The DMZ

Rhino

22:03

@RoryAlsop I think for large companies, not much. Graduates or 5+ years' experience.

Rory Alsop

That is true. Large corporates are unlikely to be available. HR will block you at the first hurdle - so you need to look at other options

Steve DL

@RoryAlsop sure. Let's talk tomorrow during daytime if you'd like? I could probably advertise your visit to our current MSc students if you want to come in with internship/job offers. They're currently doing their MSc projects. I can also present you to my colleague in charge of the MSc

(we have socials on thursday evenings so it's a good time for me to catch him and discuss visits)

Rory Alsop

That would be useful - if you can ping me your contact details we can get a chat so you can see the 3 areas we hire into at grad level in security and risk.

Steve DL

I added you on LinkedIn. My email address is [email protected] / [email protected]

Rhino

@RoryAlsop Yeah. I'm gonna go do something else I think.

Rhino

22:26

I have trouble enough getting people to take me seriously in programming and I have a 20k SO rep.

Rory Alsop

@SteveDL - thanks. Have accepted and will write you a note later.

@Rhino - have you created a careers.so profile to showcase that stuff?

schroeder

I have CISSP, CISM, and years of experience - is CRISC superfluous or a useful differentiator? Would the C|CISO look funny to employers?

Rhino

@RoryAlsop Of course.

Unfortunately my experience is in uncool languages like C++ and uncool ideas like device drivers. Of course, it's trivial to learn java or C#

ah well

got to go. Real life calls.

Steve DL

22:42

Funny how everyone loves C++ but noone gets jobs with it -- though, MS decided to ditch .NET for C++ in Windows 8 app development!

Rory Alsop

22:55

@schroeder you've seen my presentation bit on the value of certs? CRISC very useful in my team, as is CISM

I have C|CISO, but not sure where it would be useful in current market. It may be for my next move

Steve DL

/me makes careful notes...

Rory Alsop

Stack Exchange Security Blog: Presentations: Starting your security career – where can you go?

roryalsop on March 28, 2013

I gave a talk on career planning in Information Security at Abertay University on the 16th of January 2013.

Securi-Tay is an annual security conference organised by students at Abertay and is a very well organised and run event – could put some professional conferences to shame!

Video of my talk

The talk went down very well, with a lot of discussion spinning off afterwards, and the odd additional visitor to Sec.SE

Most of the video should be straightforward, but a couple of the slides may be hard to read so I have included them here: …

Steve DL

Ah! Thanks Rory

Rory Alsop

@SteveDL For my current team (and the one I led in EY) I have a list of essential certs like these, plus tech certs and business/soft skills - and balance them accordingly. In my current role I'm a part of Op Risk, so CRISC is very useful. In 1st line roles, more of a bias towards CISM/CREST etc

Steve DL

Right. We never really heard of certs at my uni. Also I did a MRes for my last year and went straight for a PhD so I was already a bit disconnected...

Rhino

23:01

@SteveDL I saw this... I'd actually say there are quite a few jobs in it, just less than other languages like Java.

There's two variants really - finance companies who do C++ on Linux for "performance".

and people who have to because they need to work with some existing technology e.g. drivers.

Steve DL

@Rhino that's fine by me, I can't deal with the fact that Java doesn't have things such as multi-inheritance. Every time I write half-serious code, that one comes up to bite me.

Rhino

My personal frustration is probably more related to hiring practice than anything else; when Rory said big companies won't look at you without a degree that applies to programming too.

The moral of the story is don't drop out of college/university.

Steve DL

@Rhino the best jobs are not advertised anyway. Sadly enough, networking is important, and getting to talk to team managers and tell them how they need you might land you a job

Rhino

@SteveDL yeah

Steve DL

I've had opportunities often because I went out of my way to talk to people whom I had no idea would give me work

Thomas Pornin

23:05

@SteveDL Java forces you to realize that there are two kinds of inheritance: inheritance of types (also known as sub-typing) and inheritance of behaviour.

Java has multiple inheritance for the first kind (with interfaces).

In C++ you tend not to notice that the two kinds exist and are distinct.

Steve DL

@ThomasPornin that is true indeed, but interfaces require that I re-implement all functions.

Thomas Pornin

@SteveDL So it is. But I find it to be rarely an issue -- unless you are afflicted with a very common disease, where you define 15 methods instead of 1 or 2 for the same functionality.

