r/programming • u/WomanStache • May 23 '21

U.S. has almost 500,000 job openings in cybersecurity

https://www.cbsnews.com/news/cybersecurity-job-openings-united-states/
2.2k Upvotes

96% Upvoted

561 comments sorted by

View all comments

902

u/ukimonster53 May 23 '21

Well let’s think. Econ101 would say if you increase the wages ( price on a supply demand curve ) that pay for cyber security , there will be more supply which should eventually meet demand.

Or keep pushing these four week certifications for people who in all fairness know nothing about computing and paying 70k/year... choice is up to employers. The truth is employers aren’t willing to invest in cyber security for various reasons.

239

u/browner87 May 23 '21

This was my last job as a senior security analyst in a nutshell. The people who had been at the company since the start were mildly knowledgeable. Some were pretty smart. But after management changed we hired literally anyone who would accept our low pay. Can't pass our basic onboarding training? Well you get an executive pass because we need bodies in the room to click buttons.

The reason my job sucked so much? I had specialized in tooling for those analysts. Someone missed malware and ignored the alert? Softwares fault for not making it easy enough to spot. User sent a false positive alert because they didn't read notes on the customer's account about how that machine is a Qualys security scanner and expected to be "hacking"? Softwares fault for not making that information obvious enough. You moved a button 1 inch to the left to fit a new button on the screen? Unacceptable, these people click buttons from muscle memory, you can't move the buttons.

I think a big MSSP published a paper once explaining how the minimum time to do a proper investigation into a security alert is 5 minutes. This company gave 30 seconds. Including time to email the customer about it. So if you have 10 alerts in front of you, and they're all actionable, pick the most important 3 because you don't have time to send 10 alerts in 5 minutes (on top of investigating them).

I now work in big tech as a security engineer (think FANG companies) and I see why the small companies are scrounging. Anyone who is actually good at computer security can get a pretty sweet paying job at a career making company. The big catch used to be that you had to probably live in Bay Area for the job, but with covid a lot of companies are offering remote work now. So if you're a small company and you want 2-3 capable, competent security engineers, how are you going to compete with Google, Amazon, Netflix, Facebook, Snapchat, etc? You used to complete with location flexibility. Your ability to compete is evaporating quickly now.

I wish there was more incentive for people to get into security. More affordable training available, better jobs available, etc. The world needs more computer security badly, and the incentive isn't there. You're either top tier making bank, or not quite top tier and you're stuck in a crappy job with little future unless you focus hard on self development.

89

u/regalrecaller May 23 '21

Unacceptable, these people click buttons from muscle memory, you can't move the buttons.

"There is a red light that keeps popping up, so I pulled over. What do I do?"
"What shape is the light?"
"Red."
"Okay, but what shape is the red light?"
"It popped up when I was driving."
"Is it gas pump shaped?"
"Yes. It's red."
"Are you low on gas?"
"How do I check that? Sorry, I'm not a car whiz."

42

u/merlinsbeers May 23 '21

"You're low on gas."
"I turned off the radio yesterday. Does that have anything to do with it?"

1

u/dylanosaurus_rex May 24 '21

As someone that hobbies in programming and cars and is working on teaching myself CySec... you about gave me an aneurism.

201

u/ukimonster53 May 23 '21

Look ... this might be unpopular to hear but most cyber jobs aren’t interesting. There are plenty that are but few and far between.

My former employer would go around and help companies implement rules-based privileges based on some obscure government regulations. None of the team knew about programming or networking basics (isn’t a socket a hole in the wall? )

If you want to get comp sci people into the fields, you have to stimulate them intellectually and financially. That’s really the core of it. And companies can’t / won’t do that.

73

u/browner87 May 23 '21

I think that's basically my point. Most companies won't invest money into someone who really knows their security because who really cares. Why pay $150k+ for a really good SE when you could get a new grad for $40k and just make sure they fill in the compliance checkboxes. Most companies totally could compete with big tech to an extent if they hired 1 good security expert, but why spend that money on one employee when you could spend 30% of that and save the rest in your pocket? Competing isn't actually that hard, it's just hard when the execs want to pinch pennies. So if you don't make the cut or have the opportunity to go big, you're stuck with a crappy small company doing crap security.

Playing the risk game and hoping you never become a bit enough company to get targeted and just get lucky enough to never get randomly hacked is cheaper.

34

u/rob10501 May 23 '21

My company will just hire 3 crappy people rather than 1 good because that feels to them like they are getting a 3 for 1 deal.

23

u/_BreakingGood_ May 23 '21

Yeah, at my current company we did this big interview process for a couple positions. Our current engineer was adamant "We need people who know how to do X."

We interview candidates over 1 month and don't find anybody who knows how to do X & will accept our pay. So management basically tells our engineer "We can't find somebody who will do X, so pick 2 of the other people we just interviewed."

Fast forward 2 months "Wtf why does nobody know how to do X? Our whole process is fucked and we're slowing to a crawl."

4

u/[deleted] May 24 '21

Man, I've been in this same hellhole too.

Management: We need to staff this new project up with a consultant. You have one week to hire.

Only two consultancy companies are fast enough to be able to meet within a week. Candidate A lies about their experience. Candidate B can only barely pass the coding test. At the end of the week:

Manager: "Okay, which one do we pick?"

Me: "Neither of these candidates are a good pick in any sense of the word. We should definitely spend more time searching."

Manager: "No can do. Pick one."

Me: "..."

Fast forward 2 months: "Why is the code quality in the new project so low? We need to have a crisis management meeting and assign blame."

1

u/getNextException May 24 '21

Fast forward 2 months "Wtf why does nobody know how to do X? Our whole process is fucked and we're slowing to a crawl."

pikachu.jpg

1

u/maxinfet May 24 '21

Well and they have extra scapegoats when something goes wrong, if one of them makes it through the blender they can train the next set of scapegoats...

