Maven911

Thanks spydum!

Thanks for the detailed response!

Asking the Hive Mind who might play with HTB, vulnhub and other labs (OSCP paid one):

1. Aside from: linux cmds, nmap, metasploit, sqlmap, mimikatz, kali's well known tools - what other tools are often used by pen testers ?

2. How is MFA beaten in today's enterprises ?

3. Do most engagements assume one is already in the network ? If not, how does one scan (basic OSINT towards their externally facing website, but let's assume that is very secure)

4. How well do pen testers know the defense side and amalgamation of so many defensive tools - how do they learn what to beat ? Is it really as simple as try to fingerprint and then look for known vulnerabilities on msf ? Or do pen testers not care if xyz enterprise is using this version of Palo Alto or a carbon black EDR etc.

e.g. Alphabet soup of products in a large enterprise for defensive solutions - NGAV, EDR, SIEM, honeypots etc. etc.

5. How do you keep up ? aside from Reddit

6. any advice to future job seekers working their way into learning more infosec ?

I've been trying to learn infosec for a few years now with the eventual goal of either an offense/defense role. Plan to work on my OSCP next.

I have a few basic questions please:

1. Aside from: linux cmds, nmap, metasploit, sqlmap, mimikatz, kali's well known tools - what other tools are often used by pen testers ?

2. How is MFA beaten in today's enterprises ?

3. Do most engagements assume one is already in the network ? If not, how does one scan (basic OSINT towards their externally facing website, but let's assume that is very secure)

4. How well do pen testers know the defense side and amalgamation of so many defensive tools - how do they learn what to beat ? Is it really as simple as try to fingerprint and then look for known vulnerabilities on msf ? Or do pen testers not care if xyz enterprise is using this version of Palo Alto or a carbon black EDR etc.

e.g. Alphabet soup of products in a large enterprise for defensive solutions - NGAV, EDR, SIEM, honeypots etc. etc.

5. How do you keep up ? aside from Reddit

6. any advice to future job seekers working their way into learning more infosec ?

Just to take a pulse, but am I in the minority that finds Quora to be a great great resource to learn on a variety of topics ? I know HNers are often critical so wondering what others think. Some say Quora's time has well faded and it is no longer used as much, but I'm not sure about that..

genuinely curious but how so ? because the true source IP address is masked ?

A bit of a tangent: as someone studying cybersecurity at a university in NYC and dealing with a range of topics: virtualization, forensics, incident response, defense, offense, CTFs, bounty programs etc. etc. And at the pace I am going at it (evening classes), it will take a few years to finish, and even then I might not start in the security industry right away.

I would like to ask, in your opinion, what is a good way to stay up to date, simulating as close as possible to real-world experience through hands-on self-teaching methods ? And what areas would you concentrate on personally, considering how vast the field is.

How much work was involved in the 3.5 years ? What tips would you say worked for you ? What do you think you do in your life that might have given you a leg up in cracking the puzzle ? (besides being intellectually inclined and adept)

Similar to not relying on cyberinsurance when things go awry, the field as a whole is in an interesting shape where on one hand there is a dearth of skilled employees (1 million globally supposedly, according to reports), and on the other hand companies that do not want to train IT works with the necessary cybersecurity skillsets to fill the gap, and in turn rely less and less on the red herring of cyberinsurance. Talking to my colleagues who are looking to break in, even after taking training/seminars, which can be quite pricey, employers will tend to hire for junior roles at best.

I thank the author of this article - this happens all too often in the industry where it starts sliding into dealing with massive egos rather then actual improving teammates, coaching and truly helping the codebase.

Use to work in this space more in the 2G-3G era and a bit of 4G in packet core networks.

Interesting space and would love to know about how I can keep up (will shoot you an email if you do not mind)

A few semi-random thoughts: -Initially Huawei had that reputation of stealing back in the days when they were caught reverse engineering Cisco router OS code -They are also known to throw tons of people to any network issue including bespoke on the spot fixes (which would be a nightmare for support engineers, imagine a worst case where every client is running a specific version of code from all the hot fixes and custom patchs) -Growth in revenue has been unbelievable from the above. And yet their core equipment is banned in a few countries (US, Canada, Australia). A true Chinese success story.

Other thoughts: -NEV is a tough space, margin rates are so low yet your hip phone manufacturers are making bank $ -The patent wars are very real with a number of companies that are not not equipment makers (e.g. interdigital) that just collect royalties

If an ssl cert is expired on a website, you don't have access to the secured website. In this case though, how does it affect Ericssons telcom equipment (core routers and switchs for mobileand voice) ?

I've been researching this topic for some time now, alternative data, and not surprised since Nasdaq is a large provider of software (e.g. market-making sw amongst dozens of other sw):

QUANDL SPECIFIC: -Quandl has a pretty decent blog that I would check out, you never know what new large corporate policy enacted might get rid of it: https://blog.quandl.com/

GENERAL NOTES:

-More and more asset managers are using it and there is some worry that everyone is making the same conclusions off the same data set, and thus no money to be made. Though most practitioners say this is a none-issue, there is more and more alt. data sets out there to chose from, cleaning the data is tricky and testing the veracity of the data provided and knowing how to combine it with others sets is a key competitive advantage that not every asset manager is good at.

