can find something better. Good luck!

>>19626 >but management considers it a waste of time This is why most of the leaks happen. Not because of the incompetence of the people that were hired by the management but rather because of the management.

>>19596 OP hates his job. There is a support group for people who hate their jobs. It's called "Everybody." It meets at the bar.

>>20260 the only field that sincerely needs an "envangelist" role

OP Jerks off to Mr Robot and thinks he is 1337 hackerman. Is actually a mouth breathing jerk that doesnt know how to talk to other humans. Thinks everyone should just do what he says. Also is probably a skid with a SOC analyst job. Go git gud, part of good is being able to communicate.

>>19596 Infosecnormal people think in terms of frameworks. <-- This. Is spot on - people care about social surroundings more than art of craft so they adopt the bullshit framework which is a needless abstract layer on top of the hacking surface. They gaslight themselves thinking they are experts because other incompetents play the same buzzword game. L33t Hax0r is not a meme it makes sense for me more than playing stupid political games in order to degrade your self scoring social points from the degraded. You've seen right through the matrix - that's freedom.

>>>There are 2 types of people in cybersecurity. Are these two types of people with us the room right now, OP? NGL sounds like you're mentally jerking yourself off, the noise in my computer seems to think so as well. Seems like you just made a checklist of your own traits and slid it off as t h e h a c k e r s vs ew normal people

>>19596 Don't have anything to add other than I took a cybsec qualification recently and the dichotomy is real, but there were far more infosecnormal people than real hackers (70% normal people I'd say)

>>19596 >infursec god i hate whitehats its unreal especially furries i'd rather side with blackhats instead

>>20281 I recently took some online courses with other people. I'd say it's more like 90-95%. A few people are there because they want a career change and are genuinely interested, genuinely want to know how things work. The rest are there because the boss made them take a class, because they're Army meatheads who are just there so they can check the box for ISO 17024, IAT LEVEL III, HUT HUT HUT HUT HUT, to get a promotion, and don't want to hear anyone say one word that isn't going to be on the test. Recently I was taking a five-day course for Linux+ and there was this one woman who spent four of those days interrupting the instructor over and over, saying "what's a filesystem." Goddamn, woman. You're in a course for mechanics who build race cars and you want to know what a wheel is. She was, of course, a government IT employee. People tried to send her Wikipedia links, tried to dumb the concept down and speak to her in baby talk, but the Affirmative Action hire just didn't understand the big words. And if you're wondering why the Chinese keep on pantsing us, that's why.

>>20291 I’m taking a MSc Cybersecurity degree at the moment and the same applies here. A few genuinely interested people and an ocean of normal people who use windows and don’t know where programs are installed to by default. Insane.

>>20290 That'll be my new username thanks

>>20290 >thinks furries are only found on the blue team

>>20290 >>20304 Guys... how about taking your discussion of the furry fetish elsewhere? This is not the board for it. Also, the "blue team" (defense) and "white-hats" (ethical hackers) are two different concepts. Red team white-hats exist too, they call themselves "ethical penetration testers".

I want to be the infosecnormal people OP speaks of and im fine with it. My interest in tech is completely normal person-tier. I dont care one bit about digging deeper, its just a well paying job to me. No offense to anyone in this thread...truly, i respect your curiosity but i find things like nutrition and biology more interesting, but those industries are worthless for making good money that will allow a person to live comfortably in a modern city. m sorry to be the exact person OP despises, but yes, im a selfish person who wants to live my own life outside work that doesn't involve weekends of honing my elite hackz0rz skills. I often see cybsec people speak of the notion that there are no entry level jobs in CybSec.. Currently about to finish a Bootcamp in Cybersecurity and if it is necessary i will chase the CompTIA Sec certification. Is it absolutely necessary? Im a personable and warm person who is also attractive and not the typical IT long hair smelly ghoul. How much is this an asset? Is prepping for interview questions and learning as i go on the job really the best way forward? or will those interviews not even make it my way with just a Bootcamp? Should i include "Pursuing a CompTIA certification" In my resume just so HR filters pick me up? Whats the best advice you can give me for breaking in to this industry with minimal qualification? Thank you.

>>20310 >Im a personal and warm person who is also attractive Go sell used cars, then.

>>20311 you have soykaf grammar, and sound bitter. L bozo Used cars salesmen are not "personable and warm" you retarded glitterboy.

>>20291 China will continue to pants the west as long as our approach to education remains as stagnant lenient and unmotivated. Even India is starting to catch up in comparison to the uneducated zombies of western suburbia >>20310 Out of all the people I've met, there's no one I despise more than someone in it for the money. Work your passion or something, be interesting and truthful to yourself for a change

>>20315 I don't understand why you would hate someone for wanting to make money so they can live a good life. Could you explain why you feel this way? If they have a good job, then they can do their passion without having to make their passion work(and thus make their passion less enjoyable). Not that guy btw.

>>20312 Of course not. Con men, professional liars, and bullshit artists manipulate people, trick them, and steal from them by being "smelly ghouls," amirite guise? Amirite? Clearly there's no element of charisma or looks involved. Clearly. A lucrative career in used car sales is just waiting for you. It's clearly your calling. You'll get rich! Or maybe you could start a church to compete with Scientology. That might be just what you're looking for. Or perhaps politics.

>>20316 wow someone who gets it and isnt a fuarking pretentious fuarktard. i literally mentioned my truer passions in the post but they dont make enough money, if i can actually do a job that makes me more money which frees me up to pursue my real passions in my free time why wouldnt i? bitter effing nerd, get a clue and get over yourself

>>20318 you are completely retarded. last reply said being personable and warm, not attractive and not being smelly. you idiots are trying so hard its pathetic. is being nice and sociable the same as being manipulative to your own gain? fuarrrking imbecile. kys. i like how you jump to cults and politics as your next example looking to the furthest extreme as if psychopathy is the only driver behind charisma, and being a master of the social sphere. youre delusional and sad, and way stupider than you imagine yourself to be. once again kys.