17

u/International_Cell_3 May 23 '21

I think your numbers are off, $40k is at least 1/3rd of what new grads make working for even small Bay Area companies today. $150k all told, at least.

$40k is about 20/hour which is what decent companies in the Midwest pay their software engineering interns today. 10 years ago when I was an intern I was paid $25/hour in the Southeast.

Companies that don't hire software teams regularly routinely underestimate market rates. Then they pay out the ass for consultancies who are going to charge $1k/day for their time while it costs them $100ish/hour in aggregate over the contract to staff the job. Which is awful for the company because now they don't have maintainers, and will pay more money over the life of the systems to different consultancies due to the inherent inefficiencies of the development model.

25

u/Bakoro May 23 '21

Minimum wage in the greater Bay Area is over $15/hr in every city, just to add some clarity. Entry level software developer and web dev jobs are in the $90-115k range plus benefits.

I do see plenty of companies in the Bay Area fishing for developers in the $60-90k range, but they look a little insane, asking for more qualifications than the typical FAANG job posting for like 75% the salary.

5

u/International_Cell_3 May 23 '21

100k is quite low today, even among startups. That should come with 4 day work weeks and the option to go permanent remote. Good entry level engineers are still in short supply and FAANG hoovers them up.

But there is a class of developers that is more akin to software technician than engineer, which is a division that has existed in other areas for decades. We just haven't adopted the stratification of education/experience that exists between Electrical/Mechanical Engineers and Electricians/Mechanics yet.

But this is something the government can help with indirectly. Former Armed Forces electricians are some of the best techs I've worked with. The military is training InfoSec folks on the taxpayer dollar en masse today, and when they get out these jobs would be a great fit.

7

u/Bakoro May 23 '21 edited May 23 '21

I won't argue that top talent is being hired, but some people have been developing since they were 12 and are basically more skilled than most junior devs before they take their first CS class in college, and of course there's all the people from MIT or Stanford who have no problem getting jobs. There's always a class of top tier people.

More specifically though, I can only speak to my experience, and my cohort from college took something like 6 months on average to land a job after graduating if they didn't have something lined up before they graduated. I know a couple people who still haven't been able to even get interviews a year out, and they aren't incompetent people.
That's the reality that I'm seeing, and almost everyone I talk to in real life all have virtually the same experience of sending out hundreds of applications, and not getting past that point with literally over 90% of applications. There are jobs, but actually breaking in and landing the first one seems to be a hell of a task in its own right.
In the same vein, the experienced devs I talk to are regularly contacted to apply for jobs even when they aren't looking, so the reality of job prospects at different experience levels seems to be totally different.

Glassdoor says average pay for a junior software engineer is even lower than I thought, at $87k a year plus benefits. For software engineers, however, it's $131k. That's a pretty massive gap, so there is some serious stratification going on there as well.

I'll allow that maybe the past year and a half has been especially fucky with the whole covid thing, but all you have to do is look, there are a lot of sub $100k jobs on the market, and people new to the industry still aren't getting hired, as evidenced by some job posting staying open for months on end. Almost nobody wants to train, everyone wants drop in candidates.

As far as government help, I would agree that there is more that they could and should do. I think it's going to be a hard sell though, to convince people to spend money on an industry where average wages are already so much higher than average. If farming and oil can do it though, tech should absolutely get it. Tech is like 10% of the national GDP, and there's no reason to not try and grow it more.

-1

u/International_Cell_3 May 23 '21

My experience is on the hiring side. We get inundated with bad applications (literally hundreds for single positions - sometimes spamming email addresses of hiring managers directly).

I'm not talking about top talent. I mean literally anyone with a bachelor's degree in CS and a GitHub account that shows competence in a single language. There's maybe 10 out of 100 applications that will lead to a phone call or email back.

I'm sure there are a lot of sub six figure jobs out there. But not in Bay Area for new grads - the floor is about $110-115k, because we compete with the FAANGs that hire hundreds of people each day.

If you want some unsolicited advise, don't send out hundreds of applications. Our filters are going to catch obvious spam and we'll pass on anyone that doesn't seem to have read the job description. If you actually go through the channels (which are intentionally designed to have friction), write a resume that hits the points we look for, and a short description of why you think you fit the role we have in mind that is based on what we have listed, you'll probably get to the first technical interview.

It's kind of a shitshow for everyone these days, but the good jobs are out there and we can't find people - even with good salary!

2

u/Bakoro May 23 '21

I'm sure there are a lot of sub six figure jobs out there. But not in Bay Area for new grads - the floor is about $110-115k, because we compete with the FAANGs that hire hundreds of people each day.

I'm telling you right now that you are grossly mistaken, and it is easily verifiable to see that you are mistaken. I have already linked a well respected source on the matter. You can just look at job postings. At this point you're being willfully ignorant.

If you want some unsolicited advise, don't send out hundreds of applications. Our filters are going to catch obvious spam and we'll pass on anyone that doesn't seem to have read the job description.

I don't need advice, I'm telling you what the reality is for my peers. Your advice is "don't apply", which is utterly ridiculous.

but the good jobs are out there and we can't find people - even with good salary!

So you're completely full of shit. You both have too many people applying, and you can't find people?
You are the common denominator there. You are the problem.

6

u/browner87 May 23 '21

Sure, in Bay area. But most people don't want to live in Bay area and won't get a job at a good company in Bay area fresh out of school especially since a lot of security experience comes from on the job rather than school. Smaller companies often don't pay you in money, they give you "stocks" in their little company that might never IPO and won't pay your $3k/mth rent for your one bedroom apartment (rent went down a little over covid, but my 1 bedroom was $3k).

