14 ms·

Cybersecurity Pros Name Their Price as Hacker Attacks Swell

236 points by benryon 7y ago

strict9 7y ago
There is an endless supply "infosec specialists" and "ethical hackers." But there is a massive shortage in motivated experts that ensure packages are up to date and fluent enough in code spelunking to ensure the app isn't trusting user input or allowing privilege escalation. There's also a shortage in technology leaders willing to spend money on the mundane aspect of security. It requires regular work, not compliance effort and periodic audits/pentests that check off boxes.
- cryptica 7y ago
  Software complexity in most companies has exploded. Nobody is doing anything to try reduce or manage complexity so it's only getting worse. The more complexity there is, the easier it is to find vulnerabilities.
  - CyberBank 7y ago
    >>Nobody is doing anything to try reduce or manage complexity so it's only getting worse. I disagree, I see a number of large corporations starting to standardize either 1) their entire development stack from IDE all the way to how the code is deploy 2) Reengineering entire languages to have one language be used e.g Quartz at BofA 3) at the very least, companies are starting to standardize their middleware stacks, to at least avoid the configuration related issues of having a development team managing that. While I do agree, that the complexity of third party libraries has exploded and is increasingly difficult to manage, I'd say companies are well on their way to standardizing that, with tools like Nexus, SonaType, Blackduck, etc. We're obviously a long ways away from being even 75% effective across the board, but to say nobody is managing the complexity is a bit short sighted :)
    - ctcthrowaway 7y ago
      OPSEC comrade :)
    - WrtCdEvrydy 7y ago
      > I see a number of large corporations starting to standardize My current job in a nutshell. It's like handling children (No, you can't add a new technology because you want something fancy on your resume)
  - zercurity 7y ago
    We're trying to address this. If you've got sometime I'd really like to compare notes on this and learn how you guys work day-to-day. We're leveraging Osquery to asses the various aspects of systems to try and build threat models where risk cascades as systems change. To help facilitate automated reporting. Alongside the traditional mundane cybersecurity day-to-day activities.
- bluedino 7y ago
  Things are out of date because things that are working don’t get money and time allotted to them to update them. People still run Windows XP because there’s a piece of software that never got updated to run on Windows 7, much less Windows 10. There’s those Java apps that are stuck on Java 6. Websites that still need IE6. Things that use the unsafe versions of stuff like HTTPS...because Visual Basic 6 doesn’t support them out of the box. But it still works. So it keeps going.
- hyperion2010 7y ago
  I'm out here imagining all the unethical hackers drooling over the sweet sweet vectors that are snap and flatpak. Unfortunately the qa and auditing aspects of distro packaging seem to be taken for granted, and the resources for that are surely not sufficient to counter motivated adversaries.
  - antod 7y ago
    Don't forget helm charts and docker containers. The security/assurance of that supply chain is pretty lacking. It feels like some people are actively applying the (historical?) Wordpress security model to Kubernetes for expediency.
  - snazz 7y ago
    Do enough people actually use Snap or Flatpak (especially at large companies) to make it worth anything? I’d imagine that most people would just use real distro packages and stuff compiled from source instead of trusting Snapcraft or random Flatpaks off the Internet, especially in production.
- deleted 7y ago
  [deleted]
gist 7y ago
Also sounds like in the old days and somewhat similar to 'nobody ever got fired for buying IBM'. Why? Well by throwing money a great deal of money to hire the experts (if that is the case) nobody can be called out as they can if they didn't pay for that insurance.
jedberg 7y ago
Not surprising. At Netflix, despite the already high salaries, the security engineers were paid a premium for their skills. The highest paid engineers at Netflix were security engineers. They did stuff like invent entirely new security protocols[0][1]. [0] https://medium.com/netflix-techblog/message-security-layer-a-modern-take-on-securing-communication-f16964b79642 https://medium.com/netflix-techblog/message-security-layer-a... [1] https://github.com/Netflix/msl https://github.com/Netflix/msl
- lawnchair_larry 7y ago
  How do you know what everyone was paid? That’s definitely not the norm though - security engineers are typically classified the same as an SDE for payroll purposes, and tend to have less negotiating leverage than high level SDEs who build and ship products, except maybe some very rare exceptions. But most companies also don’t have their security engineers actually write shipping code. I think this article, like every security related article from bloomberg, is pretty much BS. Also, they use the example of CISO at a large company. CISOs aren’t actually security experts in the vast majority of companies. They’re usually business people or outright frauds, disappointingly. The people who hire and interview them have no way to validate them. The article makes a case for why CISOs are worth a lot, justifying the cost of a breach. The problem is that CISOs have virtually no impact on whether or not you get breached, and they usually bear no responsibility for it. It doesn’t matter who you pay how much - it isn’t going to affect the outcome much. Alex Stamos is one of the few that actually has any background in security at all, and look what good that did Yahoo and Facebook. Not much. The other problem is CISOs rarely get any actual authority over product, and when they try to flex, they just get pushed out. The ones who survive are simply master politicians who manage their messaging and their image. The real reason for this article, I suspect, which appears to be primarily sourced from a security recruiting firm, is that they take a cut of every position they fill. It’s very much in their best interest to pump up the value to justify their fees. Most security money is very poorly spent. I think part of the problem is that hackers are usually bad managers, and tend to be less interested in playing corporate politics. So the manager jobs go to someone else, who has to make decisions they don’t understand. The higher up you go, the more this gets amplified. For every breach you hear about, that company likely has a few competent security folks saying, “see, I told you...”
