Comment by nicce | Hacker News Reader

Comment by nicce | Hacker News Reader

Parent Full thread

> Most of the work is preventative.

Current work culture is bizarre in cyber security. I am not personally very fan of it.

Nobody wants to work on defensive side. You are not getting either fame or money if you do your work well. The expectation is that you do your work perfectly. There is no actually measurements in place to prove that your good code prevented 100 data breaches!

But on the other hand, if you are on offensive side, sometimes find cool bugs, you get fame and money. Does not matter if there is a long break sometimes. Your goodness is measures based on how much money you got.

What does it mean? People start doing bug bounties. They hoard tools only for themselves to make more money, instead of releasing them to improve general security. They keep small bugs themselves so that they can be used in exploit chains to get bigger bounties.

If the reputation of the company is based on the participations of the bug bounty program, they start doing less and less in-house engineering and outsource the cyber security testing for bug bounty platforms.

And vicious cycle starts.

Plenty of people working on the defensive side are famous, sometimes even more famous than those who do offensive work. Take, for example, Google Project Zero, or the numerous people on “infosec Twitter” who are almost invariably doing defensive work. People who do exploit development tend to be a lot more quiet about what they do and where they work.

I think Project Zero would count as offensive work in this regard; they are actively trying to find problems in other systems, rather than trying to stop other people trying to find problems in their systems.

Project Zero is an offensive team doing defensive work.

But their work is essentially penetration testing and exploit development. That usually counts as offensive side. They are not designing and building secure-by-design stuff, for example.

They are known for breaking stuff, and everyone wants to be the same.

Goal might be defensive in everything cyber security researchers do, but that was not my point.

Project Zero is not defensive. Infosec Twitter has both sides.

I do agree with you that defense is a large part of the industry. My perspective is even that most organizations are looking for “defense” roles. The field is very wide (e.g., folks working on cryptography to sec ops).

It is defensive, but for the best guys out there, the carrot is on offensive side. You are not getting rewarded for doing perfectly secure systems, unless you work in very big company.

It means that most of the average guys build defense, and then the best guys test them and pick the money when something is found. While we could prevent most issues if those best guys help on building the systems instead.

But they have no motivation, because they get more money from other things.

I think that you might actually observe that finding attacks on systems is common, while developing a “perfectly secure system” is much harder to do, if not impossible.

Your view on cyber security seems to be painted by bug bounty programs. But I agree that the offensive side is more sexy than the defensive side, but it easy to forget that in the end, we are all really working on defense

Reply on news.ycombinator.com