Phil Martin - Essential CSSLP Exam Guide Updated for the 2nd Edition

Lets explore the statistical attributes of your average attacker after all, the better you understand your opponent, the better equipped you will be to defeat them. Of course, I have a hidden agenda to this conversation that I will reveal at the end of this discussion.

In 2016 a fairly exhaustive effort was carried out by HackerOne to identify the makeup of hackers across the world. HackerOne helps to connect companies with hackers who can help expose vulnerabilities in the companys systems. The average hacker is a gray-hat someone who helps out companies and people for good, called white hats, and those who sometimes walk on the dark side for fun and profit, commonly called black hats. The color of each hat is based on early westerns from the 1930s in which the good guy normally dressed in white while the bad guys wore black. The gray hat reflects a combination of the two when you mix white with black you get a shade of gray. In short, gray hats are more than willing to help companies find weaknesses, as long as there is some profit or fame to be gained. At other times, you would not want to meet this same character walking down a back alley in the Dark Net. It all depends on what color of hat he is currently wearing.

Here are some interesting details from that report about hackers:

• The vast majority are under the age of 34
• 72% hack for money
• 70% also hack for fun
• 66% thrive on the challenge alone
• 50% claim to do good in the world through their hacking activities
• The United States and Russia have the highest concentration of free-lance hackers
• 17% use hacking as their sole source of income
• 26% generate of their income from bug bounty programs (companies willing to pay for hackers to discover vulnerabilities in their software)
• Hackers make anywhere from $20K to $350K from a single bug bounty program
• 98% are male

While all of this is interesting, take special note of that last statistic 98% of all hackers are male . As in he, not she. Why am I bringing this up? Because no one would ever accuse me of being a politically-correct individual, and I am not going to follow the socially popular trend of equally representing attackers as both genders in this book. Until you write a book you will not appreciate how difficult it is to do such a thing. Therefore, when we discuss an attacker, it will always be a he, because that is what the facts overwhelmingly support. This book will focus on how to implement secure systems, and I will leave the social crusading to others.

Does this offend you? As that timeless philosopher once noted, Haters are going to hate. Besides, my end goal is to really tick off hackers, anyway after all the whole point of this book to beat them at their own game!