CyberBank 7y ago
The biggest areas for growth for Cyber at the moment are of the not-so-sexy jobs. The asset inventory, patch management, vulnerability management, third party management, risk management, etc. If you are good at any of those and are innovating in any of those areas, you are as close to naming your own price as you can get in Cyber. As for the most "needed" areas of Cyber, it comes down to education. Not your bachelors degree, but educating and raising awareness to your business, your IT staff, and even your development teams. It's extremely tricky to measure your return on investment, but almost always it comes down to a lack of knowledge causing one massive hole in the fence, leading to a breach. No amount of controls will stop someone truly motivated and skilled, so you're better off raising the fence a bit higher and hoping that it deters the truly malicious. Disclosure: I run Vulnerability Management and Assessments globally for one of the largest companies in the world, so my answer may be a bit bias :)
- thorwasdfasdf 7y ago
  I've never understood people who say: "No amount of controls will stop someone truly motivated and skilled". I don't think that's true. Correct me if I'm wrong, but If there's no holes in the application/web stack to be exploited, then there's no getting in. Right? It's not about hacker/pirate skill. It's about whether or not the target has plugged all their holes or not.
  - spydum 7y ago
    not right. there are ALWAYS holes - it's the nature of software, hardware, and humans.
  - CyberBank 7y ago
    I am referring to a CIA (confidentiality, integrity, availability) related incident. Less so the availability. If an attack was truly motivated, the web stack / application stack is not how you compromise the system. The user is how you compromise the system. Do you have proper physical security to prevent unauthorized access? Do you have proper password and 2 factor auth configured? Do you educate your employees on how to identify phishing? There are numerous other ways to compromise a system than remotely via the web or application stack :)
aczerepinski 7y ago
I'm skeptical about the "more than 300,000 unfilled security jobs" stat. Are we talking about thousands of empty chairs for each of the big tech companies and hundreds for each of the remaining fortune 500?
- eswat 7y ago
  I’m failing at finding the original report about this but this is the line I keep seeing repeated in PRs: > Nationally, there were 301,873 cybersecurity job openings in the private and public sectors during the 12-month period between April 2017 and March 2018. This included 13,610 openings in the public sector.
- bluedino 7y ago
  Mostly security auditors, people who fill out spreadsheeets or run canned tools
- mr_toad 7y ago
  I don’t know about this particular statistic, but what is often done in these studies is to survey organisations to ask how many of these staff they want or need, or how many vacant ‘positions’ they have. The numbers don’t always reflect how many positions they actually have the budget for, or whether they’re willing to pay a realistic rate. Arguably, if they were willing to pay market rates there couldn’t be any vacancies, because supply and demand.
  - bayesian_horse 7y ago
    I rarely see the concept of "supply and demand" used properly. In introductory economics, it's just two lines crossing somewhere. In reality though, companies still have to make a buck, so there is a definite limit on how much a company can pay a "security professional" and still be profitable. And worse, if we are talking about a labor shortage across an industry or country, price doesn't really come into it at all. Price is only a competitive factor, it doesn't create or destroy individual developers. If one employer "scoops" an employee for a higher price, the shortage moves to where he just left. Sucking in talent from other industries or countries also has its limits. And on top of all of that there seems to be some anti-competitive effects preventing wage-wars.
jamestimmins 7y ago
I'm curious if anyone has found consistent work doing bug bounty's and things like HackerOne to a sufficient degree that it would replace a FT engineer role. I'd love to hear/learn about someone's experiences if it exists.
- CyberBank 7y ago
  I know a few folks who do full time between things like SynAck and BugCrowd. SynAck is the ideal model in my opinion for pivoting to full time vs part time as a professional bug bounty individual, although it takes a ton of skill and hardwork. I'd say it's the exception moreso than the norm. If you are interested in learning more about SynAck and it's model shoot me an email: i@willcode.it I can try and setup some contacts from their side that are working full time on platforms like it
  - jcims 7y ago
    Do the folks you know that are doing this full time actually depend on that income for their livelihood? I was on the receiving end of a large program for a short stint and have been watching it casually over the past few years. It's very much a feast and famine way to live, and you need to not only be very skilled, you also need to be dedicated to the effort and be very disciplined with your money. A $20K chained RCE looks great on paper until you're trying to live on a constant diet of clickjacking and IDOR bugs for two months straight. I would caution anyone thinking about this to do it as a side hustle for at least six months if not a year to test the waters, understand the subculture a bit, and take a few rounds on the roller coaster.
