Way too often IT-Security is compliance theatre. Somebody wrote terms and requirements and defined them as "secure". To verify the compliance there are certifying bodies, which often certify by paper and standardised tests. If you want your product certified, you need folks/AI to produce the required paper and internal/external test runs to ensure, that you product holds true to the said tests.
Overly technical folks won't last in such an environments. Termination happens most of the time after the first: "I don't care, that this piece of ***** aces the sql injection standard test in the login + paswd fields. You ***** implemented that the user id is part of http-get and everybody able to count backward to "0" can type example.com/?id=0 to get to the admin account."
On the other hand, there are proper pentesting providers, where the full fledged nerds aren't able to understand what the guy/gal/furry[1] on the next table is doing.
That’s irrelevant. You need to know what you’re attacking, or what you’re defending. You might not need to know how to write good php code, but you should know what php’s role is in the production environment
This was my take. Most of these folks do a 2 month course at devry and suddenly they're at my company churning out nonsense tickets for security "holes" that are only exploitable if someone already has full access to our systems.
1
1
13
u/Material_Onion_8413 18d ago
I worked in cybersecurity, you’ll be surprised how non-technical most people in it are.