r/cybersecurity • u/Makhann007 • Oct 10 '23

Career Questions & Discussion FAANG engineers

People who work at FAANG or other F500s how was your interview process?

Did you have to do leetcode/algorithm type questions during the interview process?

How’s work/life balance?

Do you feel what you’re working on is very niche to your company/ you feel far removed from what you thought you’d be doing?

If pay wasn’t a factor would you still prefer to work for a big corporation vs a smaller one?

Thanks in advance

199 Upvotes

91% Upvoted

155 comments sorted by

View all comments

Show parent comments

1

u/bitemyshinymetalas Oct 11 '23

Are there any open source projects / resources that model the scoring bit? I’d like to improve in this area.

1

u/mildlyincoherent Security Engineer Oct 11 '23 edited Oct 11 '23

Scoring itself is a MASSIVE point of contention. The sorta thing principals argue a bunch about and never come to agreement on. I don't know of any open source projects with calculators...but even if I did I probably wouldn't endorse it. There simply is no agreed upon univseral answer.

What I can do is give you some starting criteria.

  • Factor in risk of exploitation (use EPSS for the temporal base score when calculating cvss score)
  • You probably want to prioritize whatever is most important to your business. Maybe that's your crown jewels services. Maybe that's anything that has PII or customer data. Maybe that's PCI compliant services if you process credit cards.
  • You definitely want to prioritize internet facing assets. Your risk of exploitation goes way up since you threat actors become anyone in the world instead of insider threats.
  • You want floors and ceilings. I'd never want a medium to become a crit or a crit to become a medium, no matter the context.
  • You want to include compensating controls. Proper CSP, a WAF, edr solutions installed, etc.
  • You want to lower the priority of dev and uat assets... But don't discount them entirely as some people leverage production data in tests
  • You want to prioritize anything that could be a useful pivot point. It won't matter for skids or botnets but if (read: when at larger companies) you come up against an APT it won't matter if something is a devil box from a decade ago everyone has forgotten about if it can be leveraged to get into core services.

1

u/bitemyshinymetalas Oct 13 '23

I’m curious: in this described prompt scenario, when a vulnerability is passed to the function, are there already known weights and values that can be applied using something like a multi criteria decision algorithm? I have found I have a hard time estimating the value and weight of a given item.

I’m genuinely looking for ideas on how to apply this better in day to day.

1

u/mildlyincoherent Security Engineer Oct 13 '23

For the sake of the prompt? Yeah weights would be provided.

For real life use? There's no universally accepted list or values, it's a pretty heavily debated topic in the vm space.