Despite the decline in vaccine effectiveness (I've seen conflicting studies of how much this has changed), they're still incredibly effective compared to any other protection we have at the moment.

None of this changes the fact that people are going to continue to die until a higher proportion of the population receives a COVID vaccine -- and that we _can_ mitigate this through other measures. None of these things lead me to the conclusion that we should return to normal and accept an increased healthcare system burden and death rate.

[0] https://www.cdc.gov/mmwr/volumes/70/wr/mm7034e1.htm?s_cid=mm...

Social distancing and masking work. They reduce the possibilities for spread between people -- not perfectly, but enough to reduce it to a manageable level for our current healthcare resources.

Saying that our current measures to combat the virus don't work is disingenuous at best, and a blatant disregard for everything we've learned from the past year and a half at worst.

The answer to this is not to say 'we can't fix the underlying issues right now, so we're not going to do anything'. The answer is to take measures that we _can_ implement until those longer-term solutions can come into play.

You might be willing to accept the risk of getting sick on your behalf, but by advocating a return to 'normal' before we have the capabilities to deal with this virus, you are advocating for putting even more stress on healthcare systems across the globe already on the verge of failure. There are patients in heavily-impacted areas who cannot access healthcare for other life-or-death concerns because hospitals are crumbling under the workload of COVID cases.

The article even states this; COVID is likely to reach endemic status eventually, but we are still nowhere near that. Ignoring it will have enormous costs on vulnerable populations -- even more than it already has.

2. Something like evilginx2 can provide man in the middle functionality for stealing MFA tokens, or I try to find endpoints that have misconfigured or absent MFA.

3. It depends on the engagement. We like assumed breach scenarios because they're more effective for the time and money involved, but clients want entirely black-box engagements fairly often as well. Otherwise, I'll focus on using OSINT to develop a phishing target list, assuming I do basic scans against the organization's external network footprint and don't find anything egregious.

4. It's all about experience. You have to come up against the tools, and then see what works. It's really a lot of trial and error, though a lot of common bypass techniques will work against multiple products. There's no one-size-fits-all bypass.

5. Twitter, public Slack channels, and research performed by myself and my coworkers.

6. Learn soft skills. It's easy to teach someone how to do the technical part of the job, but you have to be able to communicate it to stakeholders. Technically, you should focus on the areas that interest you, but ensure that it's something used by the types of clients you're doing work for. It doesn't help to know the latest and greatest Linux attacks if none of your clients even know what Linux is. It doesn't help to be a badass web application pentester if you're expected to be able to move through a large Active Directory environment. Personally, I focus on Windows and Active Directory environments.

Comments URL: https://news.ycombinator.com/item?id=18554395

Points: 1

# Comments: 0

You can definitely automate many parts of testing, especially enumeration steps, but any security professional knows that a tool is no substitute for a knowledgeable hacker.

It's not an easy thing to learn to challenge people, but it's vital to maintain a good physical security posture. Employees need to feel comfortable challenging those who they don't recognize, and making sure that employees are part of an organization's security team is important.

A lot of our security--both network and physical--is based on the illusion of security. One of the most important things that penetration testing does is to make organizations aware of the issues, to put the bug in their ear to remind them that security is important, and shouldn't be an afterthought. We see lots of organizations make material improvements to their security as a result of red team exercises. We also see a lot of organizations that don't. It's disheartening when that happens, but I like to think I help make a difference. The next data breach might be mitigated by our recommendations, or even prevented entirely.

Just because she skipped over some unimportant parts of the story doesn't mean she didn't have plenty of time after being shown around the building to accomplish her objectives. She does address this, too:

> I took FOREVER looking around this office space, and eventually they said their goodbyes because they had to go back to work. They had a strict policy of escorting visitors. But I had been seen walking around with trusted insiders so no one questioned me.

> I was free to take my time. I made myself at home. My main objective at this site was to weasel my way into private corner offices.