>>19596 Yes, it is true "cybersecurity" is, for most jobs calling themselves that, just an office job where you complete checklists, email people, and fill out forms. You install and manage various security bloatware in your organization, and so on. One exception is when you work at various consulting firms that do red teams and audits. This is analogous to many industries where the "big players" every one has heard basically just push paper and all interesting or actual work is done by contractors. Another potential exception is working at cybersecurity product companies, and sometimes security for big tech, where there is a greater proportion of people who actually know what's going on and won't respect you if you have never published a vuln or a tool. You're still going to have to be kind of a cool guy, though. If you want to be the 1337 h4ck3r you think you are nobody's stopping you from going out and doing bug bounties, and CTFs today. There is more than enough stuff on Github. But honestly you already have enough knowledge to just half ass it enough to impress the "infosecnormal people". Why not just pose as one and do whatever you want off the clock? >>20310 CompTIA certs are a cakewalk so if you write that you are "pursuing" it people are going to think that you are literally retarded. They might still hire you anyway because a lot of corps need to check a box to say they "did cybersecurity" regardless of their actual securities

>>20321 i only mean in the meantime to get a job, should i add that to get my foot in the door, and hit that buzzword in the HR filters for resumes, and HR people are not going to think its retarded i assume because they are retarded. i still have a bootcamp certificate on my resume just to show that im on my way and or prepping for the next step already.

tell them youre a 1337 4NU5 h4X0rz they will hire you

>>20320 >I'm personable and warm 2 posts later >kys you fuarrrking pathetic imbecile kys again Most "personable and warm" are not that quick to jump the gun and tell someone to kill themselves You're either not as personable and warm as you think you are or you're just good at lying through your teeth and keeping a smile while internally screaming out of rage. Don't get me wrong tho, pursue a job that pays well and gives you enough time and resources to then pursue your real passions, having a job that you love is nice, but if it ain't going to sustain you, you might as well just have one that pays well, nothing wrong with it. I'm just saying that if you're this quick to devolve into a soykafspewing beast you might not want to put that on your resume

>>20323 thanks! >>20324 what makes you think i have to be a completely agreeable person at all times just to have sociability? im actually super low in agreeableness, and i despise people who act like fuarrrking retarded monkeys. you think people say moronic soykaf at work like the last guy just did? he doesnt deserve any respect, and this is an anonymous board where there is supposed to be no pretense. what level of pretense is really involved in dealing with normal people who arent full of delusional bias like the last commentor? im happy to tell someone they should kill themselves and id gladly say it to someone irl too if they were stupid enough to act in that way in public. maybe not infront of a woman who would find that too aggressive. and this kind of bitterness never enters the workplace. and no i dont imagine myself to be some empath gay boy, i just meant in general, i can be comforting, calm and sociable, even crack jokes, something the average Mr Robot headass could never do. Put what on my resume? being personable and warm? nikka what im just saying this is an asset for me, and yes, i did devolve into a soykaf flinger because i realized i was dealing with a monkey.

>>20325 I guess we do have quite differwnt visions of what personable and warm is supoosed to be like. Maybe I'm just misstranslating it to my own language and picking a wrong meaning. I get being a fuarrrking monkey online, anonimity, no repercussions, whatever. It can even be a nice outlet if you've been bottling up anger for a while. I'd still find it hard to say someone's personable or warm if I saw them telling someone to kill themselves for saying something stupid irl, which I guess you'd do. You don't have to be always agreeable, but there's a few steps in between telling someone he's wrong and starting a soykaf flinging contest while screaming like retards. But that's my opinion, nothing more. Not much of a point in diacussing personal views of people' s qualities anymore I'd have to guess. Having said that, don't understimate the power of writing some empty words about people's skills and teamworking in your resume. The custom may be different wherever you're from, but normally it's fine to write a little personal section about you related to the workfield. And don't forget it's mostly HR people reviewing your resume, even if you show nothing to prove it, adding some bullshit about how good you are at working in a team and resolving conflicts will show that you at least value those skills enough to consider writting them down on the resume.

>>19596 >>20321 "pursuing" comptia is a red flag, just read the book and sit the test it's babbies first cert. That said, when looking at entry level hires from service desk etc taking the iniative to self study is a big plus. But being able to talk about a home lab and what you do with it is even better. Cybersecurity degrees are a fuarrrking joke. Take CS or just start in helldesk.

OP, there is also men like me, that need learn about programming and cybersecurity to avoid begin arrested, tortured and killed by corrupt governments. I had friends that got arrested and killed two days ago. They used call me "the paranoid", for not use social media and use Linux. Things are getting realy bad, and I'm only talking to you guys right now because I know the exact channels that are actively under surveillance. I have around five months to learn everything I can about how stay safe(computer networks, programming and other useful stuff) so I can wageslave on some dead end job, keep low profile, save money and leave the country. I hope you guys never go through what I'm living.

>>The Infosecnormal people are the perfect corporate employee. They have made a career out of infosec because "the pay is good". >>Will not learn for sake of learning. Must be spoonfed. >>No time spent outside of work hours on improving their skills. >>Unless it is for a cert. That they need. For their new job. >>Consumer tech on all their personal devices. >>Owns no soldering iron. Err... what? It's good for our corporate overlords if we are skilling up outside of work time, because they don't have to pay us in time and money to train up. It's good for our corporate overlords if our hobbies are our work, because then they can fool us into working without pay. "Ohh i dont need to join a union... im in technology!!!" "Oh the unpaid overtime is totally worth the subsidised snack bar!!" "It's not work!! It's a hackathon!!!" "Wow I got IBM to use my library!! They are still not offering maintenance and they're just getting rich off my work... but it is so cool!!" In any other industry, you get paid for overtime. No pay? No work. Have some fuarrrking self respect jeez.

>>20448 It's good for me if my work is my hobby because I can get paid doing something I enjoy. Having said that, if I get better at my work because I spend time on it as my hobby outside of work and naturally improve at it, I expect a raise, or to find a more demanding job that pays better. If I do something as a hobby that I end up using at work, you bet your ass I'm putting the time it took me as worktime and get paid for that. Having a job that you enjoy doesn't have to be bleak. But yes, have some self respect and use it to your advantage, not your corporate overlord's

I've decided that I don't want to work mainstream infosec because I'd have to deal with normal people, retarded office politics, and all the other corporate/normal person bullshit that comes with that. I don't give a soykaf about defending the infrastructure of some random company I have zero emotional attachment to, I could care less if XYZ company gets hacked. The impact scope of working for a specific company is limited to mostly their own corporate assets I could care less about, I don't care about grinding for certs, I don't care about making fuarrrk tons of money either. I want to make an impact on the world and leave it better off than I found it, and really the best way for me to do that in cyber is to go nation state and become an unironic fed but I've got fuarrrking principles so that's out of the question. The field and private sector is oversaturated with normal people trying to make an easy buck with their bullshit meme degrees graduating from unis with fuarrrk tons of debt and zero practical skills, these people don't give a soykaf about computers, the art, or culture of hacking, they're just trying to bullshit their way into any fortune 500 company that will take them. I don't want to surround myself around these people that care so much about the rat race, and I especially do not want to surround myself with the """infosec twitter community""" fuarrrkwits. I've known for awhile that I don't want to work a normal 9-5 job, but as I grow older and become more disillusioned with the state of our world, that belief only grows stronger. I'll just have to make it as a freelance, or possibly remote, I know that I can do it, so I will. Goal is to make it onto the Synack Red Team and start popping off one Hackerone, so I'm going to focus most of my time on the web app side of security. Wish me luck lains

>>20549 But what a your plan?Black hat?

