[Career review] “Information security in high-impact areas” by Jarrah Bloomfield

As the 2016 US presidential campaign was entering a fractious round of primaries, Hillary Clinton’s campaign chair, John Podesta, opened a disturbing email.This account is based on public reporting of the incident in outlets including Vox, Vice, and CNN.

The March 19 message warned that his Gmail password had been compromised and that he urgently needed to change it.

The email was a lie. It wasn’t trying to help him protect his account — it was a phishing attack trying to gain illicit access.

Podesta was suspicious, but the campaign’s IT team erroneously wrote the email was “legitimate” and told him to change his password. The IT team provided a safe link for Podesta to use, but it seems he or one of his staffers instead clicked the link in the forged email. That link was used by Russian intelligence hackers known as “Fancy Bear,” and they used their access to leak private campaign emails for public consumption in the final weeks of the 2016 race, embarrassing the Clinton team.

While there are plausibly many critical factors in any close election, it’s possible that the controversy around the leaked emails played a non-trivial role in Clinton’s subsequent loss to Donald Trump. This would mean the failure of the campaign’s security team to prevent the hack — which might have come down to a mere typo”‘This is a legitimate email,’ Charles Delavan, a Clinton campaign aide, replied to another of Mr. Podesta’s aides, who had noticed the alert.

---

Outline:

(00:09) Introduction

(02:31) In a nutshell:

(03:23) Why might information security be a high-impact career?

(04:45) Protecting organisations working on the world’s most pressing problems

(06:19) The security of advanced AI systems

(07:29) What does working in high-impact information security roles actually look like?

(10:06) What kind of salaries do cybersecurity professionals earn?

(10:47) How to assess your fit in advance

(12:17) How to enter infosecurity

(12:21) Entering with a degree

(14:04) Entering with (just) IT experience

(14:46) Do you need certifications?

(15:23) What sorts of places should you work?

(16:59) Safeguarding information hazards

(17:44) Contributing to safe AI

(18:19) Working in governments

(19:20) Want one-on-one advice on pursuing this path?

---

First published:
December 18th, 2022

Source:
https://80000hours.org/career-reviews/information-security