• Cornelius_Wangenheim@lemmy.world
    link
    fedilink
    arrow-up
    164
    arrow-down
    1
    ·
    8 days ago
    1. No one’s hiring you unless you have an OSCP or similar certification.
    2. A real pen test will set off all kinds of alarms.
    3. You don’t get paid until you deliver a 100+ page report detailing what you did and your findings.
    • Echo Dot@feddit.uk
      link
      fedilink
      arrow-up
      33
      ·
      8 days ago

      You hope it’ll set off alarms. Sometimes it doesn’t, mostly because they don’t have monitoring setup.

      • Cornelius_Wangenheim@lemmy.world
        link
        fedilink
        arrow-up
        23
        ·
        8 days ago

        Pen tests aren’t cheap. Even basic ones are ~$20k. There’s only 2 types of companies that bother with them: ones that care about cybersecurity and ones that have to do it for compliance (PCI/CMMC/etc). Both will have some kind of IDS and a SIEM.

        • Echo Dot@feddit.uk
          link
          fedilink
          arrow-up
          2
          ·
          8 days ago

          That’s what happens when you do off the book stuff on company time. Got to organize yourself better.

    • ameancow@lemmy.world
      link
      fedilink
      English
      arrow-up
      24
      ·
      8 days ago

      You’re implying that people who post on 4-chan have no clue how the real world works and no idea what business is like and how people make money!

    • Captain Howdy@lemm.ee
      link
      fedilink
      arrow-up
      24
      arrow-down
      4
      ·
      8 days ago
      1. Most folks dgaf about certs, and I agree with them. Certs are BS. I only have certs because employers paid for them and in tech (especially security) there’s a LOT of free time if you know what you’re doing. Certs only prove you can pass a test.

      2. Bold of you to assume most companies have intrusion detection systems and that their monitoring isn’t muted half the time.

      3. Findings come from an automated report generated by a scanner that does literally all the work.

      OP post is really not that far off. It’s an easy gig.

      Source: I’ve worked on both sides.