• 0 Posts
  • 106 Comments
Joined 1 year ago
cake
Cake day: July 2nd, 2023

help-circle
  • What about this scenario:

    • you keep your main garage door, side doors, and windows locked
    • provide a key to anyone who wants to borrow your lawnmower or whatever
    • someone discovers a window you mistakenly left unlocked and starts using it to take stuff without using a key

    Would this be considered breaking in? Probably. Here is where the analogy breaks down; if I were to leave the front door of my house unlocked, even if there’s a welcome mat outside, anyone who enters without my knowledge or consent can be charged with breaking and entering (yes, even though no actual breaking is involved).

    The interesting thing with public APIs is that there are generally terms and conditions associated with creating an account and acquiring a key, though if you are hitting an unauthenticated endpoint you technically never agreed to them. In this particular case with Authy, it would probably be argued that the intent was to acquire data by exploiting a vulnerability in the custodian’s system and use it for nefarious purposes or profit. I’d call it a hack.












  • It’s an odd position to be in; I work in the private sector but my company deals almost exclusively with government and NGO contracts, so at times I feel like I’m public sector.

    What I’ve noticed is that even though the desired outcome is nearly identical for both sectors, the buzz words associated with each is what determines who responds to my job applications. As an example:

    Private: IaC and Policy-as-Code, supply chain and software composition analysis, SAST, DAST, etc.

    Public: Compliance automation, risk management frameworks, risk quantification (this one has generated a lot of excitement recently), etc.

    This is purely anecdotal, but you may find adjusting your resume to include some of these buzzwords as applicable to the industry to which you are applying may help you get your foot in the door.

    To reiterate, yes I know in the end all of these companies strive toward the same goals, whether it be passing audits or being able to demonstrate prudent security practices to clients, sometimes the hiring manager is looking for specific terminology and will discard any applications that exclude it.