>>Infosecnormal people view R&D as time wasting At least in terms of research I actually see the opposite of this, a ton of security "research" being done by these people that is totally inconsequential, sometimes fictional, and at worst just bullying open source maintainers with bullshit in an attempt to prop up resumes with made up vulnerabilities. If this is R&D, emphasis on development, there's definitely a lack of that with infosecnormal people because a lot of them are not really interested in learning how things work, just in getting jobs at these large tech companies. >>Lacking technical skill Infosecnormal people are impressed by non technical products like reports and processes. >>Infosecnormal people think in terms of frameworks. They memorize mitre numbers to throw up during presentations. Rely on cheatsheets printed on their desk for the steps in the killchain. I can say I've seen this a lot as well. So many university projects based around "attack matrices" and "kill chains" and all of this other nonsense. I think it's fair to argue that the entire field of threat intelligence, while occasionally creating interesting reports, is sort of built on a bunch of ex-military nonsense like this and so it wows those people. A TON of people that don't want to spend the time making technical projects gravitating to these spreadsheet projects in academia. >>No time spent outside of work hours on improving their skills. >>Weekends filled with side projects which to outsiders look like work Just be careful with this, there is a lot of truth from >>20448 If there's one thing these normal people can be right about it's a certain amount of work life balance can be useful. While a lot of the time these people use it as a crutch to learn nothing at all, there's no point in spending tons of time outside of work on learning if it's learning stuff you don't honestly enjoy, and doing what you want for a living can make you not enjoy it for fun anymore. At least for me I can say that the most fun stuff is not really what most people do at work, so that's where the side projects go for me. >The Infosecnormal people are the perfect corporate employee. They have made a career out of infosec because "the pay is good". Who knows how long that will last. I'm assuming this post is more about the "infosec professionals" at large firms and not the thousands of unnamed SOC workers at every other company/consultancy. I would also like to mention that these security consultancies are not the solution either. A lot of seemingly hacker types working at these places where you're just doing tons of repetitive pentesting and getting paid a fraction of what you should be with grueling hours. It's okay to have the work you're doing to grow your skills actually get you paid also, or at least I certainly want to be paid as much as the infosec normal people coasting. One thing I've also seen is a good chunk of people getting into infosec because leetcode is too much work. I think this will continue to be the case as the expectations for infosec knowledge continue to decrease and be replaced with corporate management fluff. You won't (and already don't) need much infosec niche knowledge, and then people just gravitate to these postings because they don't want to leetcode.

>>20570 I think this lainanon has covered quite a bit of what I was going to cover in my response, it was also better written. I still want to slap my two cents in here. >>19596 Personally this all feels written by a person who I can feel is either 18-25, has been deluded into the really cool soykaf that you'll do behind a keyboard when you have this job but then you realise that it's not all what it's cracked up to be. What you've described in your post OP can be shared across 98% of all other high paying jobs, Cyber Security is also fairly new, interesting and also expanding. This is going to attract good people and soykafters to, no matter where you go unless its just you sitting a dark cubicle handling all INC there will always be a jobsworth. Lets concentrate on infosecnormal, personally this term is garbage. What your describing is just corporatism, I have a boss. I need to prove to them and his boss that the work I am doing each day is contributing positively to the environment that we run, you do this through reports, through meetings through discussions. It is NOT done by sitting down and staring a bash terminal all day. If you start your own business the first thing you will realise is >I need to create my own reports from scratch >Who does the accounting >How do I get on the books at other companies >How do I market my company >What about legals on contracts Even when people are hired as Pentesters, you're given a process in any mature company. It will most likely be based around OWASP Top 10 and how to abuse certain exploits in whatever you're testing. This is done so that when I as company A) get a report, company B) will also get a similar level of results. Also you seem to be crying about Frameworks? >>Infosecnormal people think in terms of frameworks. They memorize mitre numbers to throw up during presentations. Rely on cheatsheets printed on their desk for the steps in the killchain. Frameworks are used in every part of work, from cooking to cyber to cleaning. There is a framework all of them different, I will agree that some people really don't understand frameworks. Mitre being one of them, but they are important as these important structures on how again an environment is looking without having to understand every single firewall rule. The CIO doesn't need to know every single rule, but he does want to make sure that when a rule is created it goes through appropriate change control AND that it's approved by the correct individual. If I had to impart one piece of advice, understand what you're good at and stick to it. But you need to be able to convert what you're doing into value for your paycheck. If you can't do that prepare for disappointment.

>>20449 trans girl die in their 30s

>>20690 Live fast, die young, leave a beautiful body.

>>19598 >then you should prey on them Hack it, get all their data, prepare a ransomware to encrypt all their systems. Meanwhile buy puts (stock options for shorting a stock) for their stocks. With the data and ransom in place, ask for a good sum of money with monero or else you make everything public. Either way make everything public, profit soykaf tons with your stock options because when this type of soykaf goes public the stock sinks. Be sure to expose all CEOs emails and other crap that was going on inside the company.

>>20449 Do you have any more blogs, websites or zines by hacker transwomen?

I'm currently studying a Masters degree in cybersecurity (Yes, I know...) and it's honestly soul crushing being surrounded by people who have no appreciation for non-corporate cybersec culture or interest in technology beyond what is required for a job. The worst part is that I feel the attitude somewhat rubbing off on me. >Everyone runs windows >Those who 'know' linux only know how to use the shell somewhat effectively, no interest in OSS or how linux works under the hood. >Barely anyone can program. Those who can, program in Java because that's what their university taught them. >Nobody knows C/C++. Those who claim to say "pointers are confusing". >Only one other guy on my course has genuine interest in the field but our personalities don't really gel that well. In the summer I will be working on a research project of my choosing. I can't wait. I plan to research and develop a eBPF rootkit for the linux kernel. None of my coursemates have any idea of what they want to do. Those that took some provided ideas are scared of having to implement some of them (because they can't program). I think the worst part though is just how few practical skills are taught. Half of the course is about bureaucratic bullshit that is of interest to corporate managers but no one else. I'm slowly losing my mind.