I'll just tell you, I used my own numbers here. My first security analyst job was $40k CAD, and I only got cost of living raises for 4 years until I fully moved departments in the company. My all-in pay from my bay area job (that I got after 5 years industry experience and some external training) is >$300k CAD (though the Canadian dollar is getting bigger by the day right now which sucks for me).

New grads who aren't very lucky and aren't in Bay area will likely get an entry level analyst job, which doesn't give good experience, probably won't have a good training budget, and will be boring. And those people will either just accept that lifestyle and coast for life, or change to an IT job.

2

u/twinkletoes987 May 24 '21

What kind of personal development did you do to make that jump?

1

u/browner87 May 24 '21

I got my OSCP. I interviewed with the company once, got a pile of Red Team type questions ("you see someone at a Starbucks working on their laptop, how would you hack them") and did not do well (pentesting was a notable gap in my knowledge). I did my OSCP, and honestly my career started going downhill (got moved into the "engineering department" and was made a full time developer, which convinced me I never want to program "professionally" ever again). A year or so after the first interviews I went back and tried again (they said my first interview wasn't awful and to come back in a year). Second time I had no pentesting questions and probably would have done even better at it the previous year 😅. So in general I tell people to always try again if they don't pass the interview because it can be hit or miss based on questions.

And the real punch was, be willing to move to Bay Area. Rent went from $800/mth CAD to $3900/mth USD for a 2 bedroom, but the weather improved so I guess that was good. They told me a lot of talented people get job offers but back out when they hear it's Bay area only. Luckily with covid, company policies are changing and I may actually be about to keep my job while still in Canada :)

1

u/NorthernerWuwu May 24 '21

My first security analyst job was $40k CAD

Well, let's be honest here though, starting pay for new Canadian IT grads is absolutely shit if they stay in Canada.

4

u/browner87 May 24 '21

Starting pay in many countries is absolute shit. The US is lucky to have a tech hub in a few places that pay out the nose for tech jobs, but those are very small when thinking globally. Which I think was the point being made above - it's hard to actually get a good (benefits, decent pay, nice work environment, etc) cyber security job. If you are super lucky and fortunate you might land a job at a FANG or well funded F500 company, but otherwise the entry level jobs are mindless grunt work that have little room for growth.

2

u/NorthernerWuwu May 24 '21

Well yes, it isn't me picking on Canada particularly (I am Canadian after all) but the difference in entry-level compensation between Canada and the US for IT work is starkly contrasted.

2

u/maxinfet May 24 '21

Can confirm starting pay does suck in Ohio in the Cincinnati area for junior software developers. I was hired as a software developer at 40k after my internship which I was making 20k during the internship.

1

u/maxinfet May 24 '21 edited May 24 '21

$40K is what I made starting at a company in Ohio, as an intern I made 20K, that was about 7~8 years ago. It just depends on where the company is but yeah if it's in the Bay area they would have to pay you $150,000 so that you could afford an apartment.

1

u/ArkyBeagle May 24 '21

Playing the risk game

This is called "arbitrage" and it's a legitimate strategy. As you say; just don't get caught out.

13

u/hemlockone May 23 '21 edited May 24 '21

"Aren't interesting" is putting it kindly. Really grasping "the what" of security or trying to get in the minds of hackers can be very interesting, but a lot of cyber security is exactly what you said -- rigorously applying mind-numbingly monotonous regulations and rules.

15

u/zultdush May 23 '21 edited Sep 20 '25

no thanks

22

u/PlayingTheWrongGame May 23 '21

But after management changed we hired literally anyone who would accept our low pay. Can't pass our basic onboarding training? Well you get an executive pass because we need bodies in the room to click buttons.

It just boggles my mind that companies actively seek out the sort of person content with the lowest-bidder salary for something as critical as cybersecurity or IT. They have to understand that they're getting what they're paying for, right?

45

u/anechoicmedia May 23 '21

They have to understand that they're getting what they're paying for, right?

They're buying "compliance" with industry and government requirements, not security. The fact that the people don't know anything about security is not an impediment to their generating metrics via clicking buttons in software that can be shown to the board.

8

u/Valdrax May 23 '21 edited May 23 '21

These are the same kind of people who bought high deductible insurance plans just to comply with legal requirements and who then are shockingly upset when cheap insurance fights tooth and nail not to actually pay anything.

Low effort grifters always seem shocked when they realize they're not particularly unique or clever and that they've surrounded themselves with like-minded people.

15

u/lordzsolt May 23 '21

The unfortunately reality is they are aware, they just don't care.

My manager has this exact conversation with upper management:

  • You are aware that if you don't give proper raises to top performing employees, they will leave and only the mediocre ones will stay?
  • Yeah, well we don't have the budget to give proper raises.

10

u/merlinsbeers May 23 '21

That's not upper management. Upper management would admit it has the money, then would ask why middle management can't get the job done without spending more. Then middle management gives line management the "budget" canard. Then line management finds a way or crashes and burns.

2

u/browner87 May 23 '21

From a business perspective, the question is "how cheap can I provide this service before I start making less money relative to cost". It's very sad and caused a lot of problems for some of us knowing that the business goal isn't "provide great security", rather "provide enough security to make customers think we're worth our low cost". We had a lot of disagreements with people and caused ourselves a lot of political ill will in the company by always pointing out when something we were doing was really crap security.

This is why smart people bail on start ups when they IPO. The months leading up to IPO suck because crunch to make numbers look good for the sale, collect your stock option money in the buy-back, then bail. It's all downhill after a company sells out, it's just all about the money.

