Hacker News Reader

Comment by publicprivacy | Hacker News Reader

Thank you all for your perspective, and suggestions.

I was on a bad psychedelic trip, accompanied with some other issues at the time and ending up making threatening statements to a very high level official, but no battery occurred whatsoever. Thank goodness, or I would probably not be writing this message

View on HN

The challenge here is your choice of specialism. Security is fundamentally a trust-based business and the industry is pretty wary of anyone with a perceived black mark against them. The reasons for this are mainly liability ("if this guy does something wrong and he already has a record, how will we look?") and reputation ("what will our government customers think about us if we hire this person?").

Could/would you consider a sideways step to something less directly security based? For instance there might be data engineering roles that might suit.

My experience is different. I'm not a felon but I come across them in the workplace fairly often as an internal investigator. We have infosec personnel working for us with nonviolent sex offender convictions who also maintain security clearances (defense contractor). Life does not end with a conviction; don't wear a sandwich board broadcasting it but honesty goes a long way. It's the lies that I'll eventually hang you with.

Go west if you can. If you're on the east coast it's hell. The "liability" concerns are (IME) a pervasive east-coast racist myth from the 60s, but it's a real threat. The same justification was used to expand routine drug screening from forklift operators and truck drivers to keyboard jockeys. Equifax did drug testing of white-collar employees and did not hire criminals; so much for their liability and reputation following the worst data breach in history. It's all bullshit; both justifications are veiled cause to not hire blacks.

Mind your co-workers inclined to cyberstalk everyone around them and using your skeletons to raise PR hell to advance their own career. We've unfortunately thrown employees under the bus due to public outcry. Social "justice" in action! (What was the prison sentence for, if not justice...?)

There's some decent but counterintuitive advice in here, OP: have you tried applying to a job with a clearance requirement? That way your past gets (should get) evaluated within a defined decision making framework, instead of by a spooked recruiter using their lizard brain.

The point of security is to remove trust as a requirement.

Poster could say, “you don’t need to trust me, that’s the point of {insert product or service}”.

OP is doing "SecOps" which is incident response and security automation. The service includes him as a moving part.

You could also consider working as a consultant or external pen tester. When we hired our pen testers, we did not run background checks on them, not least because they have no access to customer data so it's much less of a concern.

If the people you're paying to find weaknesses in the security system are assuredly never going to find a way to access internal data then how did you conclude you needed a pen tester in the first place? I mean, it's probably the right conclusion but only precisely because they'd find a way to access things they shouldn't be able to.

It could have been for a service that was not in production yet, and in an isolated environment.

We spin up a clone of prod and point them at that.

Certainly if a weakness is found in the clone it's also present in prod, but that's what contracts are for. And we also review logs to make sure.

edit: a clone of prod w/ only test data in it, not prod data.

How do you know what you are looking for in the logs?

If you have the foresight to be able to recognize a malicious action from the logs, why not have the software block those actions from the start?

We log all accesses and flows. So eg if our pentesters found a vulnerability in an endpoint, we can retrieve every post against that endpoint and (1) verify the pentesters didn't exploit it against prod, and (2) verify that it hasn't been exploited by anyone else.

Of course, that only works if the vulnerability is reported. There is no reason for the malicious actor to report the vulnerability they have chosen to exploit.

What percentage of the vulnerabilities discovered are independently discovered by multiple pen testers?

It sounds like you're suggesting that pen testers by default will not reveal discovered vulnerabilities with clients.

Then you talk about "discovered and revealed vulnerabilities". But, your first sentence talks about "discovered vulnerabilities not revealed".

What you may be wanting is a honeypot, where a pentest client intentionally puts some vulnerabilities of various exploit difficulty into the clone environment to ensure pentesters are doing their job.

> It sounds like you're suggesting that pen testers by default will not reveal discovered vulnerabilities with clients.

How so? Presumably most pen testers are working in good faith. But, if there is a malicious actor in their midst, that individual would not disclose any vulnerabilities they intend to exploit, no. What would be the point? That's just a really good way to get caught.

> Then you talk about "discovered and revealed vulnerabilities".

Yes, that's right. While it is theoretically possible for all your pen testers to be working together maliciously, if you are careful in your employment practices you can make this highly unlikely.

