Pentester Interview

[lupin]

I've got to say Lupin, it's pretty sad that under the current educational systems, that those skills have to be obtained at the university level. I'd say the first two are questionable; I've yet to see some with a university degree who still doesn't require a lot of on the job training, and as to sticking with school, it the reality for most students is it just means that Daddy kept writing the checks. A job history is a lot more telling in my mind. As to reading and writing, the basics should have been completed by the Eighth Grade (US). Personally, it's anathema to me that critical thinking should only be taught as a skill in postgrad courses. That is a life skill that has to be taught by parents starting with pre-school children.

The last one is the only thing that I'd expect to that a university should actually be teaching.

Yes, I'll agree that a lot of the points I made are soft points - there are good counterarguments against each of them, and situations where they don't apply.

While I do agree that in some cases that the bar for getting a University degree can be rather low, and some people may just coast along while the parents foot the bill, its still some level of achievement to get one, and you can at least make some basic assumptions about the level of intelligence and perseverence a person has to have to do so. And regardless of the fact that daddy may be paying for it, theres a lot about the University experience thats pretty unpleasant (tests, assignments, etc), and that fact that someone goes through with it for a few years without saying "fsck this" at least shows that they can spend some time doing things they dont like to do (and every job has some tasks like this). I think you can also infer a lot more about that persons level of drive when they pay for the Degree themselves or do it while working. So its a little circumstance dependant perhaps, but I think you can make some assumptions about a persons ability to finish something through to completion based on them getting a Degree.

Regards training in English, we get most of the basics out of the way by grade 8 here in Australia as well. However, while I was probably above average in my writing skills in year 8 (or at least not below average), I definitely didn't write anywhere even close to the standard that I would require to do my job now. I only got there after I completed my first bout of tertiary education. Its the practice that you get from having to write so much during tertiary education that does it I expect.

Id also never claim that a University Degree is any sort of substitite for practical experience.

And about critical thinking skills. Yes, I have a problem with the fact that they aren't taught in school - I think it should be taught from primary school alongside Mathematics and English. But while it is uncommon for these skills to be taught in school at all, my experience from doing a post grad Masters Degree is that being forced to apply those critical thinking skills to unfamiliar problems during the course really helped me develop those skills further.

Personally I wouldn't demand a Degree from a person who I was going to hire, but I do understand why some of the less imaginative HR people require them. By the same token thugh I also wouldn't completely disregard the benefits of a candidate having a Degree. Id regard it as an indicator (if not a definite proof) that the candidate had at least some of the qualities I mentioned above.

[hhmatt]

One of the university's and college's goals are to put you in debt so that you have to work the rest of your life to pay off this debt. I don't call this motivation.

"None are more hopelessly enslaved than those who falsely believe they are free" - Johann Wolfgang von Goethe

[compaq]

Personally I wouldn't demand a Degree from a person who I was going to hire, but I do understand why some of the less imaginative HR people require them. By the same token thugh I also wouldn't completely disregard the benefits of a candidate having a Degree. Id regard it as an indicator (if not a definite proof) that the candidate had at least some of the qualities I mentioned above.

Do you think all over the IT feild, not haveing a degree wouldn't be a stumbleing block, or more so in the security side.
The employees PR?

[lupin]

One of the university's and college's goals are to put you in debt so that you have to work the rest of your life to pay off this debt. I don't call this motivation.

"None are more hopelessly enslaved than those who falsely believe they are free" - Johann Wolfgang von Goethe

It might be an unintentional side effect of attendance but I don't think Universities and Colleges have that as a goal. If it is a goal they seemed to have missed out on it for me and for many of my friends...

"Never ascribe to malice that which is adequately explained by incompetence." - Napoleon Bonaparte

Do you think all over the IT feild, not haveing a degree wouldn't be a stumbleing block, or more so in the security side.
The employees PR?

Depends if you have experience or not.

[xsv2009]

from what i've gathered, the most difficult part about the "industry" is entering it. this is where i believe a college degree is worth its money... that is, getting your first real job and from there, gaining the much needed experience to move higher. the job listings i've seen recently will take certifications(most often CISSP) as a substitute for a degree. the irony is the experience required in order to receive the CISSP certification.

[g3ksan]

Is "the man" trying to get you down?

You just don't know, man. You haven't seen it, dude. Free your mind!

I think for the most part, we all agree, but in a different way.

from what i've gathered, the most difficult part about the "industry" is entering it. this is where i believe a college degree is worth its money... that is, getting your first real job and from there, gaining the much needed experience to move higher. the job listings i've seen recently will take certifications(most often CISSP) as a substitute for a degree. the irony is the experience required in order to receive the CISSP certification.

It's more luck and hard work to get in than anything. You have to convince someone that taking a chance on you would be an awesome thing. CISSP takes experience, but the SSCP takes only a year's experience. I know a lot of people don't look at it, but I think the SSCP would be a great substitute for someone starting out. You can get an Assosiates of CISSP, but that just seems cheeseball to me. That just says you can pass the test, but don't have the experience.

[streaker69]

You just don't know, man. You haven't seen it, dude. Free your mind!

I think for the most part, we all agree, but in a different way.




