Was macht eine Person die bei der Cyber Security arbeitet?

Your question is comparable to “what makes a person working on a construction site?” The correct answer can only loud: everything possible. Cyber Security does not necessarily mean Pen Testing (“Hacking”).

We have a wide range of people in our company: sales, marketing, consultants, developers, testers, members of the so-called “Red Team” (these are the ones who think about small businesses immediately when he hears “Cyber Security”) and more. And we are All in cyber security. This is just the topic within which we move.

Although my everyday life differs somewhat in comparison to the company where I was previously employed (which was on the move in “production” rather than “cyber security”), I am simply a software developer and architect in the backend. I am part of a developer team and we develop various software for customers, with us always being a more important aspect in the development of data protection and data security. This is actually the biggest difference to the past.

Questions

• “How could someone come unjustly to the processed data?”
• “Did we overlook anything that would allow others to cap our software?”
• “Is Module XY of our software in a safe or insecure environment?”
• “Are the data really anonymized or exist in the memory or in the DB traces that allow a return?”
• “What things do we write via Outlook or teams and for what do we have to use other possibilities (e.g. via Linux) that are not listened to by third parties (e.g. Microsoft)?”

actually play a role where I used to like to hear (even and especially in terms of the thoughtless use of Microsoft products) that I should not mind. On the contrary, we also get regular training, on the one hand the employees in terms of recognizing simple vulnerabilities in everyday life (e.g. tail gating), on the other hand we also work with other security companies and exchange ourselves with each other as a company and the employees get regular digests to stay at a reasonably current level in terms of security.

The reproduction mentioned by secret007b is also an important part, yes. But with immediate pentesting I nothing to do now. It is enough for me to know the most important techniques in relation to SQL injections and AD attacks so that I can incorporate appropriate knowledge into the development so that no corresponding gaps are implemented.

But I do not do pen tests, for example, and do not commission or monitor them and work in the field of cyber security.