    - CyberBank 7y ago
      Yes the ones I know do it full time as their only income AFAIK. Most do live in low cost of living areas, none of them that I know are living in places like San Fran :)
      - jcims 7y ago
        Ah, indeed low CoL helps a ton. I would say only 10-15% of our reports were from folks in the USA and I don't recall any being full time. The dedicated folks were mostly from eastern europe and middle east...i'm guessing that has changed a bit over the past few years.
SubiculumCode 7y ago
I told my son repeatedly that if he ever wanted a secure and high paying job it coukd be in cybersecurity. We aren't going back to less dependence on networks, and we are putting more and more valuable assets and operations on those networks, which will need to be protected. Although, I suppose ut is possible that computer security could move into the automsted sphere....
novok 7y ago
A lot security issues will boil down to the CISO / consultant saying: You have to spend a lot more on your software infrastructure, hire more staff and keep shit up to date and not use bottom barrel $10/hour offshored engineers. It will have to become company culture to keep shit up to date and do the basics in security. Like with equifax: https://arstechnica.com/information-technology/2017/10/a-series-of-delays-and-major-errors-led-to-massive-equifax-breach/ https://arstechnica.com/information-technology/2017/10/a-ser... And when that is the problem you have to deal with, it's more about executive buy in and management than it's about any sort of security expertise, and that seems fairly difficult to do at most companies with really large systemic security culture issues such as that.
arcboii92 7y ago
As a software engineer early enough in his career to change tack, how would I go about venturing into this space? Cybersecurity is something that has always interested me, but it seems like such a massive feat that I often find myself overwhelmed and settle back into my comfortable dev job. Then every time we finish building a new publicly accessible system we send it off to "the security company" to pen test it. I am always very jealous about this.
- neuralzen 7y ago
  Take the OSCP course, that would get you some good practical exposure and a well-recognized cert. Having a software engineering background you'd be well positioned to do code auditing too, if that was your bag. If you really want to make bank, get into smart contract auditing. Going to events like DefCon and Blackhat is great for networking too. Check out capturetheether.com and hackthebox.eu for some practice!
  - bitcoinmoney 7y ago
    Smart contract auditing = block chain? Are those jobs still around? I thought that had a 1 year shelf life
- chasemiller 7y ago
  Bug bounties are a great way to get your feet wet. I've seen many devs (especially web devs) have a lot of success hacking on websites that are built with frameworks they are familiar with. I would recommend checking out Bugcrowd or Hackerone to get started. Besides that, there are a ton of great online courses such as PWK/OSCP, and labs (HacktheBox).
- mitchell_h 7y ago
  Cyber security is so wild west right now. change your linkedin. Do some public speaking. Read some blogs and you'll get your foot in the door. Where you go from there is about how well you sell your self.
- biztos 7y ago
  There is the serious end of the security business, the service end, and the fake end. Plus of course all the black-hat ends. If you want to be in the serious end, which doesn't necessarily pay more than any other software job but can be really interesting work, I would suggest learning about anti-virus and similar attacks (there are books and tutorials) and generally making your server software game as strong as possible. Then get a job with a security company at whatever level and bust your ass looking for challenges. You can rise very quickly if you can move the dial for the customers, and "smart and gets things done" plus "gives a shit about security" is a rarer combination than you'd think. The service part, e.g. your pen-test company, is going to be much more mercenary. Great experience if you can get it, and probably a good space to start your own company in, but of very limited value in the big world. Security companies will have huge annual contracts, pen-testers and the like will be called in occasionally to check off a box on a security audit. Either one can work for you, but it's best to know what you're getting into. The fake end of course is companies promising something they won't actually deliver, or will deliver with gross violations of ethics and/or the law. Obviously avoid these as best you can -- for the more serious companies, having your name associated with "SEO" or other spammers can permanently blacklist you from employment at least in the US, obviously the dodgier the play the greater risk of blacklisting. Hiring managers worth their salt have a nose for this, since Ethics is way more important than Skillz for any serious security job. In case the black-hat part isn't obvious: in many places word gets around if a talented hacker is interested in security. Mafia is mafia even for us nerds. If something sounds suspicious, I strongly suggest you don't take the meeting. (This may be less of an issue in the US.) Best of luck to you! The world needs more smart people working for a safer Internet!
euske 7y ago
No disrespect to actual security experts, but here are the four common areas where a lot of dubious/questionable "pros" can pop up: - Health experts - Education specialists - Productivity gurus - Security specialists
- whymauri 7y ago
  where's blockchain?
