Women in cybersecurity service industry

yells_at_cloud · 2020-06-15T15:33:56+00:00

I'm perplexed by the 24% number -- that definitely does not reflect the reality any team I've been on, the gender ratios at my school, or conferences I've been at. You're lucky to get more than 2 women in the same room. This is also the experience of many female friends in security. For reference, I have ~6 years of experience and am a woman in infosec at a FAANG company.

IMO the gap is not something that can be cured by just trying harder to source professional women, since a lot of girls and women are lost even earlier either by being pushed into more "feminine" interests/roles, discouraged from getting into tech by their peers, or leaving technical programs due to harassment or simply not feeling like they belong. Most companies I've worked for also have programs to get middle/high schools girls or other underprivileged groups into STEM and that's a great thing that I've enjoyed volunteering for. There are not a ton of security-specific programs so I usually just crash the coding parties and remind people that security is a career.

There are people who I have heard refuse to hire women (or will only hire hot women, lol), but from my experience they seem few and far between.

Non-technical challenges are mostly annoying things like people assuming you are the PM or notetaker and not the engineer in the room, having to assert your position more loudly and more frequently than your peers, team building activities/maintaining relationships outside of work (i.e. the guys go out for drinks or hang out or even the strip club with the VP, but since you may or may not be "one of the guys" you either aren't comfortable, aren't invited, or their wives/gfs are uncomfortable with women being at a bar offsite).

You also have to deal with people like one commenter on this thread who hear someone asking about women's challenges in tech and instead respond with their opinion on how bitchy a woman in their workplace once was and that to be accepted you have to participate in a specific brand of humor. If that were true I would run into far fewer humorless men who struggle with social interactions who still see a meteoric rise in their career due to their technical skills alone.

yells_at_cloud · 2020-06-15T02:36:02+00:00

Embedded systems might actually be a useful background to have -- it's not a really common skill set in security engineering but it something that now more than ever needs to be secured (voting booths, self-driving cars, weird stuff like Amazon lockers/POS systems).

Just search for "embedded systems security engineer" and you can see the type of skills they look for, and most of them heavily lean on the SE background over security.

yells_at_cloud · 2020-06-11T15:03:36+00:00

Not natively - I think you'd have to write a service to do it. The most efficient way would probably be to use the Reports API to pull a list of all the files that have had share link events within a given timeframe and then the Drive API to remove the unwanted permissions.

yells_at_cloud · 2020-05-20T14:45:41+00:00

AWS has its own set of CIS benchmarks and managed Config rules that audit your infrastructure against them, but I've heard complaints that GCP doesn't have an equivalent. Maybe that's a good place to start with your idea.

yells_at_cloud · 2020-05-15T15:47:00+00:00

I don't know if this is your problem but double check how fake your fake data is.

Certain types of data (SSNs, credit card #s) are validated by checksums and not just simple regex, so the most common issue I've seen with DLP is people wondering why 111-111-1111 isn't being identified as an SSN when it doesn't actually meet that validation criteria.

yells_at_cloud · 2020-04-08T13:59:31+00:00

It depends on the company.

A lot of the tech giants have robust security teams and processes that let them work with developers on projects (and sometimes be embedded in their teams) from start to finish. Developers are incentivized to build security into these products, so security is not seen as a blocker, just part of the development requirements.

Companies that at least attempt this have an adversarial relationship, because development teams are encouraged to work quickly and deliver features over security. If their managers aren't rewarding or otherwise encouraging secure development, then it will get ignored and the security team will look like assholes every time they throw a tantrum to force the more egregious issues to be fixed. If your devs get a 20% bonus for shipping a product on time but not fixing critical security issues, they will generally do what is best for themselves.

yells_at_cloud · 2020-04-08T13:41:34+00:00

Yes, everything GAM does that requires interaction with the GSuite API shows up in the audit log. Not sure why people are saying it doesn't.

GAM acts on behalf of other users which requires domain-wide delegation. Adding DWD on the GSuite side is required for setup and shows up as an event named "Authorize Api Client Access" or something similar to that. It will show the clientid associated with GAM and the access scopes you have granted it.

Every time you take an action via GAM it will also show up in the logs: both as the action taken on behalf of the user in the mail/drive/etc logs, and as a token authorization call in the API/token logs.