>>21028 >Half of the course is about bureaucratic bullshit Almost all non-security related companies see infosec as an area required to be compliant with regulations. These courses sell you the idea that you will fit well into the market and into some better position, as CISO for example. These people don't need to know soykaf, is a big sales and marketing position. Remember that you can study anything you want and research anything you want by yourself. Why waste time with courses like these? You will have more time and money to pursue it if you just drop it. How much did you paid in tuition fees? How much is your rent + monthly expenses? Put these two numbers together, imagine how much you can accomplish if you used that money to provide for yourself while having all the free time to research. First time to not be a normal person is to not follow normal people footsteps.

>>21028 If you don't mind telling, why are you getting a masters degree? Is there a job you are after that requires it and not only a bachelors? Also, I feel the same way about people not having a genuine interest in tech/cmps/linux/etc. It seems most people are doing it for the money. Those poor sods...

just how bad is the infonormal person psychopath situation both in study groups and at work? I don't deal well at all with psychopaths and bullies in the workplace, makes me either want to get them fired or just leave. I imagine there's far less in cyb because of all the autists (myself included), but it's inevitable that the normal people are coming. What about management? t. just got a scholarship for some soykafty government cyber certificate

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 OP's post is a good description of the "cybersecurity" climate. With the exception of leadership teams who know their org needs good infosec and values good infosec (or just good tech) culture, individual contributor roles don't pay well, especially if an academic path is taken to get there. Running a "virtual CISO" firm in the way a law firm is run or operating some platform as a service pays well. Unfortunately for those in an individual contributor role, they will always find themselves working for and amongst total morons, and for those who are both talented and actually look to find out, red team pays a lot better. -----BEGIN PGP SIGNATURE----- iHUEARMKAB0WIQS5hjP4BamCdkrDp9sUF5ETqor2JwUCZIVQNwAKCRAUF5ETqor2 Jw9jAQCPP1uzdhTIRneC3bJXNUNSpcfI1NjSto1R4bES1S4ErgEAieJ3UIX00pAR Bht1+2UioQQOGpocCehNSmo11jrKSVw= =BMQR -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- mE8EZH6ExBMFK4EEAAoCAwQo6DlP7ILmNvj3ImPTt1o4rW+qSr+DJ489pOESjKvo xCrTVurgL0UeLyalrJq8jPQYceX2BgjL+OeQQvs2QmNgtAtubmNwLWhvcHBlcoiT BBMTCAA7FiEEuYYz+AWpgnZKw6fbFBeRE6qK9icFAmR+hMQCGwMFCwkIBwICIgIG FQoJCAsCBBYCAwECHgcCF4AACgkQFBeRE6qK9idxBQEAmpVOEgMxMx80eNTVCAM4 6qXOojz8E8hq8r4FUZbODOMBAIEqzUQ/unt1LylaoqEud+eqK7IyIMnFfZKEpRgy Za41uFMEZH6ExBIFK4EEAAoCAwTczX54KXWQEtzS7/S1B6rcbZl6jzLm4Fj3SMP7 NQsxQz4U1KAa52Yj4LrdkwIXM37WkKgE+iY7583pK0Ce8jVVAwEIB4h4BBgTCAAg FiEEuYYz+AWpgnZKw6fbFBeRE6qK9icFAmR+hMQCGwwACgkQFBeRE6qK9iftNQD/ fB3MubZJ9c8na34TLUYY2BZZ6Nx6j+ZX6iwxPnaZ+8gBAKRSTIp3Gqlu/y7XAi6K y+2706o9KPLzN9gysgWOOsFT =iyrF -----END PGP PUBLIC KEY BLOCK-----

>>19596 I appreciate this post, I've been slacking hardcore and I needed to be called out for not spending more time outside of work learning.

>>22385 Still too pretty for an incel like you

>>20449 >>20992 >trans girls Let's be real, you're not Edward Tivruski the 4th but a dude with a dress and mental issues who spent too much time at the wrong corners of the wired. Meanwhile on the internet nobody knows one is a dog, nor cares. Why do you porn addicted weirdos have to always try to make it all about yourselves anyways? >>OP The thing is it's always been and still is a niche hobby, only championed by a small group of technically affine enthusiasts. That now this skill has become recognized as a crucial staple of the ever more technology reliant business world changes nothing it that. The jump in demand and job opportunities has only spawned specialization in college courses and certificates while you were hard pressed to find hardly any just 15 years ago and with that only come "infosec normal people", but not a sense of fascination for the subject of course. I get it, it's sometimes difficult to accept that most people will never share your interests, especially in tech, but many really just want to earn a good living and then meet up with friends afterwards and socialize and other normal person things. And cybersec has become just another vector for that. Even if especially this field direly needs skilled people who don't drop the ball when ai is about to go full global botnet. Another suggestion I've seen is that yeah, if corpo culture isn't for you. And frankly it's for nobody who just wants to make cool things then maybe going independent is the thing and avoid all this diversity hire nonsense so you can hire people based on their skill again. Or join more hacker forums to find people on your level and vent. But always keep in mind they're riddled with feds who're either cybersec normal people themselves or actual haxx0rs who got busted and are now forced to be there. You probably can still have a good chat with latter though as long as you don't overshare. Either way good luck and I hope you manage to bring some positive change in this world.

>>21768 What's the point of signing your post and sending corresponding public key along? I though that when you sign something you assume people have correct key to verify the signature. It there a normal Lain article explaining why I'm wrong?

>>22408 Good question The key is an secp256k1 key, so there's a very real chance it's on a blockchain somewhere and they expect you to look it up. If they instead used an RSA pk then maybe they would want you to respond to the message using their public, but that wouldn't stop the lainmins from altering the message and replacing the signature.

>>22408 >>22414 My guess is that it's just another form of tripcode. Basically only use the key for lainchan and it acts as a more secure, but harder to use and verify, tripcode.