- freehunter 7y ago
  As a security specialist, 100% agree. It’s just not provable that we are worth anything. There is so much theory and guesswork and companies still get hacked because you can’t prove if I’m wrong or right until you actually get hacked. There’s too much ground to cover and not enough people watching the alarms. And of course he alarms trigger whenever a stiff wind blows. Everyone wants to do security but no one knows what security means so they just cut a fat check and pretend like it is working.
  - WrtCdEvrydy 7y ago
    It's the same thing as formal software engineering specs. Unless you're doing software for airplanes, ain't noone formally proofing anything being done.
    - agentultra 7y ago
      That's not true! I don't usually write proofs at work but I do work with formal models of critical sections in our systems. Although on the side I am working on bootstrapping Lean's ecosystem so we can write more proof-carrying code in more places.
  - westpfelia 7y ago
    Plus Security Expert is incredibly vague. Like what do you do? Are you a pen tester? SIEM analyst? Compliance? Do you work in SecDevOps? Or are just a firewall/IDS guy? Or maybe you walk around the office and hit your accountants every time they click on a phishing link with a wiffel ball bat. The world of info sec is so massive that saying you are a expert in 'Security' is useless.
bulatb 7y ago
High-profile well-connected people, friends and peers of executives, and people in a right-place, right-time situation name their own price. ICs at FAANG get FAANG-level comp. Consultants gladly take dumb money's budget. "Cybersecurity Pros" get the standard NDA and noncompete. Until there's a breach.
siculars 7y ago
“CEOs don’t know what it’s worth until it’s walking out the door,” Comyns said. “Then they stand in the door and say, ‘You’re not going anywhere.’” They deserve what they get. If you underfund critical parts of your infrastructure that you don't even realize are critical, what do you expect? Pay for talent. End of story.
- Spivak 7y ago
  True, but if it's critically underfunded everywhere then it's what we have now where it's just the cost of doing business and a risk you account for. I would imagine most sites on the internet could be exploited by someone targeted and ultimately relying on the fact that their data/site isn't valuable enough to attack in the first place.
buboard 7y ago
cybersecurity is a cat and mouse game, it will never end. If it ends up like another arms race, it s going to be a huge cost to the markets, bigger than any national defense budget. The best way to secure data is not to have them stored in the first place. I think this will be the next big trend, from big data to small data
- bayesian_horse 7y ago
  Most cybersecurity threats are "simple" crime, rather than government action, and even the latter is often quite "commercial". If there is enough law enforcement and enough self-protections by civilians (companies), criminals should get demotivated and the overall level of activity should die down, just like "real" crime. We're far from that though.
ummonk 7y ago
>Just last week, Capital One Financial Corp. disclosed that personal data of about 100 million customers had been illegally accessed by a Seattle woman, possibly one of the largest breaches affecting a U.S. bank. The firm’s shares have fallen 8.9% since the intrusion was revealed. Misleading reporting. The whole stock market went down since then, and banks particularly so.
mrdependable 7y ago
I've been interested in learning cyber security for a while, but I can't help but feel if there was a successful attack the fallout and pressure would be intense. Is that a real thing to worry about or is my imagination getting away with me?
- TACIXAT 7y ago
  There are all hands on deck situations, but you just do what you're good at, figure stuff out, and fix it asap. Usually it's a team effort. Not awful. If you're interested I really recommend it.
plolio 7y ago
I'm studying cyber security in Germany. It's the single best decision I've made so far. The work opportunities seem endless and I love working in the industry. Most of my fellow students simply decided to go into this field because of the high monetary compensation and expect salaries starting from 60k€ upwards with a Bachelors.
- hwj 7y ago
  Does the name of your university start with an "R"? ;)
dandare 7y ago
The last time my work password expired and I had to increase the number at the end from 7 to 8, I asked our 6-figure-salary cybersecurity pro what is the point of password rotation when all it achieves is that regular users stick it on post-its to their monitors or store it in draft emails in Outlook. > Compliance.
zer0faith 7y ago
Guess I need a raise.
- commandlinefan 7y ago
  Title is misleading. It should read “Cybersecurity pros who graduated summa cum laude from Ivy League universities with dozens of contacts in the C-levels of Fortune 500 companies and are under 30 can name their own price”. Truly unique times we live in.
auiya 7y ago
Yes and no. The price many cybersecurity pros want, is to be able to live in a place of their choosing and work remotely. Many will even take lower salaries than the market would dictate where the company is located to do so. While this is slowly improving, a majority of companies are still not willing to accommodate this in my experience.
slowhand09 7y ago
I want companies to be held liable for their breach, especially when they are negligence or easily avoidable. I currently have FREE CREDIT MONITORING as my PII has been exposed by multiple reputable companies plus the government. Monitoring x3 doesn't punish them for leaking my data. I doesn't even (in my mind) give them enough incentive to make it much harder to loose. I'd be happy if is was encrypted and regularly tested to make sure it was still encrypted, both at rest and in motion.
- slowhand09 7y ago
  note: monitoring X 3 as multiple leakers each are being "punished".