Terry Chia

@SteveDL More often than not multiple inheritence is a sign that your code design is overly complicated.

Rory Alsop

@SteveDL I'd have to agree with this @Rhino - get along to events, BSides, Rants, Infosec, 44Con etc. It really helps!

Rhino

@RoryAlsop I'm doing that in CH - so far nada.

Same deal as always... all roads lead to HR.

I'd go to bsidesmcr if I was still in MCR; if I go back to the UK I might wander along

Rory Alsop

23:11

@Rhino CH?

Terry Chia

@Rhino You need to interview at hipster startup #15783. They don't have HR departments. ;)

Rhino

@RoryAlsop Switzerland

Rory Alsop

@Rhino ah - sorry, yes

Switzerland appears to be an interesting one - lots of complications to working there

even when I was in Big-4 it was complex

because I am not Swiss

Rhino

No worries, it's confusing, they have four national languages so to make everything simple the official country name is in latin.

Rory Alsop

(although I do like Toblerone)

Rhino

23:12

@RoryAlsop It was complex. It hasn't been since they joined the schengen; I have a work permit in any case

It may get more complicated in the next few years though since this:

Swiss immigration referendum, February 2014

The federal popular initiative "against mass immigration" (German: Eidgenössische Volksinitiative "Gegen Masseneinwanderung", French: Initiative populaire « Contre l'immigration de masse », Italian: Iniziativa popolare "Contro l'immigrazione di massa") is a Swiss federal popular initiative. It aims to limit immigration through quotas, as it had been before the bilateral treaties between Switzerland and the European Union. The proposal was launched by the national conservative Swiss People's Party and was accepted by a majority of the electorate (50.3%, a difference of 19,526 votes) and a majority...

Who was talking about the UK and immigration earlier?

Steve DL

My partner is there right now for an internship, even though she has a work permit in Germany where she normally resides, she has had to wait for four months to get her stay permit delivered, and was told she couldnt leave the country until then...

Rory Alsop

I had to deliver everything formal through one of my colleagues (who wasn't actualy Swiss, but could commute across the border from Germany) because I wasn't based locally. Despite the client sitting at the same table as us...

Steve DL

Ah well.. the joys of immigration...

Rory Alsop

Just reading your bio page at ucl. Interesting research. Oh - and sent you a wee email.

Rhino

They do have some crazy rules here. I don't notice it so much because people don't assume I'm foreign (I'm in the french zone speaking french) and I have I permit in any case.

Steve DL

23:19

@RoryAlsop i got that, was about to reply!

@Rhino if i recall well, the french area was more in favour of immigration than e.g. Ticino? Last time I met a French speaker there I was clearly told I wasn't welcome, by a restaurant waiter! That was kinda funny.

Rhino

@SteveDL Yep, the french areas voted for immigration.

That said, you can get a hostile reaction here too.

Steve DL

Indeed.

Rhino

@SteveDL Hmmm interesting confinement on desktops eh?

Steve DL

Yes indeed.

When I was an undergrad, I did my school projects with a team that built a MAC system that reuses SELinux's type labelling system and enforces policies on sequences of calls rather than atomic calls

essentially trying to do IFC with a DTE system

the basic principle kinda worked, but it was horrible to configure and use

so that pushed me into usability research

and i've come to realise that absolutely none of the tools developed for confinement are evaluated for usability

mostly now, i'm collecting data on desktop systems to be able to reason about the fitness of all confinement models' representations of domains with what's going on in the real world

looking at confinement from a cost-of-setup and cost-of-use perspective

i'm also building more generic theory for usable security research with colleagues who specialise in other areas

Rhino

@SteveDL you can say that again. It took me a long time to work out how to make sensible additions to selinux policy; even now I'm not sure it's really easy to understand it

essentially it's not just a mechanism, it's also the base policy which you must understand to be able to use it

Steve DL

23:34

SELinux is still relatively conceptually simple... the issue is if you want to confine anything non-trivial, it takes tens of thousands of lines of policy

and you really need to remind yourself what it was you were trying to achieve

when i was still studying in 2011, I did a project where I compared audit2allow-made policies for acrobat reader to a basic XXE exploit, and I could retrieve any plaintext file from /etc, including /etc/passwd (which now ships with a unique label on Fedora systems, if I remember well)

Rhino

@SteveDL indeed. That's what I'm getting at. Essentially to understand a working system (as opposed to just the idea) and do something with it there's a lot to understand (existing policy unless you intend to start from scratch) and do to make whatever you want to confine confined.