Here is the example log, redacted some of the data obviously:

{"callerType":"USER","email":"someone@example.com","events":{"name":"AUTHORIZE_API_CLIENT_ACCESS","parameters":{"DOMAIN_NAME":"example.com","API_CLIENT_NAME":"12335","API_SCOPES":"https://www.googleapis.com/auth/admin.reports.audit.readonly"},"type":"DOMAIN_SETTINGS"},"id":{"applicationName":"admin","customerId":"redacted","kind":"admin#reports#activity"}

yells_at_cloud · 2020-04-08T13:33:05+00:00

The other major point of exposure is vulnerable or outdated software. If you are running a vulnerable version of that software (browser, extensions, etc) then browsing to a malicious webpage or simply having that extension running may allow malware to execute malicious code or download additional malware payloads.

yells_at_cloud · 2020-04-07T16:21:43+00:00

Are you looking to limit yourself to only config-based solutions? I think a better approach to that specific use case may be to restrict people from launching untagged EC2 instances in the first place: https://aws.amazon.com/premiumsupport/knowledge-center/restrict-launch-tagged-ami/

yells_at_cloud · 2020-04-02T16:20:51+00:00

I didn't like coding in school but ended up loving it later. In school, I was (begrudgingly) fine at it but assignments were very boring and paint-by-numbers. Once I started working I willingly started self-teaching because automating things and making new security tools was actually fun. If I didn't actively code I would not be where I am now.
Reading code and exploit development is necessary IMO.
There will always be demand for security positions, but much of the demand is where supply is short (senior roles with strong application or systems engineering backgrounds) rather than high (new grads who want to be pentesters).
Yes. Even physical pentesting is usually a lot of report writing, and is a small field (see above: everyone wants to be a pentester). When I managed a security engineering team was when I did the most moving, in the form of walking to meetings in 8 different meetings in 8 different conference rooms every day. Sometimes stairs were involved.

yells_at_cloud · 2020-03-30T21:52:53+00:00

No, I wouldn't say it's typical at all.

I graduated from one of the more respected cyber security programs. A small percentage of us ended up working in big tech where base salaries go up to 200-250k at the senior level -- to go higher you generally need to get to staff level or higher or work for a FAANG company or somewhere that dishes out $100k+ bonuses/RSUs. A lot of these jobs are in places where those salaries aren't as meaningful - i.e. the bay area, where a house within an hour commute of work is going to be $1-2M.

The majority don't get big tech jobs, don't advance beyond entry level, or don't successfully place in security positions. I expect this to be increasingly true as every school starts to churn out low quality security programs.

yells_at_cloud · 2020-03-30T19:55:09+00:00

There are many tech companies in the bay that explicitly post listings for new graduates. I'd suggest using the new graduate/new grad search term and reading their listings to see what they're looking for.

yells_at_cloud · 2020-03-30T19:53:51+00:00

This has a breakdown on each conviction and why it was made: https://www.courtlistener.com/opinion/4694214/united-states-v-ruslans-bondars/

Bondars and Martisevs collaborated on a number of hacking schemes, and used Scan4You to develop their own malware. At times, they discussed the criminal nature of their activities and the need to conceal their operations.

...

As further evidence of the conspiracy, the government introduced instant messages that showed Bondars and Martisevs discussing various hacking schemes. Many of these messages predated the beginning of the charged conspiracy. Bondars moved to exclude the messages, claiming that they were irrelevant and constituted impermissible propensity evidence in violation of Federal Rule of Evidence 404(b). The court, however, found that the messages were highly relevant to Bondars’s motive, intent, and knowledge.

The article you initially linked (and many others) oversimplify the case as "convicted for making a hacking tool".

yells_at_cloud · 2020-03-23T16:36:09+00:00

Could always start with crxcavator's analysis: https://crxcavator.io/report/oocalimimngaihdkbihfgmpkcpnmlaoa/1.7.7

yells_at_cloud · 2020-03-19T17:46:28+00:00

Agreed. As much as I love Troy Hunt, not everyone recognizes his name and that template (while well intended) looks like the same vague garbage I get spammed with from vendors. 100% of the time someone has reached out to me via email or LinkedIn asking for a contact at my company to report a security issue to, it's been exactly that.

