Discussion
I just realized a thing:
I got in the building. I planted a malicious device that didn't go anywhere because ports were off. I got financial docs, an old backup disk, and access to a device in LAN that didn't go anywhere mostly because time was limited and I did not bring the right thing.
How successful was I really, in that scenario?
When describing it now, I feel that what I did was easy and what I did not manage to do was the shit that would have been the wow effect.
@deviantollam Is that impostor syndrome? Or am I just shit at this?
@m4iler I think there are all different ways of having a win, and I think this would strike me as definitely counting.
Ultimately, we should remember that our job is to provide value to the client. Does the client say that what you did was valuable and that you're findings were used to them? That's the name of the game.
@deviantollam If 80% of my findings were purely "humans wanted to be helpful to me despite me being a bad bad attacker and your camera/card system is kinda shit," I wonder how much they can use that 😂
@m4iler @deviantollam to quote Dungeon Crawler Carl, “the minute we stop helping eachother, is the minute we stop being human”. It’s important that you highlighted that people will always be faulty when it comes to acting as an access control device and, similar to phishing training, any training or exercise that is meant to remind the people not to do the thing will always have a short expiration and diminishing returns. So the access control needs to be physical, and some of it was and that was what worked at stopping you in some cases, and it was also what was unsuccessful in other cases and it’s where improvements can be made, access cards and cameras, maybe a sign in system with actual checking.
@m4iler Man do I know this feeling. Imposter syndrome hits different when your job actually IS to be an imposter.
When we're training or onboarding someone to do this kind of work, there's a thing we say to them over and over until it becomes like a mantra.
You are not the one being tested. You are the one performing the test.
It's so easy to look at things you weren't able to accomplish and feel like that means you failed, but THAT'S imposter syndrome. "Success" in this job means "I showed up and accurately emulated an attacker." That's it. As long as you can look at yourself and honestly say you did that, then you succeeded at your job.
It doesn't matter if you got full DA access on day 1 or got thrown out the second you walked in the door. You showed up, you did the work, you performed a thorough and accurate test. You succeeded.