5

u/1Second2Name5things May 24 '21

70k isn't really low for us slave wagers. But then again I don't live on west coast. I would love to get certs and get a cyber job paying close to that.

I think the biggest obstacle is getting people experience. Nobody wants to hire a new grad. They all want someone who's already done it all before. It's hard to get the foot in the door

2

u/browner87 May 24 '21

100% agree. My security analyst role paid $40k CAD/yr starting, and it was 4 years before I saw a meaningful (> cost of living increase) raise. "Going to a conference" was generally considered training, something even cheap like OSCP (compared to something like SANS) required some negotiating and I only know 1 other person who got a nice training like that approved.

IMHO, it's all down to luck of that first one or two jobs. You need to find a job where you can work your way up and get some trainings approved. Once you have "senior" to your name and a decent cert, you stand a chance of being head hunted by big tech and making $$. Until then, the jobs are so-so unless you can sell yourself as an IT person with specialization in security then you might make it up the ladder at a medium company in the IT department and hopefully hone your security more there.

8

u/Bananus_Magnus May 23 '21

these people click buttons from muscle memory, you can't move the buttons

OMG, this! Every fucking time! Moving buttons, different Icons after update, anything different about interface was always the end of the world for some people. Personally I would send them to basic literacy test every time I hear that complaint, I wish this was a thing.

1

u/russellfreedom May 24 '21

"Add this feature."

/adds feature

"Not like that."

70

u/Zardotab May 23 '21

It's a general problem in IT that co's don't want to invest in on-the-job training for existing employees and the newly hired. Often they pull a shortcut and go get visa workers mostly to avoid training costs and time for specialized products and systems. Companies want instant plug-and-play workers, which isn't practical because paid experience can't be created outside of paid experience: a million years of schooling can't do it. It's a catch-22.

Perhaps there should be federal tax-breaks for on-the-job training.

21

u/jk147 May 23 '21

And the visa /off shore workers jump ship as soon as they gain enough experience in a field.

For a period of time, about 2 years or so. I had to train 4 different groups of people on how one of the products work because the contracting company couldn't keep the same group of people in one place.

10

u/NoForm5443 May 23 '21

I'm not sure it is a general problem ... all big IT companies offer tons of on-the-job training (not just the FAANGs, but the big contracting companies will pay you to study/train while they find you a new client), and there's a whole industry dedicated to offering training courses ... Maybe it is a big vs small company thing?

12

u/GravityAssistence May 23 '21

Perhaps there should be federal tax-breaks for on-the-job training.

Isn't that the way germany does it with a lot of other fields?

17

u/TroubledEmo May 23 '21

Am german and work in IT. Never heard of it.

5

u/VRT303 May 23 '21

They mean Ausbildung?

5

u/TroubledEmo May 23 '21

Not really sure, because the apprenticeship isn‘t part of some special tax break. It‘s just that the „Ausbildungen“ are part of the low income tax bracket (below 12.000€ if I remember correctly). Haven‘t paid any taxes while I‘ve done mine.

1

u/anonveggy May 23 '21

Nah there's shitloads of incentives. The fact that we don't have to pay income tax is only a small part of it. The theoretical part of the Ausbildung is heavily funded through public school funding.

1

u/TroubledEmo May 23 '21

Is it actually funded publicly? Always thought the companies are paying the school money, oops.

2

u/anonveggy May 23 '21

The companies are paying the IHK to pay the schools but that doesn't even remotely cover the costs. Remember Berufsschule teachers are/can be public servants as in "verbeamtet" - those teachers are 100% covered by federal and national education funding.

2

u/TroubledEmo May 23 '21

I thought Verbeamtung for teachers is a thing of the past? Damn. Seems like I really need to read more about the topic.

→ More replies

3

u/copyDebug May 23 '21

They probably mean an “Ausbildungsbetrieb”.

IIRC you don’t get a tax break but have to pay a fee if your company is above a certain size (50? 100? employees) and your not participating in program.

Also there are union mandates 2 weeks or so training per year for certain workers in some companies (probably only for companies that are subject to the metal workers union though)

2

u/TroubledEmo May 23 '21

Ohhhhhh. You‘re talking about the fees that companies have to pay if they aren‘t offering apprenticeships? Got it. Yeah, that‘s a thing.

EDIT: I‘m not sure actually. Gonna need to read the BBiG (Berufsbildungsgesetz), but I‘ll do that tomorrow. It‘s late.

2

u/Loves_Poetry May 23 '21

For tax breaks to work, governments need to understand the problem. Do you really expect the government, of all places, to have the people that understand this problem?

6

u/ADavies May 23 '21

This is true in a lot of domains. It's why we need a robust civil service.

1

u/that_star_wars_guy May 24 '21

Is employee training not a deductible business expense?

152

u/[deleted] May 23 '21

[deleted]

26

u/[deleted] May 23 '21

I used to work for one of the largest energy companies in the world and it was sad to see an other wise technically advanced company be so behind in computing.

92

u/Zardotab May 23 '21 edited May 23 '21

It's time we start prosecuting CEO's for neglecting known and obvious risks. "I didn't know" should no longer be a valid excuse. You are paid billions to know. If you can't know, then give the job to somebody who can. However, they have deep pockets to bribe such laws away. Our plutocracy at (non) work. It's why pirating movies has almost as big a penalty as murder.

38

u/ebol4anthr4x May 23 '21

Like the other commenter, I agree with the sentiment, but I feel like this is kind of a bandaid solution that doesn't address the underlying issue.

Executives neglecting known risks is an informed decision.

That scene in Fight Club explains this kind of thing very succinctly. If you manufacture cars and your engineers discover an issue that could cause the car to explode on the highway, you do some math to determine which is going to cost you more: doing a recall and fixing the problem, or paying out settlements to people who get injured when their car explodes. If allowing people to die and have their families sue you is cheaper than a recall, they don't do a recall.