236 points by benryon 7y ago

There is an endless supply "infosec specialists" and "ethical hackers." But there is a massive shortage in motivated experts that ensure packages are up to date and fluent enough in code spelunking to ensure the app isn't trusting user input or allowing privilege escalation. There's also a shortage in technology leaders willing to spend money on the mundane aspect of security. It requires regular work, not compliance effort and periodic audits/pentests that check off boxes.

cryptica 7y ago
Software complexity in most companies has exploded. Nobody is doing anything to try reduce or manage complexity so it's only getting worse. The more complexity there is, the easier it is to find vulnerabilities.
- CyberBank 7y ago
  >>Nobody is doing anything to try reduce or manage complexity so it's only getting worse. I disagree, I see a number of large corporations starting to standardize either 1) their entire development stack from IDE all the way to how the code is deploy 2) Reengineering entire languages to have one language be used e.g Quartz at BofA 3) at the very least, companies are starting to standardize their middleware stacks, to at least avoid the configuration related issues of having a development team managing that. While I do agree, that the complexity of third party libraries has exploded and is increasingly difficult to manage, I'd say companies are well on their way to standardizing that, with tools like Nexus, SonaType, Blackduck, etc. We're obviously a long ways away from being even 75% effective across the board, but to say nobody is managing the complexity is a bit short sighted :)
  - ctcthrowaway 7y ago
    OPSEC comrade :)
  - WrtCdEvrydy 7y ago
    > I see a number of large corporations starting to standardize My current job in a nutshell. It's like handling children (No, you can't add a new technology because you want something fancy on your resume)
- zercurity 7y ago
  We're trying to address this. If you've got sometime I'd really like to compare notes on this and learn how you guys work day-to-day. We're leveraging Osquery to asses the various aspects of systems to try and build threat models where risk cascades as systems change. To help facilitate automated reporting. Alongside the traditional mundane cybersecurity day-to-day activities.
bluedino 7y ago
Things are out of date because things that are working don’t get money and time allotted to them to update them. People still run Windows XP because there’s a piece of software that never got updated to run on Windows 7, much less Windows 10. There’s those Java apps that are stuck on Java 6. Websites that still need IE6. Things that use the unsafe versions of stuff like HTTPS...because Visual Basic 6 doesn’t support them out of the box. But it still works. So it keeps going.
hyperion2010 7y ago
I'm out here imagining all the unethical hackers drooling over the sweet sweet vectors that are snap and flatpak. Unfortunately the qa and auditing aspects of distro packaging seem to be taken for granted, and the resources for that are surely not sufficient to counter motivated adversaries.
- antod 7y ago
  Don't forget helm charts and docker containers. The security/assurance of that supply chain is pretty lacking. It feels like some people are actively applying the (historical?) Wordpress security model to Kubernetes for expediency.
- snazz 7y ago
  Do enough people actually use Snap or Flatpak (especially at large companies) to make it worth anything? I’d imagine that most people would just use real distro packages and stuff compiled from source instead of trusting Snapcraft or random Flatpaks off the Internet, especially in production.
deleted 7y ago
[deleted]

gist 7y ago

Also sounds like in the old days and somewhat similar to 'nobody ever got fired for buying IBM'. Why? Well by throwing money a great deal of money to hire the experts (if that is the case) nobody can be called out as they can if they didn't pay for that insurance.

jedberg 7y ago

Not surprising. At Netflix, despite the already high salaries, the security engineers were paid a premium for their skills. The highest paid engineers at Netflix were security engineers. They did stuff like invent entirely new security protocols[0][1]. [0] https://medium.com/netflix-techblog/message-security-layer-a-modern-take-on-securing-communication-f16964b79642 https://medium.com/netflix-techblog/message-security-layer-a... [1] https://github.com/Netflix/msl https://github.com/Netflix/msl

lawnchair_larry 7y ago
How do you know what everyone was paid? That’s definitely not the norm though - security engineers are typically classified the same as an SDE for payroll purposes, and tend to have less negotiating leverage than high level SDEs who build and ship products, except maybe some very rare exceptions. But most companies also don’t have their security engineers actually write shipping code. I think this article, like every security related article from bloomberg, is pretty much BS. Also, they use the example of CISO at a large company. CISOs aren’t actually security experts in the vast majority of companies. They’re usually business people or outright frauds, disappointingly. The people who hire and interview them have no way to validate them. The article makes a case for why CISOs are worth a lot, justifying the cost of a breach. The problem is that CISOs have virtually no impact on whether or not you get breached, and they usually bear no responsibility for it. It doesn’t matter who you pay how much - it isn’t going to affect the outcome much. Alex Stamos is one of the few that actually has any background in security at all, and look what good that did Yahoo and Facebook. Not much. The other problem is CISOs rarely get any actual authority over product, and when they try to flex, they just get pushed out. The ones who survive are simply master politicians who manage their messaging and their image. The real reason for this article, I suspect, which appears to be primarily sourced from a security recruiting firm, is that they take a cut of every position they fill. It’s very much in their best interest to pump up the value to justify their fees. Most security money is very poorly spent. I think part of the problem is that hackers are usually bad managers, and tend to be less interested in playing corporate politics. So the manager jobs go to someone else, who has to make decisions they don’t understand. The higher up you go, the more this gets amplified. For every breach you hear about, that company likely has a few competent security folks saying, “see, I told you...”

