3 ms·

> Imagine a company culture where everyone has the same line of thought you just did? What is this strange intellectual posturing you are doing? If you wanted

> Imagine a company culture where everyone has the same line of thought you just did? What is this strange intellectual posturing you are doing? If you wanted to say you think I’m an idiot, just say it without spending 300 words to subtly imply it. Look, unlike your comment, mine doesn’t require you to imagine any hypothetical worlds. I don’t have to imagine a hypothetical world where cybersecurity professionals are undervalued and undereducated, I see it every day. People doing extremely dumb shit because they don’t know better. At least they’re “free to think in a different direction”! They don’t need handholding. They don’t need to hire a “consultant” for $300/hr to read NIST documents for them. They need education, whether that’s college or some other model I don’t care.

BoorishBears 3y ago
Your comment was about a need to change education. > cybersecurity professionals are undervalued and undereducated, I see it every day. Which is more effective at changing that situation? - changing the education system - increasing the cost of laissez-faire hiring practices If a breach cost 100x as much, does the value of qualified professionals go up or down? Do incentives to upskill go up or down? Do oversight and vetting of hires go up or down? You can educate professionals until you're blue in the face: if the cost of hiring people who are underqualified doesn't change, the industry will even settle for unqualified people. If anything you'll just devalue the ones you educated even further: Their time and effort isn't free, meanwhile there's no increase in demand for them because you didn't change the cost of hiring someone dumber. You just took their time without giving them a way to actually get a return on it... unless thanklessly fighting to apply their newfound knowledge in a system that already undervalues them is your idea of a return. _ Of course, you're free to draw whatever pivot/conclusion/aberration/perceived slight you want from here: my father is a PhD, my mother holds a doctorate and they're both from the 3rd world. I've experienced what higher education can do for people better than most, there was no posturing.
- subjectsigma 3y ago
  In my line of work (government contracting) undervaluing of cybersecurity is a direct consequence of ignorance. You have no idea how many times I’ve given the same scare brief to a decision maker who on Slide 1 said “We are already safe, we don’t need this crap” and on Slide 200 is clamoring to hire more people. But they can’t find any; qualified professionals are few and far between, and too expensive for GS scale.

BoorishBears 3y ago

Your comment was about a need to change education. > cybersecurity professionals are undervalued and undereducated, I see it every day. Which is more effective at changing that situation? - changing the education system - increasing the cost of laissez-faire hiring practices If a breach cost 100x as much, does the value of qualified professionals go up or down? Do incentives to upskill go up or down? Do oversight and vetting of hires go up or down? You can educate professionals until you're blue in the face: if the cost of hiring people who are underqualified doesn't change, the industry will even settle for unqualified people. If anything you'll just devalue the ones you educated even further: Their time and effort isn't free, meanwhile there's no increase in demand for them because you didn't change the cost of hiring someone dumber. You just took their time without giving them a way to actually get a return on it... unless thanklessly fighting to apply their newfound knowledge in a system that already undervalues them is your idea of a return. _ Of course, you're free to draw whatever pivot/conclusion/aberration/perceived slight you want from here: my father is a PhD, my mother holds a doctorate and they're both from the 3rd world. I've experienced what higher education can do for people better than most, there was no posturing.

subjectsigma 3y ago
In my line of work (government contracting) undervaluing of cybersecurity is a direct consequence of ignorance. You have no idea how many times I’ve given the same scare brief to a decision maker who on Slide 1 said “We are already safe, we don’t need this crap” and on Slide 200 is clamoring to hire more people. But they can’t find any; qualified professionals are few and far between, and too expensive for GS scale.