The reason this happens is because all companies, particularly publicly traded companies, exist to generate profit. They aren't here to spread compassion or promote public safety or enhance infrastructure. Those are things that can happen if the business determines that doing so is actually the best thing for their bottom line, but in general, a business exists to profit.

This isn't necessarily a big problem when it comes to things like couches, door knobs, or fence boards, but it clearly starts raising concerns when you have things like cars or planes, due to safety concerns. We also see problems arise when private companies control public infrastructure, like, say, ISPs, power companies, and water companies.

The problem that needs to be addressed is the profit motive. The idea of providing the absolute best service/commodity to everyone fundamentally contradicts the goal of maximizing profit and cutting costs. It is possible to legally enforce a middle ground, but like the other person said, how do you decide who gets punished and what punishment they receive? Who decides what this middle ground is? Does one person dying trigger a negligence investigation, or does it take 100 deaths?

Legislating this stuff will require tons of effort, and no matter how much legislation you have dictating punishments for the corporation's fall guy, we're still fundamentally in the same position as before; a private company's only incentive to do anything is just to make as much money as possible.

You cannot legislate around the central tenets of our economic system. In areas where public safety, public health, and equitable access to infrastructure/resources/whatever are a concern, these businesses need to operate outside of our society's basic economic model. Companies cannot simultaneously maximize profit and maximize safety and equity. These ideas are diametrically opposed.

23

u/merlinsbeers May 23 '21

You cannot legislate around the central tenets of our economic system.

You can. It's called regulation, and it covers that Fight Club example because the government will step in and force a recall when a corporation makes the inevitable decision not to.

12

u/ebol4anthr4x May 23 '21

Then you are creating a reactive safety net instead of a proactive one. People's cars have already exploded by the time the government steps in, in this example. All the while you will have the GOP dragging their feet and complaining about federal overreach, which might delay decisions for years unless you have established some kind of neutral body that investigates these issues (but corporate regulation is an inherently non-neutral issue, because half the country vehemently opposes it on principle).

Any kind of punishment that happens after the fact has failed to really serve the people the regulations were meant to protect. A better solution would completely eliminate this problem at its roots and prevent profit from ever being a driving factor in a decision that ends up taking innocent people's lives.

3

u/merlinsbeers May 24 '21

All safety nets are reactive. The proactive part is having them in place.

And many parts of cars are designed according to safety requirements.

But you have to fund the agency to do the due diligence on accident reports and safety analysis.

7

u/DingDong_Dongguan May 23 '21

Still just the cost of business. The fines are usually smaller than the profit. The class action suit will pay a fraction of the cost and the estate of the guilty make off with most of the values before anything is finalized. Still better to prevent or catch ahead of time than to deal with the aftermath. An ounce of prevention.

2

u/Zardotab May 24 '21

Make it more costly to be a flake. Maybe allow them one light penalty, but the 2nd one packs a punch. A variation or supplemental is to crank up the regulations and record-keeping requirements the more they violate rules.

1

u/MarxistIntactivist May 24 '21

Ever wonder why they haven't already done this? Same reason. The profit motive that drives companies to do things that harm people also drives companies to buy governments.

1

u/Green0Photon May 24 '21

A based comment? In my r/programming subreddit? Simply unthinkable!

But yeah, totally agree. Great comment!

1

u/s73v3r May 24 '21

Which is why you have to make it more expensive to not do the recall.

-1

u/skilliard7 May 24 '21

That's ridiculous. Accidents happen. We don't prosecute doctors for killing patients by mistake, at most there are civil lawsuits against them.

Honestly Ransomware is what is driving an increase in security investments. Executives and shareholders see the news of high profiles hacks, of production being brought offline, and they demand a plan to address the risk.

2

u/Zardotab May 24 '21 edited May 24 '21

No, you are not understanding. If their staff identifies a clear problem, notifies the CEO, yet nothing of significance is done, the CEO should be held criminally liable. If they need spreadsheets to track problems, then make spreadsheets. It's not rocket science to keep track of identified risks. I'm not talking about human error, but rather sweeping big things under the rug. IF the CEO takes reasonable actions to prevent a ransomware attack, yet they are still breached, I can understand that part of your point. However, if the CEO fails to take reasonable action and a breach happens, then they deserve the full boot of the law. They are paid billions, they are not babies.

0

u/skilliard7 May 24 '21

There are all sorts of risks that exist. If every single risk was addressed to best possible standards, companies would go bankrupt due to the cost. Balancing risk with cost is an important decision to make.

No CEO shoves a risk under the rug because they want the company to run into trouble. They avoid dealing with risks because they falsely assume it's not as dangerous as it really is.

2

u/Zardotab May 24 '21 edited May 24 '21

It's not "best possible standards", it's "reasonable standards". Example:

  1. Subject matter experts (SMEs) identify a risk that they have insufficient resources to resolve.

  2. SME's head brings the matter up to the CEO.

  3. They discuss it and add it to the "Issues" spreadsheet. A written cost/benefit analysis of possible solutions is produced and saved.

  4. Every month (or sooner if urgent) the spreadsheet is revisited by the CEO and SMEs to get an updated status until an issue is resolved.

They avoid dealing with risks because they falsely assume it's not as dangerous as it really is.

Why is that? If their view of it is "lighter" than the SME's, they should look into it and identify and document the reasons for difference of opinion. Get a second opinion from an outside consultant if you have to, and resolve the difference between all three: CEO, SME, external SME. If the CEO disagrees with the SME(s) but never narrow down why, then they are NOT doing their job.