Steve DL

the main issue behind SELinux and similar systems is that they separate policy expression from use, and they cannot reason about the context in which apps are running. my PDF reader doesnt need to access all my documents, or even all my PDF files. it only needs to access the ones I want to open, when I want to open them. Now both OSX and Windows 8 implement some level of contextual awareness in their sandbox models, but it's still very superficial and not evidence-driven

Rhino

@SteveDL password_file_t, yep

Steve DL

i seem to recall acroread 7 actually looked up the file, for some reason.

but at least when checking up your audit2allow, password_file_t really sticks out

i really should've published that back then though...

Rhino

@SteveDL I'm not surprised, audit2allow you do have to check what you're allowing...

Steve DL

23:39

anyway, Dan Walsh always said not to use SELinux on desktop, yet everyone someone asks about Linux security, they get told to install SELinux and/or AppArmor

s/everyone/every time/

Rhino

@SteveDL Well he has a huge point; most of the stuff I run is unconfined. Oh and X11. XACE never really took off

Steve DL

you cant use XACE for any serious purpose

the primary issue of X11 is that the API is naturally insecure

it breeds insecurity

and, if you wanted to do something as simple as mediating X11 selections, you'd notice that the server itself also throws a lot of events on the interface for internal operation

and reasoning about whether to allow an X id or another to call a function on some arbitrary data blob is a bit difficult... the project I told you about that I was involved with, the main developer actually had to fix some bugs in XSElinux to do something as simple as default-deny on all X11 interfaces that allowed some form of IPC

so, our resulting desktop had no clipboard

actually... self-promotion: github.com/mupuf/libwsm

Rhino

@SteveDL Yeh. I think that's the reason why the x11 sandbox for fedora basically invokes a separate X server; there's no way to actually do access control inside X11

@SteveDL I was going to ask about wayland actually

Steve DL

i'm involved with Wayland via my friend Martin, we've built a basic architecture for permission handling for Wayland (the X11 successor). I think someone's now implementing this in the reference implementation of Wayland, and of course we still need to discuss and implement default policies -- but at least with this stuff we know we can build modern mechanisms such as trusted UIs for permission handling

@Rhino i propose projects every year to students to work on Wayland but they dont pick those up :p

Rhino

@SteveDL they should. Wayland shipped in F21 and will probably replace X11 in Fedora and therefore RedHat

Steve DL

23:46

Well, it's too bad not even half the work on Wayland is finished

Rhino

@SteveDL Yeah well... minor detail!

Steve DL

actually, GNOME really rushed to get it running, but interfaces such as clipboards or fullscreen are, afaik, not standardised yet

Rhino

Who needs clipboards? That's so 1995.

Steve DL

and the issue there is... the clipboard API is insecure beyond repair. You cant possibly copy/paste data to/from a password manager as it is right now

attacks have been demonstrated on the Android API which is identical in design to X11 -- every app can pull the contents of the clipboard at any time

Rhino

@SteveDL Copy-paste is a difficult mechanism to secure anyway, unless it's more post to application-specific clipboard.

Steve DL

23:49

well, it's a matter of only giving clipboard data to an app when the user said this app should be pasted into via a trusted path

it starts very simple

Ctrl+V -> trusted path (also that's a neat UX trick since really, there should not be any app that uses a custom keyboard shortcut (sorry emacs users))

and then you'd think that you can create a simple embedded UI run by the OS that apps can add to their contextual menus and that reads "Paste"

and then you'd realise that plenty of apps implement some sorts of "special paste", and "paste as kitten", etc

and you'd think "let's allow apps to use custom labels"

and before you know it, "click here to earn 1000 dogecoins" pastes your clipboard content

well, not that there is a very big attack surface for paste...

but i seem to recall OS X permission UIs used to let app developers change the name of the permission they asked for

(actually need to check that one)

and, when you build embedded UIs for picture taking, or screen recording, you'd start wanting to have better assurances that custom labels are not misused, or that the enforced labels fit all existing use cases

that's not very interesting research because it boils down to being pedantic about user experience and UI details -- something which many security engineers downplay.

Transcript for