CyberBank 7y ago

The biggest areas for growth for Cyber at the moment are of the not-so-sexy jobs. The asset inventory, patch management, vulnerability management, third party management, risk management, etc. If you are good at any of those and are innovating in any of those areas, you are as close to naming your own price as you can get in Cyber. As for the most "needed" areas of Cyber, it comes down to education. Not your bachelors degree, but educating and raising awareness to your business, your IT staff, and even your development teams. It's extremely tricky to measure your return on investment, but almost always it comes down to a lack of knowledge causing one massive hole in the fence, leading to a breach. No amount of controls will stop someone truly motivated and skilled, so you're better off raising the fence a bit higher and hoping that it deters the truly malicious. Disclosure: I run Vulnerability Management and Assessments globally for one of the largest companies in the world, so my answer may be a bit bias :)

thorwasdfasdf 7y ago
I've never understood people who say: "No amount of controls will stop someone truly motivated and skilled". I don't think that's true. Correct me if I'm wrong, but If there's no holes in the application/web stack to be exploited, then there's no getting in. Right? It's not about hacker/pirate skill. It's about whether or not the target has plugged all their holes or not.
- spydum 7y ago
  not right. there are ALWAYS holes - it's the nature of software, hardware, and humans.
- CyberBank 7y ago
  I am referring to a CIA (confidentiality, integrity, availability) related incident. Less so the availability. If an attack was truly motivated, the web stack / application stack is not how you compromise the system. The user is how you compromise the system. Do you have proper physical security to prevent unauthorized access? Do you have proper password and 2 factor auth configured? Do you educate your employees on how to identify phishing? There are numerous other ways to compromise a system than remotely via the web or application stack :)

aczerepinski 7y ago

I'm skeptical about the "more than 300,000 unfilled security jobs" stat. Are we talking about thousands of empty chairs for each of the big tech companies and hundreds for each of the remaining fortune 500?

eswat 7y ago
I’m failing at finding the original report about this but this is the line I keep seeing repeated in PRs: > Nationally, there were 301,873 cybersecurity job openings in the private and public sectors during the 12-month period between April 2017 and March 2018. This included 13,610 openings in the public sector.
bluedino 7y ago
Mostly security auditors, people who fill out spreadsheeets or run canned tools
mr_toad 7y ago
I don’t know about this particular statistic, but what is often done in these studies is to survey organisations to ask how many of these staff they want or need, or how many vacant ‘positions’ they have. The numbers don’t always reflect how many positions they actually have the budget for, or whether they’re willing to pay a realistic rate. Arguably, if they were willing to pay market rates there couldn’t be any vacancies, because supply and demand.
- bayesian_horse 7y ago
  I rarely see the concept of "supply and demand" used properly. In introductory economics, it's just two lines crossing somewhere. In reality though, companies still have to make a buck, so there is a definite limit on how much a company can pay a "security professional" and still be profitable. And worse, if we are talking about a labor shortage across an industry or country, price doesn't really come into it at all. Price is only a competitive factor, it doesn't create or destroy individual developers. If one employer "scoops" an employee for a higher price, the shortage moves to where he just left. Sucking in talent from other industries or countries also has its limits. And on top of all of that there seems to be some anti-competitive effects preventing wage-wars.

jamestimmins 7y ago

I'm curious if anyone has found consistent work doing bug bounty's and things like HackerOne to a sufficient degree that it would replace a FT engineer role. I'd love to hear/learn about someone's experiences if it exists.

CyberBank 7y ago
I know a few folks who do full time between things like SynAck and BugCrowd. SynAck is the ideal model in my opinion for pivoting to full time vs part time as a professional bug bounty individual, although it takes a ton of skill and hardwork. I'd say it's the exception moreso than the norm. If you are interested in learning more about SynAck and it's model shoot me an email: i@willcode.it I can try and setup some contacts from their side that are working full time on platforms like it
- jcims 7y ago
  Do the folks you know that are doing this full time actually depend on that income for their livelihood? I was on the receiving end of a large program for a short stint and have been watching it casually over the past few years. It's very much a feast and famine way to live, and you need to not only be very skilled, you also need to be dedicated to the effort and be very disciplined with your money. A $20K chained RCE looks great on paper until you're trying to live on a constant diet of clickjacking and IDOR bugs for two months straight. I would caution anyone thinking about this to do it as a side hustle for at least six months if not a year to test the waters, understand the subculture a bit, and take a few rounds on the roller coaster.
  - CyberBank 7y ago
    Yes the ones I know do it full time as their only income AFAIK. Most do live in low cost of living areas, none of them that I know are living in places like San Fran :)
    - jcims 7y ago
      Ah, indeed low CoL helps a ton. I would say only 10-15% of our reports were from folks in the USA and I don't recall any being full time. The dedicated folks were mostly from eastern europe and middle east...i'm guessing that has changed a bit over the past few years.