>>19596 I absolutely feel the same anon. I am currently in a school for cybersecurity and I can't tell you how many people are just completely disinterested in computing in everyway except for their professional career and discord/gaming. It's sad. I wish they'd gtfo if they're not all in

>>21028 scary that's a masters program. Been saying for a long time, teaching some super surface level cybershit to normal people and then entrusting them with it as "knowledgeable" is gonna end up fuarrrking us down the road. security isn't something you do from scratch, it's near the end of the computer inspired autism line. but corpos gotta tick the box that they have teams now, so some dude with a degree is good nuf for that and universities are striving to meet the demand with little to no regard of the consequences. good luck lainon

If the world cared about security the internet would be a platform to allow self-hosted services and sites interconnect consensually, not a mass of people using centralised services.

>>19599 Same I just got in as well just as a hobby. I'm still learning though. I've been a bit slow with it though. I'm learning more about binary exploitation stuff. I started out learning about binary stuff but I'll admit when I found out about money aspect I tried to get into web stuff because I heard that's where the money is, but I realised that I didn't like it too much. I've gone back into the binary stuff. I just hope to keep improving, and eventually being able to apply my skills

>>19606 not really an option if you're in a developed country because glowniggers will find you one way or another.

>>22524 agreed, well said. corp is just filled with run-of-the-mill "engineers" who just don't care enough to be anything but mediocre at best. Sadly, like you pointed out, the demand is so high that mediocrity is acceptable so long as you're an ass filling a seat. I firmly believe it will be this way for a long, long time. Maybe in 20 years things will have gradually changed to be different, but the talent floor is pretty low right now. People are still cooming their jorts over trash malware, but this time in Rust/Nim/Zig!!!1! Just tired of the twitter-esque insider trade over bug bounty payouts and recycled techniques as if any of that fuarrrking matters when some ding dongs in Russia are using rolling companies left and right with out of the box cobaltstrike being delivered by hta -> js -> vbs -> bat -> etc

Lurking and feel like I fall into the infosecnormal category feelsbadman. I’ve been working as a SOC analyst for a little over a year now and still feel like I don’t know soykaf and make bad judgement calls, I’m barely online outside of work, and am primarily pursuing certs for wagebux. I really want to feel competent but idk how to grow as a hacker >inb4 do bug bounties I have no fuarrrking clue how I’d start that

>>22742 Same, except 2 years. Honestly, there's nothing wrong with just holding down a job, nothing to feel bad about. It's your employer who decides if you're worth keeping around, not a lainchanner. And if you want to improve, you always have the option to.

>>22742 you have the ability to access all the information you need to start but youre simply too lazy or you dont believe in yourself

>>20290 >>20304 You have no idea of the amount of furries who aren't white hat. There are quite a few. But yeah AWS (which is like 80% of all web servers now) is pretty much all Furries.

> Any anons feel the same? Absolutely and your observation is not wrong at all. Timeline for illustration, I’ll start in the 80s but could go further back. 1980s: The hacker scene exists and the information security scene exists, there is actually some overlap mostly in the form of Sysadmins who also hack or stuffy academics who might not actually hack anything but probably would have been a hacker if they had a computer as a kid. They pay attention to what kids are doing and it serves them well professionally though they quietly just think it’s cool and thousands of kids with infinite time manage to come up with interesting stuff despite their lack of formal training. The non hackers mostly come from intelligence, academia, and the auditing and compliance communities. The NIST rainbow series is the gold standard, alpha and omega of information security (not saying the books were wrong either) and these guys are getting eaten alive by a bunch of teenagers and college students. I’ll continue next post…..

>>22877 So in the 90s the professional infosec community acknowledged the hacker community a little more. Some infosec guys were cool and would shoot the soykaf with hackers, go to their meetups, exchange information, etc. More and more hackers were moving into information security as they got older. Also the number of hackers and demand for information security professionals exploded. It was in this time that the information security world really started to soykaftalk the hacker community as being unskilled and ignorant. Oh you don’t understand auditing, or you don’t understand esoteric data structures i learned in school, oh you don’t know business process X, Y, and Z. Hackers, especially young hackers have a lot of technical gaps and know almost nothing about business processes and roles but it doesn’t change the basic fact: YOU STILL GOT OWNED BEYOTCH! Many times skilled hackers would get hired into infosec roles and embarrass themselves and many unskilled hackers would talk slick and get themselves into jobs they can’t do. This is when pentesting became a thing so that hackers did have a role in providing security but the auditing and compliance people absolutely hated these motherfuckers, getting to the bottom of a checklist only to have some 23 year old basically trash your work in the verification phase. I’d like to note that hackers loved cyberpunk in this era. Names like snocrash and count0 were common but using fictional vocabulary for real things was deeply frowned on. “cybersecurity” was a word that would get you kicked and derezzed pretty quick. continued….

I just remembered. I should mention that in the 90s the difference between the infosec and hacker communities and the shade the infosec guys would throw on hackers was never clearer than in “Takedown” Shimura goes out of his way over and over to call Mitnick an “ankle biter” even as his clients get hacked, he gets hacked, and the entire story is about the obscene lengths that he had to go to in order to catch Mitnick. The other great irony is that Shimura’s nonstop attention whoring and attempts to portray mitnick as both a master hacker and inferior hacker totally backfired as Mitnick got out of jail and became one of the most in demand figures in the information security world and shimomura’s career stayed mostly on the path it started with the exception of publishing some books that were mostly consumed by normal people and not hackers or professionals. >>22878 So then the 2000s came. The “good guys” are doing as soykafty job as ever, the biggest advance in security was that buying firewalls was no longer a questionable capex, updating and patching was becoming the norm, pentesting the mundane was becoming acceptable. We probably all know how anon went down and maybe some of us were there. Your typical upper echelon anon hacker was some guy who sat in IRC and was actually not particularly skilled…and… they fuarrrking wrecked soykaf and the information security world failed to contain them in any meaningful manner! The information security world is absolutely flooded with pretenders from law enforcement and military. These guys make “cyber” into a real word as they run their mouths making up buzzwords. The lame auditing and compliance people start larping as hackers using words like pownz0red. Things get real lame… and here we are today where some auditing and compliance nobody can advance the ranks of information security and become CISO of Equifax

>>22879 Management will always have a strong bias toward itself. Even bothering to be anything except a “leader” in their eyes is evidence of your inferiority all by itself. They don’t understand what you do and cannot communicate with you in a way that reveals you to be a rare talented all star. Instead they favor people like themselves “go getters” who shoot straight for the top, pursue power, speak their language, etc. Your pathetic SoC paycheck itself reveals to them that there’s something slothy, unreliable, and unreliable about you. continued….