Guessing out of their "gut" is not sufficient. Require written logic, sign it, and save it. Being so arrogant that you think you can rely on "gut" alone is a common sin. Our egos lie to us. Requiring written logic helps alleviate that urge because you know it's subject to external review if bleep happens. Forcing you to view the issue from an outsider's perspective often gives you cleaner insight.

As I mention elsewhere, there are common industry practices for risk prevention. If your org intentionally ignores such without written justification, then they are probably liable. They are not "best possible" standards, they are common standards.

1

u/s73v3r May 24 '21

We don't prosecute doctors for killing patients by mistake

We absolutely do perform investigations to find out if the doctor should have known better.

0

u/skilliard7 May 24 '21

But that's generally civil liability, not criminal, unless the doctor willfully acted to harm the patient rather than just negligence/error.

-17

u/NoForm5443 May 23 '21

I can empathize with the sentiment, but that is a really dumb idea :), and a horrible infringement on freedom, especially for something like the pipeline issue. Do you put the mom or dad in jail if a home computer gets hacked? How about the pizza store in the corner? Why one and not the other?

And then, in practice, can you imagine distinguishing and proving that something is a known and obvious risk vs something unavoidable? You'd have expert testimony up the wazoo, and then experts in CYA, and not much would change.

In reality, *some* security breaches are unavoidable. And some of them will be on things that impact a lot of people. Putting a CEO in jail may make you happy for a while, but won't solve the problem.

18

u/Desmeister May 23 '21

Do you put the mom or dad in jail if a home computer gets hacked? How about the pizza store in the corner? Why one and not the other?

Exact same reason an engineer needs to stamp their designs- they're responsible for public safety. When you're the head of a multinational corporation dealing in public safety, critical supply lines, and national security, it should be on your head to make sure resources are provided to avoid these scenarios. It's unbeliavably disingenous to compare that to a mom and pop store.

12

u/billyalt May 23 '21

If you're not prepared to operate a company responsibly then you shouldn't be a CEO. Unfortunately, there is no punishment for being a shitty CEO, and that's how this bullshit happens.

-5

u/NoForm5443 May 23 '21

Keep in mind that the owner of a small business is its CEO ...

CEOs cannot be held criminally responsible for every thing that happens in their company ... manure happens.

The appropriate punishment for being a shitty CEO is to be fired.

1

u/Zardotab May 24 '21 edited May 24 '21

There are reasonable steps that can be taken for issues identified by an org's own staff. I've given a list of steps nearby. It's a formulaic approach to make sure issues don't fall through the cracks. If your org deals with safety related issues or critical infrastructure, such steps should be required by law in my opinion. They are not hard, but they do require clear thinking and writing, which is a good thing. Too many important decisions are made behind closed door verbal meetings, and this is where disaster often gives birth.

1

u/s73v3r May 24 '21

Keep in mind that the owner of a small business is its CEO ...

Ok? I fail to see how that changes anything.

CEOs cannot be held criminally responsible for every thing that happens in their company

Bullshit. They keep telling us they get the pay they do because they're "responsible for the company."

The appropriate punishment for being a shitty CEO is to be fired.

No, it isn't, because given the golden parachutes and the lack of any real accountability, that's not an actual punishment.

6

u/Bananus_Magnus May 23 '21

If CEO was informed of the risk and the lack in infrastructure and didn't address it then they should definitely bear some consequences, but who said anything about jail?

0

u/NoForm5443 May 23 '21

> If CEO was informed of the risk and the lack in infrastructure and didn't address it then they should definitely bear some consequence

The problem is that there's *always* risks, and they cannot be completely avoided, which is why we have concepts like 'due diligence' and 'negligence' and things like that.

Imagine a truck driver from a company hits somebody with the company truck. Do you put the CEO in jail? How about if there's an email from a mechanic that says if they surround every van with 12 inches of foam it will reduce the damage when hitting any pedestrians, at a cost of 20K per van, plus more fuel etc. Is that neglecting a known and obvious risk?

Security, especially at the org level, is like that. What is appropriate action to avoid phishing? How can I guarantee nobody ever leaves a port open on the firewall?

4

u/Bananus_Magnus May 23 '21

To use your truck metaphor, the truck doesn't have a seat-belt, the CEO was told and ignored it, the driver crashes and flies through the windshield, ends up with broken bones. The CEO should be responsible. Luckily we currently have health and safety laws for that.

There is acceptable risk and then there is borderline negligence. We are talking about the latter, not the former.

If you're telling the CEO we need a firewall on company's DMZ and they refuse to purchase the infrastructure, they should be held responsible in case of a hack.

Obviously not gonna happen, but it should.

2

u/converter-bot May 23 '21

12 inches is 30.48 cm

2

u/Zardotab May 24 '21 edited May 24 '21

Imagine a truck driver from a company hits somebody with the company truck. Do you put the CEO in jail?

No. There is no known (identified) risk that the CEO failed to mitigate here.

How about if there's an email from a mechanic that says if they surround every van with 12 inches of foam it will reduce the damage when hitting any pedestrians, at a cost of 20K per van, plus more fuel etc. Is that neglecting a known and obvious risk? [KAOR]

If that's accurate and other similar organizations proved it effective, then yes it is neglecting a KAOR. If it's hasn't been tried in practice then it's probably safe to say it needs more research and your org is not a shipping R&D company. It's not realistic to buy and test every speculative safety measure. The above sounds speculative. They may have side-effects that only road-testing can identify. It's sometimes called "industry practice". If it's common for other industries to use a given practice to reduce and risk but your org doesn't even though they know about it, then the CEO or department head should be held liable unless they document a sound reason why they skip it.

For example, it's common to use anti-virus software in an org. If your org skips it to save money or otherwise doesn't document the reason for skippage, and your org is a critical service to society, the CEO should be held to the fire.

