"We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system..."
I guess whenever I read this kind of statement from now on I'll be thinking of HBGary and chuckling a bit inside.
I guess whenever I read this kind of statement from now on I'll be thinking of HBGary and chuckling a bit inside.
I don't mean to impune the capabilities of the people involved (I don't know who they are,) and it isn't to say that you can't find some AMAZING talent in the government realm, but as in all fields, it's the exception, not the rule.
Fast-forward to the class, and we're sitting there running tools like BackOrifice that exploit vulnerabilities that had been patched for years, and learning that a SYN flood is "a malicious attack". That's it, just "a malicious attack". When I asked about the difference between a SYN flood and a Christmas tree attack, I got a blank stare and "they're both malicious attacks".
I spent the rest of the class in the back of the room, reading the Armadillo Book.
Also, I did not once in my brief Navy career get to hack an enemy computer. Hugely disappointing.
Like I said, it isn't all bad. Two of the best security guys I know work in the government, and one of them was actually ex-Navy. But the hurdle for finding people that can get top secret clearances AND tie their shoes often proves too high to hire anybody, much less somebody qualified.
Armadillo book: http://www.amazon.com/dp/0596003439