>>22880 and so what can you do about it? Well for one they can’t promote you to leadership even if they want to unless you can communicate and understand their processes. You’ll never impress them with your incomprehensible nerd speak, they don’t know what any of it means. You’re going to have to learn business. Project Management, Finance, Auditing, Compliance, Reporting, etc. This is what your square peers are doing and they’re making more money than you. It’s not fun but it’s childs play compared to Data Structures and Algorithms. Just bite the bullet, pick some related certifications so they”ll know you kinda sorts learned it. For me this kind of learning has been good for my mental health at work, I understand why some pointless meetings are happening, I get what my manager is asking from me and when things are going wrong I can tell my leadership what’s happening in terms they won’t ignore, when projects are off track I can tell when my PM or PO is a useless cluebag taking up space. All this soykaf is like kicking dead whales down the beach and is boring and sometimes even stupid but the people who run the world rode it straight to being in charge of everyone else so in their minds it must be special stuff that only a few geniuses could possibly comprehend… or else your narcissistic puffbag of a CEO might not be special and the egos on those kind of people will not allow that. If you’re so smart why can’t you make big bucks bossing everyone else around?

So to finish up you can probably learn most od the required business just by studying up for the cissp. The technical stuff should all be review and the business end is all pretty shallow, there’s a lot more than what’s covered on the test but they can’t make any part of the test too hard or involved or they risk missing a chance to grant ISC2 membership to someone important which is vital to their marketing strategy.

So I just found another example of security outsiders controlling the security community. Rootkit. Rootkits were once a kit for after you have root, to help you get back in and hide your presence. Now it’s apparently a kit to get root. I was doing some studying and was absolutely floored as it was presented this way. It’s not my imagination, rootkit.org was all about kernel hooks and hiding, the sony BMG rootkit was about hiding the copy protection software, and if you look at the wikipedia page it talks about rootkit in the noob revisied sense and clearly talks about something else when you read the history sections. Yet another case of the unwashed masses barging into the scene and getting it’s ignorance cannonized through the sheer numbers of clueless imposters parroting their ignorance.

>>22905 Yeah, I did PC tech support for a couple of years, like 2008-2010. I mean I did it a lot more than that, but that specific job -- anyway, it was kind of hardcore as consumer tech support goes. It was all done over remote desktop sessions and we would get balls-deep in malware removals, not just running scans but using process monitor/explorer and other sysinternals tools plus gmer and the like to disable active rootkits that were... protecting the more visible malware. Hahaha a kit to get root, what kind of skiddie soykaf

So I'm studying for the CISSP and in the official guidebook they go into all sorts of annoying, esoteric, and questionably valuable information. When they get to DNS they start outlining the lookup process and stop at your local DNS server as "The rest isn't important for the exam" So there you go The fake ass presentation layer of the OSI model... important Knowing about Caesar Cipher... important Knowing about 2DES meet in the middle... important Knowing Appletalk uses CSMA/CA... Oh yeah that's important But understanding DNS lookups. Yeah that's not really in scope.

Apart from the consumer tech point, I fit perfectly into your definition of infosec normal user (a sizable hacker conference doesn't count as a meetup). I have no passion for my corporate security job, for me it is little more than a preferable career path, compared to the other options. On the other hand, I also: >run Linux, OpenWrt and GraphineOS, including a web server and only one pi >contribute to many FOSS projects in my spare time, under different aliases >have dozens of commits in multiple imageboard engines, janny a couple of boards to help keep them spam-free >no real presence on social media, blogs, or other reputation-oriented sites I care about computing. Corporations do not. They care about money. If we lived in a world where we didn't need to sell our body and skills to merely survive comfortably, I wouldn't care about money. I work in sec for money. I see no pleasure, pride or fulfillment working security for companies which deserve to be destroyed. I'm professional, friendly to coworkers, but I have no respect for the corporate. I'm obviously not alone either. Red team is full of people, clearly passionate about their art but merely here to pay off their mortgage, and if they believed they could get away with it, they absolutely would rob their employer to achieve that goal. Good on them. That's what a hacker should do: exploit the broken system.

>>23163 >no real presence on social media, blogs, or other reputation-oriented sites If you don't mind me asking, how do you manage to get around the need (for lack of a better term) to have a LinkedIn, GitHub profile, public online presence, etc.? It seems like not having any of these will get your application sent to the circular file.

Yeah. That's why I gave up. I'll keep learning and stuying the area as a hobbie but will not work with it ever again.

>>20447 >and I'm only talking to you guys right now because I know the exact channels that are actively under surveillance. tell me the channel, I want to join

>>23015 To get a CISSP you have to have a total of five years of paid experience in two of the eight domains it covers. The domains are all information security specializations, which you don't generally get into without knowing how a DNS lookup works (and usually proving it by having a CCNA, or security vendor certs, or more technical/applied ISC2 certs like SSDP). CISSP is more concerned with some higher-level managerial stuff like what are the DNS records we need, or the big-picture reasoning behind why, when designing firewall policy, we will not only whitelist traffic to the preferred DNS server and drop traffic to all other destinations on :53 (and why we might decide to add a drop rule for this instead of letting it hit the default drop at the end of the policy), but also do inspection of DNS traffic in higher layers to make sure it is DNS traffic and see what it has inside it (and what firewall blades should be considered when anticipating all the ways you can abuse DNS). It's also important to understand DNSSEC for the CISSP. So it isn't necessarily as simple as the ground-level technical details but more abstract for managers; there may be new areas of knowledge involved, but the mindset/perspective shift is the main difference moving from SSDP to CISSP, for example. But even this is a little bit lower-level than the CISSP actually is about; it would be more like "knowing to specify to the people implementing the security architecture that we should ensure these subnets can only request DNS from this server, also we should inspect this traffic in the AV, IPS, and DLP blades, also open a ticket with the firewall vendor and ask if there's a way to accelerate known good DNS, also review the policy and make sure we're not allowing DNS to be tunneled over something else..."

>>23170 >LinkedIn Never needed one. >GitHub profile I have an pseudonymous one for FOSS stuff, but none under my real identity. They're just not needed for the kind of work I apply for. Who gives a soykaf if you have a LinkedIn? How does that help? It would have to be a really soykaf company to send applications to the trash for not having a LinkedIn.