It's more luck and hard work to get in than anything. You have to convince someone that taking a chance on you would be an awesome thing. CISSP takes experience, but the SSCP takes only a year's experience. I know a lot of people don't look at it, but I think the SSCP would be a great substitute for someone starting out. You can get an Assosiates of CISSP, but that just seems cheeseball to me. That just says you can pass the test, but don't have the experience.

You missed a very important part of breaking into the field. Networking, and I don't mean attaching two computers together. If you want to get into the field, you have to network with other professionals, keep your ears open for jobs that are available, and then do what you can to get good references from others in the field that you can use. Plus, you cannot have the typical anti-social attitude during the interview process that many IT people have while they're actually working. You can always work on that attitude after you've secured yourself a nice cushy job.

[drgr33n]

One of the university's and college's goals are to put you in debt so that you have to work the rest of your life to pay off this debt. I don't call this motivation.

"None are more hopelessly enslaved than those who falsely believe they are free" - Johann Wolfgang von Goethe

I disagree with this statement. As its not the University that wants you in debt but the banks that are lending you the money to pursue your career.

Plus the fact that I'm a student and I'm a year and a half into my degree and have not needed nor wanted to get into debt to complete my degree. Its hard not to but not essential to complete a Uni degree and to get into debt. It may be different elsewhere in the world but I'm with the Open University and they provide a cheap and manageable way to pay for your degree in chunks. I'm currently completing a BSc (Honors) in computing and I've worked out the cost to be around the £3000 to £4000 mark.

You can break this down to manageable chunks of around £400 a module. The modules last for 8 years and take around 8 months to complete. I currently run two modules in conjunction to get things moving quickly but if you were short on cash you could complete the degree in around 6 years at a cost of around £600 - £700. Break that down into weeks and that's £13 a week Not much really when you think about it. Each module requires around six to eight hours a week and you work from home making use of virtual classrooms, so its easy to work and study. Also they offer a funding scheme for individuals with low income (under £20000 a year)

Maybe others have had different experiences but if you feel that your Uni / College has this as one of their motives, I would move

[lupin]

Maybe others have had different experiences but if you feel that your Uni / College has this as one of their motives, I would move

I don't think any University or College on Earth has this as a motive. The primary goal of any business is to ensure its own survival, usually by making money, and a University or a College is a business. It doesn't make sense for a business to have a goal of making its customers be in debt AFTER they have concluded their relationship with the business. Why should the University care either way if their former students have to work for the rest of their life to pay off their debt if that doesn't translate to more business for the University in some way shape or form?

Unless the Universities are secretly in collusion with "the man", and are trying to "keep us all down". But that's just conspiracy theory nonsense.

In fact its probably counter productive for a University to have its students be in debt after they leave. If students are badly financially damaged by attending their initial University course, they are less likely to take on graduate courses, and less people will take up University study in the first place if they believe its too expensive.

The more likely explanation for the high fees is that the Universities need to charge them to remain operating. Any debt carried by the students afterwards is just an unfortunate side effect of the process, not a goal.

You just don't know, man. You haven't seen it, dude. Free your mind!

Too late for me. I didn't deploy my tinfoil hat quickly enough, and now the man has me under his spell via the mind control signals secretly inserted into digital TV broadcasts...

[daffyduc]

my associates degree in computer science got me in the door at a local ISP as a Tier2 helpdesk tech... when I finished my Bachelors (InfoSec) it got me onboard as a systems tech at a credit card processing company which got me into a a company that basically leases me as a Jack of all (IT) trades for one of the largest companies in the world... when a position opened up in one of our sister companies for a security position I was hand selected...

Now from the above it looks like my degree got me up the chain.... This is not the whole story.... I feel my degree's provided me with about 10% of the knowledge I currently have and use on a daily basis.... the rest comes from the stack of books on my desk and a natural need to learn and excel. I latched on to the concepts in the classroom then went home and practiced, researched and studied on my own. If I just took what was spoon-fed to me and went out in to the job market I would probably still be answering the phones....

A degree is a piece of paper that says you were able to pass the tests.... certifications are no different.... I have studied for A+, NET+, CCNA, RHCE, and a few others over the years.... I realized early on that these certs are great for the interview with the HR team who has no technical knowledge but if you cannot talk the talk in the technical interview you could have an infosec cert signed by Kevin Mitnick and it would not make a bit of difference....

Certs are great to get in the door but it also puts more scrutiny on you.... When we were interviewing people to replace me at my old position I got the university + alphabet soup crowd lined up (pre-screened by HR) (most fresh out of a BAS with minimal experience but lots of certs) and not one of them could tell me how subnets work without quoting the definition..... not even the ones with CCNA and Net+ .... we ended up with a guy that has about 6 years REAL experience (starting as a helpdesk agent before starting school) and an associates from a local community college. His other 4 years was spent as the only IT guy for a small company (<20 users).... btw the 2 questions he did not know the answer to in the interview, he said "I do not know, But I will find out" He called me back later that day and asked if he could answer the questions... He had the ambition needed to excel in the IT field.... the others just tried to BS their way through the questions...

Certs are great... Degrees are great .... be sure you understand the subject matter before putting it on your resume. end of story....