Security Specialists in Short Supply?

Security Specialists in Short Supply

Security experts speaking at a cybersecurity conference in Washington D.C. expressed concern that the country is going to need many more skilled IT workers to protect the critical infrastructure than are presently available. The military faces shortages of skilled IT workers because many command higher salaries in the private sector. In a related story, cyber forensic specialists are increasingly in demand.

http://www.govexec.com/dailyfed/0902/090402td2.htm

http://seattletimes.nwsource.com/htm...rensics08.html


And we are told our field is getting over crowded. My only suggesting is to start polishing up your resume and chase that green. $$$$$$$

Tek Weasel,

Thanks for the info. Those are excellent articles and should help for me to create a degree program that will bring more people into the security industry. The only thing that would be of concern is that they are trained well enough. I don't want to see lax security admins that know just a little bit.

I think computer security is THE area for the foreseeable future. The industry is changing by the day and new technology brings new threats. Wish I were 20 or 30 yrs younger.

I sure agree with you, chuck, but I've been surprised lately at the seemingly lack of motivation by the private sector to increase cybersecurity. I remember recently reading a poll about how a great percentage of corporations are now viewing cybersecurity as a necessity, but so few of them are actually adding to current security procedures and personnel. My guess is that it's gonna take an attack of 9/11 scale in the cyberworld before the real demand for security professionals is seen.

Im confused. Why did he get Negged?! I dont see a thing wrong with that post. >:(
I think it has to do with the Newbie status ....
Anyway, Great post. And about the feild being overcrowded.... ABSOLUTELY.
damn "paper MCSE's" and others who read and never do, but get the certs...
ANYONE can memorize questions and answers, but its so very interesting to set them in front of a broken machine and say "Fix".... or even a working one and say "Do:"
they look lost.

i agree with avenger. you see all these mcse ppl out there and you ask them a question on security, and they don't know it. also, there are these "colleges" out there that are 90 weeks long. how can you teach someone everything they need to know in 10weeks. come on. they might know a little bit, but the ins and outs, they don't have a clue.

I've read that the field is overcrowded, too. The problem is, overcrowded with competent people or people in it for the $$$$$? I'm as technologically adept as an ant, but if I had a piece of paper saying I was qualified, I'd be going for the money, too.

As for being negged, I've been negged for just POSTING on a thread that somebody didn't like. I got the negs for something I didn't even say. You learn to live with it and hope that the positive points outweigh the negative.

When it comes to the mcse's and security...for the most part the mcse just makes sure you know how to use the product. It does give you some networking knowledge and some of the security features and how to use them, but it isn't overly focused on giving you a good knowledge of defense in depth with ids systems, intrusion detection, incident handling, etc. There are some new security certs out there and I hear rumors of possibly more coming but it is still no replacement for some real security training.

If anyone gets the chance I really reccomend the SANS classes. I just started them and I'm learning a ton.

Quote:

---

Originally posted here by Chuck56
I think computer security is THE area for the foreseeable future. The industry is changing by the day and new technology brings new threats. Wish I were 20 or 30 yrs younger.

---

You are only as old as you feel. Certainly computer security is a field that you can work in long past the age that you could work in a lot of physical fields.

It is certainly strange that there is such a lack of IT personel, as I know many in the field looking for permanent work. Maybe the employers aren't looking in the right place.

If this is off topic, I apologize, and just delete or ignore this post. How do the various classes relate to a computer science course, of do they at all? Our local Community College offers courses in computer science. I doubt I have the math background to qualify, but have considered looking into it. Would it be worthwhile?

ROTFL if you're going to neg me with some stupid crap like "den you get negged to, boi..." then at least have the sack to sign your name.

Not that antipoints matter all that much, but just be man/woman enough to own up to your negs. I do...
*shrug*
Thanks to those who did agree.
Yes the MCSE does not have a lot to do with security, but I see a lot of incompentents in all apsects of the field out there.
Avenger.

Strange thing about the security survey...Companies say security is a top priority, but don't want to spend the additional dollars to improve it. Then when it comes to budget cut time, the security area is one of the first places they look to cut costs because it is an expense that takes away from the "bottom line."

Juridian...I've heard that attending a SANS Conference is about the best thing for a security professional, in terms of exposure and learning. Can you confirm? I'd love to attend one next year - if I survive budget cuts next week.

I haven't attended one of their conferences yet...tho I hear they are really great. I am currently working on the gsec training/certification through their online program and so far it is really good.

Computer Science classes do not relate to seccurity at all. They tend to relate to programming, programming technique etc. When they talk about Operating Systems they are normally talking about a basic to semi-MCSE type training.

Even most IT programs at Universities do not cover security in detail. They do cover networking, databases, computer programming, and computer hardware and design. Security, from what I have seen, is only presented under these auspices not as a field unto itself.

However, a good understanding of programming and networking is a good basis to launch a deeper understanding of Security. So the classes are not wasted. I currently am teaching myself Perl. While I learned Fortran in college I have not used it for a long time. Since then I dabbled in C and C++ but never got overly serious. Perl so far has seemed to be a good starting language and is easily adapted to the Security and Computer Administration environment. I hope to couple that with my knowledge of networking to get a deeper understanding of Security than I currently have. Right now I am the anti-script kiddie. I am using tools and downloads to protect myself without fully understanding, in many cases, what they are really protecting me against.

BTW my credentials for making the statements I made are 6 years as an Adjunct Professor at Cerro Coso Community College and Porterville Community College teaching Networking, Introduction to Computers, and Introduction to Windows. My degree is in Mechanical Engineering so I can also comment on gears but I got out of that field 8 years ago and started working with computers and networking. Now I find myself in security and it is almost but not quite totally unlike anything else in the computer field. It helps to have a lot of basic knowledge but then that knowledge has to be used in ways I have never had to use it before. So, I am again at the beginning of developing new skills. My old ones may help but most of these are not taught in classes at this time, certainly not in colleges and universities. The class mentioned earlier sure sounds enticing though.

This raises one of the reasons why Security Specialists are needed but companies don't know how to get them. Companies tend to think of security as an add on to Computer Administration. Many administrators agree until they start realizing the amount of time it takes to keep up with the changing world of security. So instead they harden their systems with the basics and pray (or wish if you prefer) that nothing bad happens. Some are lucky, like me, that their network uses Novell as its primary NOS and, honestly, Novell is a lot safer than M$ for obvious reasons, and even than *nix because few people even try to break it. Most, however, are stuck with M$, probably are running a web server, and quickly find that standard hardening techniques are not enough and that the standard keeps moving.

If most companies did hire a true security specialist then they would probably end up firing him too since most of the work is hidden and is research and learning. One of the key mistakes, IMO, is to make the NS the Admin. If you do you have no accountability. I don't want admin access, I want a dummy network that I can try to find the vulnerabilities on, then report them along with a fix. Prove the fix and finally have the administrator repair the vulnerability in the production network. I can prove and watch the security software without admin privileges and this way I monitor not only the users but the administrators too. That gives the network an auditor, access to view without access to modify. Again, most companies do not see the need for this because they have not defined security enough.

Is my desire a pipe dream. Well, yes, for most of us it is. But until industry wakes up and realizes that security means money and that it is a specialized field they will always be in a reactive rather than proactive mode.

/me steps off soap box and fades into the distance.