>>23361 Thank you for your reply. > They're just not needed for the kind of work I apply for. It seems that despite having a decent resume, LinkedIn, and experience, I consistently get left in limbo for two weeks, then eeceive an automatic rejection email. It may be a result of mainly applying for internships (currently in uni), but I cannot say for sure. If you don't mind, I have a few questions for you: Do you have any advice for looking for and applying for infosec work? I've tried to implement some of the techniques from this video (0) to little success. It doesn't seem like many companies are hiring for infosec. Do you think that landing full time positions is easier or more difficult than landing an internship or co-op? Would you recommend pursuing one over the other? Do certs help? If so, which ones? If not, what would you recommend instead? (0) https://www.youtube.com/watch?v=__lvS2pjuSg

>>23364 I can't really help much here, I basically got in for an intern-like role (paid), whole company shat the money bed within two months due to pandemic rendering the industry temporarily worthless so they laid off a huge number of people, my manager had an old connection with a big tech company where they have an unlisted summer job opportunity, started doing casual work there in business-side-of-IT and then used that experience on my resume to apply to the same company in sec. Connections aren't easy to get, but they can be powerful. If you're already approved, you can jump over the queue. I know many corp jobs offer employees a few thousand dollars bonus if they recommend someone and that person gets hired, so if you can, try and find people in a company you'd like to work for. If you have 0 connections to work with (no university connects, no people you know in the industry) it could even be worth checking out places you know they go after work, like tech talks or pubs. For my job, certs weren't really important but they would be a nice cherry that could put one above another applicant, it's more process than technical (think of intel gathering on vulns in the wild, or following up sec tickets) but familiarity with relevant tools and relevant concepts helps a lot, they'll probably test a bit in an interview. Even understanding technical side of things and understanding scripting is a plus for the teams which aren't doing pentest rock-star stuff. I don't know exactly which certs, but I do hear OSCP thrown around a lot in the red-team/pentest circles.

* by the way, if you can apply to graduate roles, do it. They're much better than internships, although there may be a higher barrier to entry. I missed out on some of them because I didn't realize they closed about a year before graduation. Seriously, January/February.

>>23365 >>23366 Thank you for the advice. > If you have 0 connections to work with (no university connects, no people you know in the industry) it could even be worth checking out places you know they go after work, like tech talks or pubs. I would imagine conferences and local meetups could do as well. I'm not too sure about tech talks or pubs but I will be sure to look for them. > if you can apply to graduate roles, do it. I'll keep that in mind. Barrier to entry does seem rather high but always worth a shot.

>>19600 innovation is dead, only true innovation is by the very few on github

>>19596 Normalchads are kinda based to be honest. They're usually more socially adjusted, so they can be useful. >Business wants to make everybody do silly presentations for their quarterly meeting? Talk the normal person into doing most of the presenting. They like that stuff >Leadership not willing to pay for the newest tool/SANS course/whatever else? Talk to your normal person confidant and have them be the voice of your idea >Lacking credentials/permission to do whatever you need to do? Just tell your normal person about it. They probably have more charisma or social influence to sway people It's really hard not to like these guys if they like you. Just use your technical skills to make them look good and if they reciprocate then you've got a very strong working relationship

Have you ever considered that maybe some people have families and want to spend time with them. It's not that they don't want to learn new things, they simply don't have time anymore?

I swear this is the best post I've seen since a while

>>23495 Agree, good thread. >Ctrl+F imposter syndrome 0 results Hmm. Well, there's that. Imposter Syndrome (when not being a virtue signal buzzword, like "neuo-atypical" is frequently) is a real phenomenon in today's INFOSEC that I believe stems from a sigificant fraction of infosec normools actually being noobs. Many megacorp norm!es don't build their own tools or find & exploit vuns themselves, they just use other people's kit/frameworks/vulns; So, being basically skiddies, they correctly feel as if they don't have cred to warant being entitled "hacker" or "$COLOR hat", etc. So, OP's INFOSEC dichotomy observations would not surprise me in the least. I don't have much in the way of solutions to the problemspace of typical megacorp de-rezzing of hackerdom, except: Social engineering need not merely be pidginholed into manipulation for exploitation... Perhaps applying a social filter to an active community could help single out those of a more 1337 nature for potential further collaboration/conspiratorship. I've given up on trying to fix the broader corpculture in general, and take an accelerationist position nowadays. One thing to remember is that before the wired became norm, corps didn't need much infosec capabilities. Being online made the corps need to employ some basic defenses, not least of all to satisfy insurance corps who would love to cry, "Negligence!", otherwise and deny coverages of losses due to cyber-related events. I think higher level machinations require megocorps to deploy $CYBER_BUZZWORDs but, at the end of the day they see inevitable exploit as simply a risk to [halfheartedly] hedge against. After all, complete security is seen by most of modern INFOSEC folk as a goal to shoot for but not something that is actually attainable. Meh. I'm working on building my own systems from the silicon/chipset on up with a focus on security, determinism, and real-time operations / low latency performance. Screw everyone else's interoperability desires. POSIX is lame/bloat. Modern OS devs thumbed their noses at MULTICS so hard (with UNIX, and later the retarded monoliths that are Linux/Windows) that they continually stumble over multi-user/networked environment demands, meanwhile trumpeting "If you don't understand POSIX, you will reimplement it poorly" and patting themselves on the back -- never stopping to think "Hey, aren't we misunderstanding and poorly implementing MULITCS?!" Naw, let's ignore our UNI-user roots in UNIX (POSIX standards just being a byproduct and aftherthought of, post-implementation) which plague the entire design and result in soycaffe like systemD (because MULTICS dependency resolution for its compute as a service was poohpoo'd as "Overly Complex" at UNIX's inception). If you'll excuse me, I've got a debugger to go stare at blindly while I wonder "how to get root from userspace on POSIX?"... gee, I wonder if those int 80h syscalls my debugger uses could be invoked to attach my malicious process to a running root process, and then simply break, write payload at the instruction pointer, then resume... Naw, Cletus, surely the OS will check that the attaching (dbg) process is run under a user with execute privledges for the attached process's file of origin.... Hmmm, one of the tons of 1337h4x0rz has certainly tried this before since they stare at debuggers and dream or root priv escalation vulns all the time, riiight? It is a "MULTI user" OS, isn't it? So, one user can't simply debug another user's process, thus becoming able to do anything that target user can do, of course not! I guess the OS devs just expect my process to stay in my lain? POSIX isn't really just secured via the honor system, eh? Muh File Permissions!

