I work in cybersecurity — what questions do you peeps have about it?

[CyberGhost615]

[AviatorTom]

Why do cybersecurity auditors ask for information that compromises system security?

Here's a situation we often encountered...

The company I worked for before I retired built computer systems for customers. One customer's IT group was concerned that the system wasn't secure, which could be a problem because it interfaced with the customers own computer systems. They hired an auditor to check our system and the first thing they asked for was a network map of the system with all IP addresses. We told them No way, since that would compromise the overall system security to have that data released. Instead, we sat them down at one of the system's workstations and told them to have at it. They couldn't even figure out how to log in.

They then went to a workstation on the customer's own system and tried to access our system. They couldn't even find where the two systems interfaced.

Needless to say, our system passed the audit.

[CyberGhost615]

Could provide what type of an audit was being performed? HIPPA, SOX, GDPR, PCI-DSS? From my experience, auditors are there to check boxes and that’s all. They’re not technical experts and unfortunately, there are some that don’t even understand the standards they’re auditing systems against.

[AviatorTom]

@CyberGhost615 I don't know what the acronyms mean. All we were told is that the auditors wanted to check the security of the system, in particular if it has any negative effects on the company's existing computer infrastructure to which it interfaces. by the way, the interface with the customer system was a contract requirement, allowing information in the computer system that we provided to be viewed by people in the company.

[CyberGhost615]

@AviatorTom I believe that your company did the correct thing in denying the request. Auditors are supposed to verify compliance through a set of defined standards such as the European General Data Protection Regulation (GDPR). It is merely, I am required to validate that your system automatically deletes user information after 365 days. You then show the auditor that your system has no user data over 365 days.

Another scenario could be that your system is properly configured to lock a user account after 3 failed password attempts. You prove that by entering a password wrong 3 times and showing that your company has a group policy that is applied to all user accounts.

Auditors do not show up to perform a technical audit without some amount of warning. There is a lot of documentation that is necessary for audits. Your company should have been informed of what was required for the audit, why it was required, and what standard it was being compared to. They’re fact that your contract company randomly hired an auditor and did not inform the company about it leads me to believe that they were doing a penetration test.

Part of this is called social engineering. Masquerading as someone you’re not in the hopes that you can get someone to give up information they weren’t supposed to.

So, in summary, your company did good.

[genericname85]

why is it that occasionally exploits are found that are a major security concern after litteral decade of that system existing and being attacked without that exploit being found? like it seems to be very hard to build a system that can't be exploited. is it possible to explain to a layman why that is the case?

[CyberGhost615]

Cybersecurity is a game of cops and robbers. It isn’t necessarily that the exploit existed for the life of the system, but that with every update done, there will be new things that break. In essence, in order to fix something, inevitably, something else will break. The security concern entirely depends on what the exploit can do and what access it can provide. That’s why periodically, there’s a big meltdown over a specific vulnerability. It’s not that it exists, but that it allows unfettered access.

We do build hack proof systems, but they’re entirely separated from any other system. There are computers within federal governments that have never had an Internet connection.

In summary, the reason it’s a cops and robbers game is because you have information someone else wants. Information is power and the more power the information can provide, the harder people will try to find a way to access that information.

[genericname85]

but why is it so hard to have an operating system set up in such a way that only those can get in who are supposed to get in? i get that just not connecting to the internet is a great solutionn but also that makes it terribly inconvenient.

[genericname85]

i mean obviously user error is a big thing but let's ignore that.

[CyberGhost615]

There is a principle in cybersecurity referred to as the CIA triad. We are required to protect the confidentiality of information on our systems, ensure the information stored and presented has not been altered (integrity), and the availability of said information is made available to the end user when it’s requested.

It’s commonly displayed as a triangle. If you can have high confidentiality, and high integrity of systems (think top secret), but availability of that information takes a hit. Availability is also commonly referred to as usability. People want systems that are extremely secure, but if you have to enter 5 different passwords to access a single page, it slows everything down.

People want high security and high availability, but they’re somewhat counteractive in nature.

[genericname85]

yeah fundamentally that does make sense. i just can't wrap my head around why there's always backdoors and exploits possible in every system even if you assume no user error is ever made.

[CyberGhost615]

Unfortunately, in a culture of instant gratification, people want it now. You’d be surprised how many systems corporations use that don’t even change the manufacture default password, or the fact that the most popular password is legitimately, “password.”

[genericname85]

lol yeah. don't need to be an expert in cyber security to know that the corporate world genuinely runs on like 40 iq cause at that level, policies and structures seem to cement incompetence into every apect of operations. no idea what that happens but it is what it is. probably cause everyone just does what they're told for money and nobody actually gives a shit whether it makes sense or not cause they're not being paid to think about that, they're just paid to execute.

[AI Opinion]

Nice! When I work with students and career changers eyeing cybersecurity, these are the things they’re most curious about:

1. Pathways in:
- How did you break in? Certs vs. degree vs. lab/home projects?
- What would you do differently if you started today?

2. Day‑to‑day reality:
- What does an “average” day look like in your role?
- How much is hands‑on vs. meetings/reporting?

3. Skills & learning:
- Which skills/tools actually matter early on?
- What labs, CTFs, or personal projects impress you in interviews?

4. Career growth & pay:
- How do people move from Tier 1 SOC/helpdesk into higher‑level roles?
- Which specialties (blue/red/purple, cloud, AppSec, DFIR, GRC) have the best long‑term prospects?

5. Reality checks:
- How stressful is incident response/on‑call?
- Any common misconceptions beginners have about the field?

If you’re open to it, sharing your own path plus one “do this, not that” tip for beginners would be incredibly valuable.

[Anonymous]

What countries have the strictest anti-hacking laws?

[CyberGhost615]

Is that for the companies that get breached or the individuals that do the breaching?

[Opinion Owner]

For the individuals... they do more damage in my opinion.

[CyberGhost615]

If we go strictly off severity of punishment, I would have to say China as you could be sentenced to death for hacking; however, the CCP does have a major tendency to blur and ignore its own laws. They are major believers in the idea of selective enforcement.

Regarding impact to personal quality of life, I would say the United States. Depending on what was hacked, the damage caused, and the overall radius, the United States will dish out 20 years to life. What makes it worse, is you can be federally banned from ever touching a device that has the ability to connect to the internet for the rest of your life.

As today’s society is 100% technology driven, that sentence is condemning someone back to the Stone Age. I consider that to be a worse punishment.

[Anonymous]

None.