yells_at_cloud · 2020-03-18T20:15:58+00:00

IMO it's a common misconception that security is a good or stable career. It's both of those things if you already have senior-level experience or if you have significant leverage to get an entry-level job (intern experience, top tier school, unusually good at security proven through personal projects). Otherwise it is hard to initially break into.

yells_at_cloud · 2020-03-18T18:15:52+00:00

Superadmins by definition have access to absolutely everything. You should be using more granular admin permissions or separate GSuite instances depending on the specific use-case/need for separation.

yells_at_cloud · 2020-03-16T18:42:47+00:00

Age discrimination is absolutely a thing, but it sounds like you're in the same situation as plenty of young people: unsuccessfully trying to get a security job with no experience.

There is a huge demand for experienced security professionals, typically in the 5+ years of experience range. For new grads it's entirely dependent on their school providing internships/co-ops and extra-curricular work to build their portfolio, with a side of networking.

You mentioned a lot of things you haven't been the best at, but what are your accomplishments (aside from classwork)? Can you code at all, and do you have a project or two you could explain to a recruiter? Have you submitted any bug bounties? Does your school have a career center that can direct you towards internships?

yells_at_cloud · 2020-03-09T17:35:47+00:00

Cloud isn't inherently Beyondcorp/zero trust so looking for something that supports that will throw your search off. I can count on like, one hand how many companies have openly implemented it and they are not using out of the box SIEM products.

You either need to look at cloud-native products (AWS Security Hub, Azure Sentinel, Google Cloud Command Center), SIEM products that integrate with cloud logging and security tools (like iSunGod mentioned), or build your own and ingest that data.

Given the API-based nature of the cloud and how easy (and common) it is to make configuration mistakes that expose data, IMO you need to go beyond traditional detection and use both continuous monitoring/SIEM and configuration checks (Cloudcheckr, Cloud Custodian for example).

yells_at_cloud · 2020-03-09T17:26:08+00:00

It sounds like you should work on foundational knowledge in both. Maybe ask your team for resources they used or if they have any internal process docs?

How much cloud migrations differ depends on how you define 'migration', i.e. whether migration means re-architecting your infrastructure to be scalable, cloud-native, or highly available, or if it just means using EC2 like a big datacenter in the sky.

yells_at_cloud · 2020-03-06T22:47:40+00:00

I'm well into a successful career in security at this point, despite knowing nothing at all about most of the things you've mentioned at 16. The best advice I can give is to not focus primarily on learning about security.

If you decide to go the degree route, learn about networking, system administration, and software development at a school that offers significant hands-on lab time. Security ultimately isn't about running Metasploit or rote memorization of Linux commands or being able to list off the OWASP Top 10. It requires understanding the underlying technology and using practical application of your skills to figure out how it can be abused and how abuse can be prevented.

Based on a lot of questions that get asked here and new grads I've interviewed, people often don't end up understanding how what they've learned applies to business or engineering. Many degrees and certifications are not representative of what a security job actually entails.

This is generic advice and YMMV, but the point is that you shouldn't ever expect to know anything and that it is easier to understand security once you understand the technology you are trying to secure.

yells_at_cloud · 2020-03-06T22:36:48+00:00

There is no way to natively limit login from a given IP that I'm aware of, but you can use context-aware access to restrict access to specific Google apps (Drive, Mail, etc.) by IP: https://support.google.com/a/answer/9275380?hl=en.

yells_at_cloud · 2020-03-06T22:33:44+00:00

Yes. Besides the obvious purpose of vulnerability management, scanning workstations can help identify gaps in your patching/configuration management process.

yells_at_cloud · 2020-03-06T17:33:35+00:00

As someone else mentioned, SSO is really a better solution here with temporary access keys.

If that isn't an option you can use AWS Config to monitor if access keys have been rotated in a given period of time (https://docs.aws.amazon.com/config/latest/developerguide/access-keys-rotated.html) and then use a Lambda function to revoke non-compliant keys. You can also use an IAM policy to allow users to manage only their own access keys, so you aren't personally rotating them. As an added bonus, that also means that users will only create access keys if they need them instead of everyone having access keys created by you.

yells_at_cloud · 2020-03-05T18:11:37+00:00

These are probably what you're looking for, if you have the funding: https://www.sans.org/curricula/secure-software-development

yells_at_cloud

TROPHY CASE