4 ms·

As a cybersec consultant with experience working with many security organizations, I wholeheartedly disagree. There is a lot more to security than things that h

As a cybersec consultant with experience working with many security organizations, I wholeheartedly disagree. There is a lot more to security than things that have to do with software engineering. In my experience, the companies with the worst security are ones that primarily employ current or former software engineers as leaders of their security teams with a misguided mentality that security is just a subset of software engineering. Because of that mentality, they tend to focus on a very small portion of security principles.

thomk 8y ago
For instance?
- samplesizeme 8y ago
  From my experience I agree. Physical, legal and network controls often get neglected.
- txcwpalpha 8y ago
  Training and awareness, asset management, third party management, policies and procedures, legal (you should have lawyers looking over HIPAA/PCI/GDPR stuff, not a programmer), identity management, incident response, recovery & business continuity, communications plans, PR... I could keep going. All of these things could have some software engineering component, such as with identity management: there is a component there that deals with (for example) writing code to integrate your web app with multi-factor authentication, but identity management also encompasses things like writing good access control policies, managing the legal requirements for access, training people on how to use that multi-factor auth, etc. Engineering skills are of course of great use if you are talking about the security of a specific codebase or doing penetration testing or doing the nitty-gritty customization of a security application, but "cybersecurity" is much more than that.
leetbulb 8y ago
Most vulnerabilities include or source from some sort of poor software engineering though, which may root from said issues, among other things. Most of these vulnerabilities (including some hardware vulnerabilities) are discovered and exploited with clever, creative software engineering / exploit development. I know cybersec is extremely broad, but I think software engineering plays an extremely important role.
- txcwpalpha 8y ago
  I certainly agree it's an important part of security, but that's vastly different from "you should have 4 years of engineering experience before you can start learning security". Speaking practically, the vast majority of companies that experience one of the vulnerabilities you are referencing are not going to be patching the code themselves - they're going to be updating their infrastructure with code that was written by someone else. And before they even get to that point, they are going to have to have policies/procedures that alert them of that vulnerability, that assess how important patching that vulnerability is, that determine cost of patching/not patching, that determine how to receive that patch, and that determine how to apply that patch. And all of those things involve much more than programming. One of the other largest parts of defending a company from being hacked is training and protecting employees from social engineering/phishing attacks, and that's something that doesn't involve writing any code (or even knowledge of code) at all.
  - leetbulb 8y ago
    Fair points, thanks!
3pt14159 8y ago
> There is a lot more to security than things that have to do with software engineering. I didn't say there weren't? > In my experience, the companies with the worst security are ones that primarily employ current or former software engineers as leaders of their security teams with a misguided mentality that security is just a subset of software engineering. Wasn't what I was advocating for. I'm advocating for learning security after you have a base of software development. Not leading a security team with no experience learning or practicing security. Also, this is a huge and growing field, so I'm speaking generally, but I'm sure there are sub-areas where there are counter examples.

thomk 8y ago

For instance?

samplesizeme 8y ago
From my experience I agree. Physical, legal and network controls often get neglected.
txcwpalpha 8y ago
Training and awareness, asset management, third party management, policies and procedures, legal (you should have lawyers looking over HIPAA/PCI/GDPR stuff, not a programmer), identity management, incident response, recovery & business continuity, communications plans, PR... I could keep going. All of these things could have some software engineering component, such as with identity management: there is a component there that deals with (for example) writing code to integrate your web app with multi-factor authentication, but identity management also encompasses things like writing good access control policies, managing the legal requirements for access, training people on how to use that multi-factor auth, etc. Engineering skills are of course of great use if you are talking about the security of a specific codebase or doing penetration testing or doing the nitty-gritty customization of a security application, but "cybersecurity" is much more than that.

leetbulb 8y ago

Most vulnerabilities include or source from some sort of poor software engineering though, which may root from said issues, among other things. Most of these vulnerabilities (including some hardware vulnerabilities) are discovered and exploited with clever, creative software engineering / exploit development. I know cybersec is extremely broad, but I think software engineering plays an extremely important role.

txcwpalpha 8y ago
I certainly agree it's an important part of security, but that's vastly different from "you should have 4 years of engineering experience before you can start learning security". Speaking practically, the vast majority of companies that experience one of the vulnerabilities you are referencing are not going to be patching the code themselves - they're going to be updating their infrastructure with code that was written by someone else. And before they even get to that point, they are going to have to have policies/procedures that alert them of that vulnerability, that assess how important patching that vulnerability is, that determine cost of patching/not patching, that determine how to receive that patch, and that determine how to apply that patch. And all of those things involve much more than programming. One of the other largest parts of defending a company from being hacked is training and protecting employees from social engineering/phishing attacks, and that's something that doesn't involve writing any code (or even knowledge of code) at all.
- leetbulb 8y ago
  Fair points, thanks!

3pt14159 8y ago

> There is a lot more to security than things that have to do with software engineering. I didn't say there weren't? > In my experience, the companies with the worst security are ones that primarily employ current or former software engineers as leaders of their security teams with a misguided mentality that security is just a subset of software engineering. Wasn't what I was advocating for. I'm advocating for learning security after you have a base of software development. Not leading a security team with no experience learning or practicing security. Also, this is a huge and growing field, so I'm speaking generally, but I'm sure there are sub-areas where there are counter examples.