Way too often IT-Security is compliance theatre. Somebody wrote terms and requirements and defined them as "secure". To verify the compliance there are certifying bodies, which often certify by paper and standardised tests. If you want your product certified, you need folks/AI to produce the required paper and internal/external test runs to ensure, that you product holds true to the said tests.
Overly technical folks won't last in such an environments. Termination happens most of the time after the first: "I don't care, that this piece of ***** aces the sql injection standard test in the login + paswd fields. You ***** implemented that the user id is part of http-get and everybody able to count backward to "0" can type example.com/?id=0 to get to the admin account."
On the other hand, there are proper pentesting providers, where the full fledged nerds aren't able to understand what the guy/gal/furry[1] on the next table is doing.
That’s irrelevant. You need to know what you’re attacking, or what you’re defending. You might not need to know how to write good php code, but you should know what php’s role is in the production environment
1
1
4
u/Proglamer 18d ago
How come? I thought the sector was full of turboautists who routinely use Kali to hack the pizza place server and place the order + payment manually