SubiculumCode 7y ago

I told my son repeatedly that if he ever wanted a secure and high paying job it coukd be in cybersecurity. We aren't going back to less dependence on networks, and we are putting more and more valuable assets and operations on those networks, which will need to be protected. Although, I suppose ut is possible that computer security could move into the automsted sphere....

novok 7y ago

A lot security issues will boil down to the CISO / consultant saying: You have to spend a lot more on your software infrastructure, hire more staff and keep shit up to date and not use bottom barrel $10/hour offshored engineers. It will have to become company culture to keep shit up to date and do the basics in security. Like with equifax: https://arstechnica.com/information-technology/2017/10/a-series-of-delays-and-major-errors-led-to-massive-equifax-breach/ https://arstechnica.com/information-technology/2017/10/a-ser... And when that is the problem you have to deal with, it's more about executive buy in and management than it's about any sort of security expertise, and that seems fairly difficult to do at most companies with really large systemic security culture issues such as that.

arcboii92 7y ago

As a software engineer early enough in his career to change tack, how would I go about venturing into this space? Cybersecurity is something that has always interested me, but it seems like such a massive feat that I often find myself overwhelmed and settle back into my comfortable dev job. Then every time we finish building a new publicly accessible system we send it off to "the security company" to pen test it. I am always very jealous about this.

neuralzen 7y ago
Take the OSCP course, that would get you some good practical exposure and a well-recognized cert. Having a software engineering background you'd be well positioned to do code auditing too, if that was your bag. If you really want to make bank, get into smart contract auditing. Going to events like DefCon and Blackhat is great for networking too. Check out capturetheether.com and hackthebox.eu for some practice!
- bitcoinmoney 7y ago
  Smart contract auditing = block chain? Are those jobs still around? I thought that had a 1 year shelf life
chasemiller 7y ago
Bug bounties are a great way to get your feet wet. I've seen many devs (especially web devs) have a lot of success hacking on websites that are built with frameworks they are familiar with. I would recommend checking out Bugcrowd or Hackerone to get started. Besides that, there are a ton of great online courses such as PWK/OSCP, and labs (HacktheBox).
mitchell_h 7y ago
Cyber security is so wild west right now. change your linkedin. Do some public speaking. Read some blogs and you'll get your foot in the door. Where you go from there is about how well you sell your self.
biztos 7y ago
There is the serious end of the security business, the service end, and the fake end. Plus of course all the black-hat ends. If you want to be in the serious end, which doesn't necessarily pay more than any other software job but can be really interesting work, I would suggest learning about anti-virus and similar attacks (there are books and tutorials) and generally making your server software game as strong as possible. Then get a job with a security company at whatever level and bust your ass looking for challenges. You can rise very quickly if you can move the dial for the customers, and "smart and gets things done" plus "gives a shit about security" is a rarer combination than you'd think. The service part, e.g. your pen-test company, is going to be much more mercenary. Great experience if you can get it, and probably a good space to start your own company in, but of very limited value in the big world. Security companies will have huge annual contracts, pen-testers and the like will be called in occasionally to check off a box on a security audit. Either one can work for you, but it's best to know what you're getting into. The fake end of course is companies promising something they won't actually deliver, or will deliver with gross violations of ethics and/or the law. Obviously avoid these as best you can -- for the more serious companies, having your name associated with "SEO" or other spammers can permanently blacklist you from employment at least in the US, obviously the dodgier the play the greater risk of blacklisting. Hiring managers worth their salt have a nose for this, since Ethics is way more important than Skillz for any serious security job. In case the black-hat part isn't obvious: in many places word gets around if a talented hacker is interested in security. Mafia is mafia even for us nerds. If something sounds suspicious, I strongly suggest you don't take the meeting. (This may be less of an issue in the US.) Best of luck to you! The world needs more smart people working for a safer Internet!