-The ROI is something that is top of mind but not always easily attributable throughout the year, e.g. one large insight very late in the financial year can bring +100x returns on what was paid for a data provider's software.

-Hugely successful funds like Renaissance's Medallion has likely been doing this for a long long time, coupled with top PhDs looking for a lot of statistical correlation with traditional data as well.

-More and more data sets that are being created and thrown into a self-learning financial model (aka AI) have a lot of people excited, and certainly there are a lot of small funds being created, though seems to be mostly by young people or not-so-great hedge fund managers. Getting large investors to lay down significant capital has a huge trust component to it, aka want to bet only on succesful grey-haired largely-male dominated folks -A lot of alternative data can be found directly from the Bloomberg terminal e.g. MAPS <Go> function. However my understanding is that it's not that deep, quality is an issue, and everyone has access to it (no real competitive advantage).

I'm taking cybersecurity classes in NYC recently and granted we touch upon the topic of how to think like a bad actor but most of the curriculum is just trying to keep up with the myriad of topics we need to go over to cover our bases. Thinking like a bad actor is indeed one of those topics that is very hard to explicitly teach, besides already well-known techniques, and angles of attack.

A few things I've noted of the more successful students:

-Students who do well already tend to have a huge passion for the topic before they ever showed up for day 1. I know it sounds obvious but those folks do not need the class, however on the flip side they are the ones who enjoy it the most too. Even when its not employer reimbursed tuition, they are getting the most satisfaction out of the class, despite knowing this stuff already.

-Participating in CTFs and online "Hack this site" and paid labs is a thing they do. No one does bug bounty programs but that's the next level up or dream.

-They pickup small nuances the teachers mention and start researching it right away, nuances that do not get registered by those first learning the topic, or ignored by those who think they know it all already

-Keeping up with daily news is a breeze since it's not a chore for them

-Anyone who mentions the reason they are taking the class is to gain a broad picture understanding e.g. to understand what the tech sec ops are doing, or for better decision making, or even to give better "orders" to their info sec teams (risk mgmt., audit, investigation, standards builder) tend not to know the material that well. Their reasons are fine, and ultimately they will get what they aim to achieve, but not only does it feel diametrically opposed with those who want to learn even more from the class and get their hands dirty, it slows down the class to their level, when they become the majority (not all classes have the same makeup of student profiles).

-Ultimately, it's what you put into the class. Your project can be a bobo I've researched 5 articles before presenting to I want to challenge myself like no tomorrow.

Try listening to a police scanner on broadcastify. I like the nypd bronx ones, its the sufficient level of quiet dead time with some action too.

There's a similar company in NYC that grows in shipping containers called Square Roots. They are planning to expand across the U.S.

I am nearing that age, but the displeasure started several years ago. I find myself a bit trapped with a a place where I am marrying 2 specialties that tend to go together, and that in theory should be an ideal job. But hte people, politics, and lack of genearl teamwork have left a sour taste. And it's not like I am ready to give up the money I save (I make a bit more because of the industry but still a lot less then others in this field). And since I am on an immigration visa, it's not as easy for me to hop around from place to place. A bit lost at what to do. Its not as if I am not following my heart because I think I am, I just do not like the environment, nor will it be any better at another unknown place.

Speaking of which, any suggestions on any good books on anxiety from the HN crowd?

I would love to work with you or bounce off some ideas on how to changeup the somewhat legacy legal tech

Aren't surface covers $100 though ? So that would be a $500 (400+100) in total.

And some pens are $40 though not everyone needs the pen.

i feel i am in the same boat. any tips that have helped ?

Just wondering, the last time I touched DSPs was in EE school. How can I keep up interest in the field if I am working in a seperate field? Any good resources and projects worth undertaking?

This is such a wow moment for interdisciplinary research. Most have hears of analyzing ice cores but this is unprecedented in it's level of detail.

How do you take care of not getting Lyme disease, are you always in the look out for symptoms?

You don't happen to work at a large bank do you? Many friends at banks say this is common place.

Yes having witnessed it myself, it's tragic the self inflicted wounds Montreal takes, while peoplr still pretend it's a tech hub (only in the tiniest of sense)

And better weather and the cachet of being in a world city.

The brain drain has been going on for decades now... But lately, the general Canadian media has claimed there is a reversal. One case in point is Montreal being proclaimed an "AI Hub". It's considered an "AI hub" mainly because of one of the fathers of AI is from there (and one his students coming up with the concept of Adversial networks) and a few companies opening satellite AI branches such as Google and Microsoft. Nonetheless, that likely amounts to a few hundred jobs at best, involved in cutting-hedge AI/ML/DL. Toronto also has a few well-known AI research centers. And these centers haven't seemed to have produced noticeable concrete results. But only time will tell if these pan out, and more importantly produce enough jobs to keep local talent, which in my mind is still very doubtful.

Anyone work on something strategic that not only encompasses technology but a shift in how the business operates, does business with it's customers etc

This is very cool, thanks will sign up!

I am also interested in that space and would like to pick your brain on: what do you read to keep up in this space? Personally, I follow Crain's, and CREtech.

And speaking of cap rates vs. multiples (valuation per sq foot), wsj had a great article on the Wework business model on how artifical it's valuation seems versus traditional office-leasing: https://www.wsj.com/articles/wework-a-20-billion-startup-fue...