As such, if your data shows that 100% of all known vulnerabilities were independently discovered by multiple testers, then there is reasonable confidence that any malicious actor's failure to disclose a vulnerability will still be reported by someone else.

But if that figure is less than 100%, and especially if it is considerably less than 100%, then there is much more doubt cast on another pen tester in your organization's ability to find the same vulnerability. Here you have a problem.

The app and api are on the internet anyway, so you don't need to be a pentester to test it w/ no intention of reporting.

You don't need to be, but there are some big advantages:

1. You get to test the flaws in an environment where nobody will raise an eyebrow. If you go straight for the production system, it is likely your early attempts will visibly show up in the logs.

2. You get paid to carry out malicious deeds. That's a double win.

It would be kind of silly not to.

I think it would be silly to do so. You're pulling down $20k+ contracts for a week's work. It's a pretty good gig and completely legal.

Why do you think it would be silly to take the job?

The second two sentences read like excellent reasons why you should take the job (even if they are just a repeat what I already said in different words).

I must have missed something.

I meant silly to use exploits find while performing a pentest for malicious purposes.

You get well paid and it's legal.

Then what do you need pen testers for? With an offer like that, any threats to your system will come work for you instead.

The reality is that you don't get paid well if the data is worthless. You only get paid well when the data is worth orders of magnitude more than what you're being offered. If you are inclined to break that law, that's a pretty nice carrot dangling there.

If you are so inclined, why wouldn't you take the job and report the not so crafty exploits to bring in the sweet, sweet paycheque and use the really juicy exploit to also go after the even sweeter data? It's a total win-win situation...

...unless you get caught, but if you are so inclined that's not exactly on your radar.

My claim is that people tend not to do crime if there's a very well-paid alternative, and I think I have pretty good empirical backing on that one. Also, our data is probably not worth that much. We do pen testing so we don't get popped and leak our customers data, likely losing some of our customer base (even if it isn't worth much, not having it leaked is); because soc2 essentially demands it; and because smart customers care more about pentests done by good firms than soc2.

Exactly. So what do you need pen testers for[1]? Just pay the 'bad guys' to go away.

[1] Okay, regulation, but the need for such regulation is still in question.

>What percentage of the vulnerabilities discovered are independently discovered by multiple pen testers?

I'd warrant nearly all of them, though it may take a while.

If you have ever submitted or worked with a bug bounty program you will run into dozens of duplicates.

I've personally performed and overseen assessments in which the company had already done a complete blackbox pentest and wanted a second whitebox review to make sure the first company knew their stuff and validate they found the same bugs. Also did a few of the honeypot assessments in which companies put purposely vulnerable code in to make sure 'we are doing our job', I hate those most.

Depending on the testers speciality of course, the reports often found the same or similar issues.

Source: 15 years as a pentester, offensive security engineer, and now security architect.

> I'd warrant nearly all of them, though it may take a while.

Why guess when the other commenter has the actual data...?

What commenter had data?

The one we were originally talking to before others started randomly interjecting with gobbledygook.

His eventual response was 0, by the way.

> What percentage of the vulnerabilities discovered are independently discovered by multiple pen testers?

Zero because we patch them as soon as we are notified. Generally at the end of the test / before the retest, but if they found something serious they would notify immediately,

Patch production, sure, but naturally you would leave them in the pen testing environment for some time in order to collect data. No data and you’re just guessing. That’s fine for amateur hour, but not business.

It's relatively common to have pen testers attack a cloned environment w/ sanitized data. This is especially true in cases where your policies (or those you've agreed to from customers) require you to present evidence that you are having a pen test done every X years.

access to live data for testing is also a compliance question -- as in, don't do it, and why are you doing it?

why are you not using cloned or dummy data?

You said in your post it was not drug-related, but here you say it was a bad psychedelic trip. Which is true?

I meant drug sales, thank you I updated

“Gotcha! No hire!”

You should try to petition your state governor office to get the felony removed. It is a long time consuming process and will likely need help from a lawyer, but I have friends that have successfully gotten their felony removed after several years of diligently trying again, and of course good behavior in the mean time. It may never happen, but might as well give it a shot, it can’t hurt.

Reply on news.ycombinator.com