2 ms·

The US military really needs a major upgrade in terms of its THINKING about internet security. I've spoken to the military trained "cyber warriors" at conferen

The US military really needs a major upgrade in terms of its THINKING about internet security. I've spoken to the military trained "cyber warriors" at conferences and it was unsettling. They simply had a worse grasp than some pre-college kids I've met who dabble in security between high school classes. There's a lot of veneer there and not a whole lot of substance. It is like they're trained to be the world's best script kiddies (e.g. they run provided tools in a given order and expect a predetermined result, they don't REALLY grasp the underlying concepts at a low level). Now I will say the NSA has some really sharp cookies, and I'm sure some other DoD departments do too. But the people at the top seem to think "cyber" war can be mapped to normal war, and train accordingly. That's a fool's errand. Hopefully they get it together, but in terms of DoD's own internal politics it seems like a long road with the computer illiterate grey hairs at the top.

txcwpalpha 8y ago
At my previous security consulting firm, the leadership team kicked off a massive hiring effort of DoD veterans, driven by the idea that "cyber warfare is similar to real warfare, so veterans are a natural fit for cybersecurity jobs". Blech. Based on my experience working with those ex-DoD folks, I echo your sentiment. Anyone who was known to be a part of the veteran hiring initiative became a black sheep among the other rank-and-file at my company, because everyone knew that the DoD folks could hardly do anything more complex than a follow a 5-step "how to install metasploit" guide without having their hand held (and even then...). They also had very little familiarity with basic security tools like MFA, IDS, IDM softwares (which makes sense after reading the article). The worst part still was that they were very cocky about their abilities. I heard way too many times about how "I have experience with 'real war' at the pentagon, I know what I'm talking about", when in reality they certainly did not. If the actual DoD is anything like their ex-infosec employees that I worked with, I can only imagine that this article is just the tip of the iceberg.
rhexs 8y ago
But what's the solution to this? At the end of the day the Fed Gov has become an incredibly successful jobs program for vets. (see vets preference and all sorts of affirmative action there) Obviously, one can make the argument that perhaps the skill-set and drive that encourages one to join the military is probably, in a majority of cases, orthogonal to what makes someone good at cybersecurity. But who would ever argue that? It's political suicide, "how dare you hate the troops", etc. It's fun to see how toxic it can get -- I'd recommend looking at a few of the USAJobs message boards that have advice on how to get hired. Every now and then you'll see a thread about how the veteran preference is unfair, and, well, I won't spoil it. :) It won't change until it has to change.

txcwpalpha 8y ago

At my previous security consulting firm, the leadership team kicked off a massive hiring effort of DoD veterans, driven by the idea that "cyber warfare is similar to real warfare, so veterans are a natural fit for cybersecurity jobs". Blech. Based on my experience working with those ex-DoD folks, I echo your sentiment. Anyone who was known to be a part of the veteran hiring initiative became a black sheep among the other rank-and-file at my company, because everyone knew that the DoD folks could hardly do anything more complex than a follow a 5-step "how to install metasploit" guide without having their hand held (and even then...). They also had very little familiarity with basic security tools like MFA, IDS, IDM softwares (which makes sense after reading the article). The worst part still was that they were very cocky about their abilities. I heard way too many times about how "I have experience with 'real war' at the pentagon, I know what I'm talking about", when in reality they certainly did not. If the actual DoD is anything like their ex-infosec employees that I worked with, I can only imagine that this article is just the tip of the iceberg.

rhexs 8y ago

But what's the solution to this? At the end of the day the Fed Gov has become an incredibly successful jobs program for vets. (see vets preference and all sorts of affirmative action there) Obviously, one can make the argument that perhaps the skill-set and drive that encourages one to join the military is probably, in a majority of cases, orthogonal to what makes someone good at cybersecurity. But who would ever argue that? It's political suicide, "how dare you hate the troops", etc. It's fun to see how toxic it can get -- I'd recommend looking at a few of the USAJobs message boards that have advice on how to get hired. Every now and then you'll see a thread about how the veteran preference is unfair, and, well, I won't spoil it. :) It won't change until it has to change.