euske 7y ago

No disrespect to actual security experts, but here are the four common areas where a lot of dubious/questionable "pros" can pop up: - Health experts - Education specialists - Productivity gurus - Security specialists

whymauri 7y ago
where's blockchain?
freehunter 7y ago
As a security specialist, 100% agree. It’s just not provable that we are worth anything. There is so much theory and guesswork and companies still get hacked because you can’t prove if I’m wrong or right until you actually get hacked. There’s too much ground to cover and not enough people watching the alarms. And of course he alarms trigger whenever a stiff wind blows. Everyone wants to do security but no one knows what security means so they just cut a fat check and pretend like it is working.
- WrtCdEvrydy 7y ago
  It's the same thing as formal software engineering specs. Unless you're doing software for airplanes, ain't noone formally proofing anything being done.
  - agentultra 7y ago
    That's not true! I don't usually write proofs at work but I do work with formal models of critical sections in our systems. Although on the side I am working on bootstrapping Lean's ecosystem so we can write more proof-carrying code in more places.
- westpfelia 7y ago
  Plus Security Expert is incredibly vague. Like what do you do? Are you a pen tester? SIEM analyst? Compliance? Do you work in SecDevOps? Or are just a firewall/IDS guy? Or maybe you walk around the office and hit your accountants every time they click on a phishing link with a wiffel ball bat. The world of info sec is so massive that saying you are a expert in 'Security' is useless.

bulatb 7y ago

High-profile well-connected people, friends and peers of executives, and people in a right-place, right-time situation name their own price. ICs at FAANG get FAANG-level comp. Consultants gladly take dumb money's budget. "Cybersecurity Pros" get the standard NDA and noncompete. Until there's a breach.

siculars 7y ago

“CEOs don’t know what it’s worth until it’s walking out the door,” Comyns said. “Then they stand in the door and say, ‘You’re not going anywhere.’” They deserve what they get. If you underfund critical parts of your infrastructure that you don't even realize are critical, what do you expect? Pay for talent. End of story.

Spivak 7y ago
True, but if it's critically underfunded everywhere then it's what we have now where it's just the cost of doing business and a risk you account for. I would imagine most sites on the internet could be exploited by someone targeted and ultimately relying on the fact that their data/site isn't valuable enough to attack in the first place.

buboard 7y ago

cybersecurity is a cat and mouse game, it will never end. If it ends up like another arms race, it s going to be a huge cost to the markets, bigger than any national defense budget. The best way to secure data is not to have them stored in the first place. I think this will be the next big trend, from big data to small data

bayesian_horse 7y ago
Most cybersecurity threats are "simple" crime, rather than government action, and even the latter is often quite "commercial". If there is enough law enforcement and enough self-protections by civilians (companies), criminals should get demotivated and the overall level of activity should die down, just like "real" crime. We're far from that though.

ummonk 7y ago

>Just last week, Capital One Financial Corp. disclosed that personal data of about 100 million customers had been illegally accessed by a Seattle woman, possibly one of the largest breaches affecting a U.S. bank. The firm’s shares have fallen 8.9% since the intrusion was revealed. Misleading reporting. The whole stock market went down since then, and banks particularly so.

mrdependable 7y ago

I've been interested in learning cyber security for a while, but I can't help but feel if there was a successful attack the fallout and pressure would be intense. Is that a real thing to worry about or is my imagination getting away with me?

TACIXAT 7y ago
There are all hands on deck situations, but you just do what you're good at, figure stuff out, and fix it asap. Usually it's a team effort. Not awful. If you're interested I really recommend it.

plolio 7y ago

I'm studying cyber security in Germany. It's the single best decision I've made so far. The work opportunities seem endless and I love working in the industry. Most of my fellow students simply decided to go into this field because of the high monetary compensation and expect salaries starting from 60k€ upwards with a Bachelors.

hwj 7y ago
Does the name of your university start with an "R"? ;)

dandare 7y ago

The last time my work password expired and I had to increase the number at the end from 7 to 8, I asked our 6-figure-salary cybersecurity pro what is the point of password rotation when all it achieves is that regular users stick it on post-its to their monitors or store it in draft emails in Outlook. > Compliance.

zer0faith 7y ago

Guess I need a raise.

commandlinefan 7y ago
Title is misleading. It should read “Cybersecurity pros who graduated summa cum laude from Ivy League universities with dozens of contacts in the C-levels of Fortune 500 companies and are under 30 can name their own price”. Truly unique times we live in.

auiya 7y ago

Yes and no. The price many cybersecurity pros want, is to be able to live in a place of their choosing and work remotely. Many will even take lower salaries than the market would dictate where the company is located to do so. While this is slowly improving, a majority of companies are still not willing to accommodate this in my experience.

slowhand09 7y ago

I want companies to be held liable for their breach, especially when they are negligence or easily avoidable. I currently have FREE CREDIT MONITORING as my PII has been exposed by multiple reputable companies plus the government. Monitoring x3 doesn't punish them for leaking my data. I doesn't even (in my mind) give them enough incentive to make it much harder to loose. I'd be happy if is was encrypted and regularly tested to make sure it was still encrypted, both at rest and in motion.

slowhand09 7y ago
note: monitoring X 3 as multiple leakers each are being "punished".