>>23373 Reading through this again I remembered another key answer to the question "why are infosecnormal people?". The purpose of infosec people in a business is to either improve their security or improve the appearance of their security. Just focusing on the former, a big part of the job is to convince people to do obvious things like segregate the production network or not expose critical databases to anyone with an Active Directory account. Technically speaking, none of this requires you to be able to craft 0-days in assembly. Assuming you know enough that this needs to be done, this is way better accomplished by being a sociable, respectable yet knowledgeable-appearing person who can convince higher-up, even more normal person, people that they need to make bozo team six adhere to basic security practices.

>>21768 >red team pays a lot better. Red teams in big tech are basically all about purple teaming now. They pay better than equivalent levels but eventually you need to level up or jump ship. Leveling up means you take on more managerial roles and depending on what tech company you are at means writing more docs or starting more "projects". The field is flooded by infosecnormal people and post pandemic leadership can't really differentiate between the two. Game theory means if you want to be paid more you are not actually adding value since mature red teams turn into another security program and don't actually red team. There are many red teamers in big tech who don't understand how tor works or how they would set it up. They are out of touch with the actors they emulate and without that creativity then red teaming is just compliance testing. >>22399 >But always keep in mind they're riddled with feds who're either cybersec normal people themselves or actual haxx0rs who got busted and are now forced to be there To think all a threat intel company needs to do is have a couple of interns on forums and they would have better threat intel than whatever security vendors are selling now days. Local meetups get glowies or informants too. Someone new and they are always looking for some vague "job" done. They glow in the dark. >>22515 >I absolutely feel the same anon. I am currently in a school for cybersecurity and I can't tell you how many people are just completely disinterested in computing in everyway except for their professional career and discord/gaming. It's sad. I wish they'd gtfo if they're not all I had a degree in something completely unrelated to computers. My degree is literally a checkbox for hr. I have my curiosity to thank for my career. Don't be too jaded anon, this gives you a leg up. Not now but in 5 years when those kids are your competition. >>22742 >inb4 do bug bounties I have no fuarrrking clue how I’d start that I'll be honest with you. It is hard to get the initial rep on something like hackerone. Once you have good rep you get invited to programs first and those are were you get to look at stuff first before everyone else. The events they throw in vegas are wild. Those top hackers are making insane money in one night events. Most of their setups are just automated scans and inventory of assets. If it picks something up then they take a manual look. Make a django app and create your own inventory tracker for all assets in a bounty. Then just manually look at any changes that happen between scans (new ports open, new hosts, subdomains going offline)

>>22878 >This is when pentesting became a thing so that hackers did have a role in providing security but the auditing and compliance people absolutely hated these motherfuckers, getting to the bottom of a checklist only to have some 23 year old basically trash your work in the verification phase. Still happens now days. But I find more of the pentest vendors now are a bit more compliance than actual security. >>22880 > Even bothering to be anything except a “leader” in their eyes is evidence of your inferiority all by itself. I get it for climbing the corporate ladder which I really rather not do. I already have side hustles where I am in a proper leadership position to push the direction. In that scenario the product launch and success is dependent on my planning which means all the backroom work is a means to an end and it is measurable as a win or loss. >>22881 > If you’re so smart why can’t you make big bucks bossing everyone else around? I think about quite a bit. I am looking for a local maxima for my skill to pay. The difference between 300k and 600k in salary doesn't change a developed country lifestyle (a bit more breathing room but w2 is all tax slavery on the higher brackets). But those higher levels in big teach no longer pay for your tech ability or knowledge, they pay for the soft art of bullshiting. It comes with a lot more time constraints and it backs you into a corner where your value add is no longer a hard skill. The problem I see is that on paper they need more red team operators. They need more skilled ones and are willing to pay because they can't find skilled operators. The industry is filled with unskilled infosecnormal people who then turn red teams into a checkbox policy team. Rather than address how this doesn't properly add the value they needed to the company the company will then just consider that the new measuring stick. This means that both skill level of teams go down as well as salaries. Imagine getting brought on to be an operator and you spend your time dealing with compliance of policies because some infosecnormal person screwed up and now legal won't let you do any SE. I like the historical context you gave anon

>>22905 Imagine having to deal with infosecnormal people changing the terminology and you have to bend the knee because there is more of them on a team/org. >>22909 > not just running scans but using process monitor/explorer and other sysinternals tools plus gmer and the like to disable active rootkits that were... protecting the more visible malware You were doing more then than most soc analysts now. They just click around on the crowdstrike dashboard. Not alerted nothing to see here ! >>23163 >contribute to many FOSS projects in my spare time, under different aliases >no real presence on social media, blogs, or other reputation-oriented sites Based. This ended up kicking me in the ass anytime I went job hunting. I have all this hands on experience under all these different aliases not my real name. But I do that because most employers do not like being involved in open source. >>23170 >If you don't mind me asking, how do you manage to get around the need (for lack of a better term) to have a LinkedIn, GitHub profile, public online presence, etc.? It seems like not having any of these will get your application sent to the circular file. My professional accounts are literally curated on an as needed basis. I share things here or there for job hunting time. I don't post to social media and if I do it is done to keep an online presence enough for when they do those searches. Linkedin I use as a sales funnel for new job postings. Eventually if you network well enough you don't need to have these online since you can have people in your circle refer you. To be frank, there is a ton of red teamers who have blank linkedin and blank image. I would rather hide in the noise than draw more attention.

is that any reason do blackhat?

>>22905 >Rootkits were once a kit of after you have root, to help you get back in and hide your presence Yup >Now it's apparently a kit to get root You sure that's a common usage these days? I haven't heard that too much. You're right ofc that the Wikipedia article does say that in the history section. It cites an old Symantec white paper. But the Wikipedia article also says "Modern rootkits do not elevate access, but rather are used to make another software payload undetectable by adding stealth capabilities." Doesn't feel like the meaning of the word has changed or bending the knee to noobs. Just feels like a Wikipedia argument. You can see in the Talk section back in 2006 there's some Wikipedia editors going back and forth about the definition. Wonder if its just a chip on this guys shoulder. But idk people change definitions all the time so maybe this other definition is more widespread than my anecdotal experience.

>>19596 You can be both. Chilling at work in the SOC/Pentest but in free time do some researches/BugBounty/etc.

>>23496 CAP_SYS_PTRACE, dumbass.

>>23624 You can make money by your own (if you are good enough) or you could work with ransomware groups and get a cut of the profit.

>>23624 Same reason to be a bank robber. Fortune, Glory, and the thrill of it.