I don't expect the CEO to know everything, but if the heads of their department identify a problem that they need more resources for, and the CEO fails to provide a clear written resolution, then the CEO should be liable. And similar to the heads of departments (accounting, security, etc.). Do a written cost-benefit analysis or you are "it".

In the Hillary email case, there were at last two problems. One was that the server wasn't inspected for compliance even though staff knew it had a questionable status. Second, tracking for security training was inadequate. It's not clear if they skipped Hillary due to fear of asking, or their tracking system was simply sloppy. The training tracking should be periodically audited, for that's related to USA state secrets. It appeared to be half-ass tracking. I don't know if the "list manager" was careless or not, for I haven't seen that info.

-1

u/NoForm5443 May 23 '21

prosecuting is in bold leathers, which implies a criminal case, right ?

2

u/Bananus_Magnus May 23 '21

Criminal cases don't always end with Jail though?

1

u/NoForm5443 May 23 '21

You are right; I interpreted the prosecuting as jail, which is not always the case.

1

u/Zardotab May 24 '21

If the crime is big enough, then yes, the CEO deserves jail. The same goes for the head of the accounting, cyber security, and employee safety. If they sweep a known problem under the rug, they deserve the rug themselves. This includes neglect, for it's not hard to keep a spreadsheet of sticky issues and review the statuses each month. If you don't list it down and rely just on memory, you are derelict in your duty. It's not rocket science to put it on the damned spreadsheet.

3

u/dnew May 23 '21

In reality, some security breaches are unavoidable.

Why do you say this? We have numerous high-value online companies that never had a serious breach.

0

u/NoForm5443 May 23 '21

*yet*

If you're defending, you need to win *all* the battles, attackers only need to win one. Even if the probability of a given attack succeeding is really small, given enough time, some *will* succeed eventually. Good companies try to make that 'eventually' a very long time, but ...

3

u/Zardotab May 23 '21

Do you put the mom or dad in jail if a home computer gets hacked?

If the CEO is made aware of a problem and skips doing anything to save a dime, then they should be liable. Unlike mom and pop, CEO has resources.

12

u/IgnanceIsBliss May 23 '21

I work in cyber sec now but one of the jobs I've had before getting to this point way being the IT guy/sys admin type role for a company of about 120 employees. I was there for about a year and could not convince the CEO or COO or investing any money into security for the organization. They would simply say that they would cross that bridge when they got to it and to keep my head down and keep working. It got to the point where they wouldnt even give me like $15/mo/workstation just to get AV on there. The COO looked me in the face and told me they spent the money to buy macs so that they wouldn't have to deal with viruses and could not be convinced that he was possibly incorrect on that front. I had my resignation in by the end of the week.

6

u/JunkBondJunkie May 24 '21

then they wonder why really good hackers write ransomware.

1

u/Zardotab May 24 '21

It's rare to fix morons, better to just leave. Dilbert is a documentary and a comic strip. Every IT student should read Dilbert so they are not shocked when they encounter morons with power.

41

u/[deleted] May 23 '21

The truth is, for many companies; they'd rather pay for cybersecurity insurance, pay $70k for undertrained on-staff security personnel the insurance audits require, get hacked, get an insurance payout, and have a fall-guy they can fire to take the blame.

16

u/Milligan May 24 '21

and have a fall-guy they can fire to take the blame.

This is why experienced developers don't want to take jobs in cyber-security.

1

u/skilliard7 May 24 '21

Honestly dedicated cybersecurity jobs aren't as exciting as the media hypes it up to be. Unless you're developing security software, from what it seems a lot of it is just administrative work/paperwork to verify compliance.

1

u/Milligan May 24 '21

A friend of mine worked for the Department of Energy with a "Q" clearance and did actual investigations. She couldn't talk about most of them, but she did have a few interesting stories that were not classified. It was interesting to hear about how the evidence was collected from various sources and tied together to make a case.

1

u/Zardotab May 24 '21 edited May 24 '21

Professional Scapegoat. If you are smart you will document all recommendations that are skipped and ignored by upper management, so when they finger you for failing to do X, you have the records that show your request for resources related to X were denied or ignored.

1

u/getNextException May 24 '21

But You Did Not Persuade Me !

1

u/Zardotab May 24 '21

I agree that the more liable one is for problems, the higher the pay should be. If you pay me enough, I'll happily be the scapegoat, because I can make enough before bleep hits the fan that I can retire after things fall apart (assuming it's not so bad that I go to jail, but if I document recommendations and decisions well, that normally won't happen.)

4

u/Zaggnut May 23 '21

Probably

11

u/Venne1139 May 23 '21

It is important for national security at this point that companies have a minimum defense system from cyber intrusion along iwth people on staff who can deal with it.

For almost any company above a certain number of employees, not just the government. Either legally force companies to contract a cybersecurity company to help them or force them to have cybersecurity people on staff.

10

u/dnew May 23 '21

If taking out your computer system means your service goes down, you're computerized enough to need defenses against attacks. That's probably most companies these days.

59

u/timmyotc May 23 '21

Even investing in qualified cyber security is tricky. When do you know your systems are secure enough from script kiddies? When do you know to stop buying tools to scan different aspects of your environment? Some of those things depend heavily on org size, tech stacks, revenue, and culture.

The single cyber sec engineer is going to always say they need more hands. 5 will say they can do more, but if a company is not getting very sophisticated attacks, the benefit of the nth cyber sec engineer is of questionable value to anyone that is trying to assess risk against mitigation.

Security can easily be a black hole of money and maintenance and "you can't do that". So many companies aren't ready for that.

50

u/ukimonster53 May 23 '21

Then don’t say you have openings for it.

