Schneier is on the money again and it's painfully true. Elsewhere I've said why cybersecurity is a losing battle and a significant part of the problem is the e

Schneier is on the money again and it's painfully true. Elsewhere I've said why cybersecurity is a losing battle and a significant part of the problem is the educational and HR side of things [0]. There's a motivation and engagement problem. Generally, people have no idea what cybersecurity is. It scares them, and they either don't want to talk about it or will let any random "expert" assuage or distract them. That's made fertile ground for a flourishing certificate and compliance racket of clueless gatekeepers who only make things worse, because the field is so deep and dynamic this stuff is ossified before the ink is dry. I also see that it's an entirely reactive affair. People and companies will spend zero attention and money on cybersecurity until they get hacked, then run around spending their fortune like there's no tomorrow of stupid things. This attracts opportunists who are often as bad as the ransom-ware gangs that preyed on them in the first place. Unpleasant as it is to say, it's the fault of the companies who do not value the deep and hard won knowledge of those who could help them... a cohort who are growing older and giving up caring. And frankly, universities are fucked, to put it as politely as I can. At least in Britain, nobody who can do this stuff wants to be within a clear country mile of these crumbling institutions with their awful pay and working conditions and total lack of vision. Elsewhere we have military and intelligence groups playing at 1980s "cyberwars", completely missing that the real war is going on within our culture. So what we're left with is a technologically over-extended society that cannot meet the maintenance needs of its structure. As educators, sadly we might set many young people up for failure and struggle since the expectations and demands of "the industry" don't match what they can deliver. Consequently the high churn leads to even more disaffection and panic in the industry. Worse still is the fate of women in cybersecurity. Again and again I've seen equally qualified candidates go into a firm on the same pay grade, the guy gets out on "pen-testing" and the woman gets put on front line support (read: stress and abuse hell). The women are almost universally demeaned and given "agreeable" public facing work, while the men are streamed into "technical" roles. The tragedy is, it's usually the females who seem to understand the higher-level strategic and operational wisdom that is so desperately missing. [0] https://www.linuxtoday.com/developer/why-we-cant-teach-cybersecurity/ https://www.linuxtoday.com/developer/why-we-cant-teach-cyber...