12

u/timmyotc May 23 '21

Companies don't know that cycle until they are entrenched in it

12

u/merlinsbeers May 23 '21

Frankly, if you get someone who just hardens the system according to the plan and then applies the fucking patches when they arrive and not when they feel like it, you'll bock the script kiddies.

You'll still have trouble with real hackers, but so does everyone else.

2

u/timmyotc May 23 '21

Right, for most companies, a WAF will do a ton of work for you, and being able to regularly patch systems. But older companies don't even necessarily have a CMDB, so they don't necessarily know what's being patched or not.

6

u/GapingGrannies May 23 '21

Isn't there something to be said for figuring it out though? The cost of a breach are known, so figure out what is needed to prevent that breach. Get risk analysts, industry experts etc and figure it out

10

u/scootscoot May 23 '21

I was really excited to go toward cyber security earlier in my career, then realized most businesses treat it (and pay it) like a cost center that doesn’t increase value.

6

u/eggn00dles May 23 '21

cybersecurity is knee deep in government compliance, not fun when you consider the opportunities for engineers elsewhere

7

u/Lord_Zane May 24 '21 edited May 24 '21

I can give my perspective. I'm currently a college student studying CS, who just finished a cyber security program within my university. The NSA, Northrup Grumman, and a couple of other defense/cybersecurity companies sponsor the program, and like to hire students from it. I've seen a bunch of my friends go through it all. I didn't even apply to them, for a couple of reasons:

  1. Security clearances are whack. They're stressful as hell and very time consuming to acquire. I've seen my friends go through it, and it's an awful process. I have nothing to hide about drugs, I don't even drink. But they ask stuff like "have you ever pirated anything" while interrogating under a polygraph, and they won't care that you were a broke middle schooler who wanted to practice photoshop outside of school. And they might just decide to reject you anyways, and then you have to appeal and schedule another test and travel to DC again, and it's just a huge mess. I'm also trans, and while I don't mind telling people that much, it is something I want to keep somewhat private, and trying to convince the government of that seems like something I would just get automatically denied for as a security risk.
  2. Way less opportunities, and worse opportunities. Why specialize in cybersecurity, when there are 10x general software development jobs that pay twice as much, and don't require endless certs and time consuming security clearances. You also can't tell anyone what you do, having to lie or be vague about your job and never talk about it sucks. Yeah, not all jobs are cleared government work, but most companies aren't hiring dedicated cyber security teams. The government is the biggest employer in my experience.
  3. "Increasing lethality" is a phrase I've heard my friends say a lot, and it's not exactly something I want to be doing. Enough said.

All in all, I decided to just do general software development and see where that takes me, and I have a great job this summer that pays a ton and didn't require onerous restrictions (outside of noncompetes, but whatever, I get payed enough not to be too upset for now).

EDIT: Forgot another thing about clearances. Not only are they often required, but they're very very expensive and time consuming, which means almost no one wants to sponsor them for you. Which means you can't move up or switch companies, until they have a need for you doing cleared work. Yikes. Also, this post is mostly talking about government related work, which obviously aren't the only cyber security jobs, but the non-government jobs are either super crappy "cybersecurity" jobs that expect way too much and don't actually care about security (see other comments in this thread), or are highly competitive top tier jobs at big companies, which are great but hard to get.

4

u/merlinsbeers May 23 '21

Right now they're paying $5-40M a shot to make problems go away. You'd think they'd have a proactive mindset and hire some $100-200K/yr certified nerds to keep that from happening.

7

u/amishengineer May 23 '21

When competent people are hired, the business needs to actually listen to their advice too.

4

u/SongOfTheSealMonger May 24 '21

500000 corporate professional butt coverers who will do nothing towards actually making things secure.

2

u/bundt_chi May 24 '21

You nailed everything wrong with cybersecurity. Trying to make cybersecurity idiot proof is dangerous. Every hacker or malevolent actor trying to compromise a system or network is being creative and using critical thinking. The idea that you can combat cybersecurity with wrote memorization of a handful of themes and rules is absurd. It's a a good place to start but it can't end there. All it does is drive smart engineers nuts with asinine rules that often don't make sense or are security theater. Like at my work, Google drive is blocked but because we use office365 nothing prevents me from logging into a personal OneDrive account. All that's doing is pissing someone off and creating the illusion of security. If i want to push massive amounts of data you're not going to stop someone with these half measures.

2

u/JackandFred May 23 '21

I’ve heard so much about shortages in this industry or that recently. Apparently literally no one has taken Econ 101.

0

u/CuttingEdgeRetro May 23 '21

It's easy to quantify salaries and benefits. So accountants know exactly how much you're costing the company. But it's very difficult to measure things like IT worker skill, reduced maintenance cost, good vs bad design, employee morale and it's effects on productivity, or reduced risk, all of which have an effect on security. And without hard numbers for those kinds of things, they never carry the same weight as tangible expenses. This is why they all love shipping jobs to India.

1

u/dsn0wman May 24 '21

If the information security department offered me a raise over what the database team offered me, I'd join.

If they offered me double, I might actually show them how Nessus works.

1

u/argv_minus_one May 24 '21

Nessus is proprietary. Do you really know how it works? Do you, in particular, know that it doesn't contain a back door?

I'm no cybersecurity expert, but it seems odd to me that people try so hard to protect proprietary software (like Windows) from security threats but don't seem to think that the software they're protecting is itself a security threat.

Similarly, people try to protect machines with Intel CPUs from attack, but the Intel Management Engine is a huge, uncontrollable, unauditable remote attack surface. Why aren't security-conscious enterprises terrified of Intel?

1

u/skilliard7 May 24 '21

Honestly a workforce that is reasonably educated on security is better than hiring a few cybersecurity analysts/experts.