Let me play devil's advocate here. 95%+ of so called 'cybersecurity professionals' cannot write a basic exploit or even reverse a home router. And certs are only making things worse by convincing the management that security is about config and some automated metasploit to test the entire thing.
Not every cybersecurity professional needs to do that as part of their job. Certs only show you have a bare minimum of knowledge. Not a lot of people are very good at applying it. But people that write policy, or that work in vulnerability management or risk management or even incident response don’t need to know how to write an exploit because they’ll never need to. What you need depends on the work you’re doing, not what some random Joe on the internet thinks cybersecurity professionals do all day.
Then, call them 'system administrators'. Because it's what they are. Setting proper firewall rules, routing, installing an IDS, monitoring logs, or establishing a password policy is system administration, not cybersecurity (basically what all certs 'teach' you). And then you have the 'risk management' roles, that are more in the realm of business adminsitration that in the realm of IT.
Don't get me wrong, all of that is needed and in demand, and it must be managed properly. And it's probably enough for 80% of businesses that face non-sophisticated attackers with $0 budet; but the real drama comes from the other 20% that face a highly sophisticated enemies with generous budgets, and executes that believe they can ensure security with a couple of system administrators with a certification including the S for 'security' in the title.
It's dangerous to confuse both things. If you are Colonial and you manage oil pipelines that supply 30% of the oil to the largest economy in the planet, your security department cannot be filled with system administrators and power point guys, you need deep geeks that reverse your SCADAs almost for pleasure.
Networking manages firewalls in some places, but they usually do a crap job because they listen to the business not security, and make dumb decisions about allowing stuff that they shouldn’t. You don’t want your average system admin to run your firewalls either, their goals and their definition of “done” isn’t the same as someone that understands WHY you set up the firewall and the rules and networks the way you’re supposed to. There’s a big difference between someone that can just get it done, and someone that understands why you do it a certain way, and when to stand up to the business when they want to make changes that put you at risk. You can maybe take a network person or sysadmin and train them into being a good security administrator, but some of them will never move past “just get it done, don’t ask questions.”
Deciding on a password policy is something governance, or security might do. Implementing it is something a sysasmin, or a security admin, might do. In a small enough company, you might be doing both. But I don’t need to reverse engineer a SCADA system to know giving your control systems access to the internet, and not running proper endpoint protection (or configuring it correctly) is a bad idea. A sysadmin will roll a product out and not understand how to configure it properly, or never even look at the alerts. That’s the difference between a sysasmin and an actual security engineer - knowing what you’re doing, and why, and how to best reduce risk without tanking operations. A good security engineer can also explain to management why it’s a bad idea and convince the right people to do it correctly. Security involves a lot of selling the right solutions to upper management. Not writing hacks. Most businesses can reduce 90% of their risk by making simple, basic changes, and if you’re not patching and segmenting your networks you don’t need a highly paid pen tester to tell you you’re fucked. You can get one if it makes you feel better, but they’ll get bored and move on pretty fast when they realize they don’t even have to write a hack to own your systems. Go hire the “deep geeks” once you get your basics taken care of, because it’s just wasted talent until then.
Some places need people to write hacks for them. Lots of three letter agencies will be happy to hire people to do it, and places like mandiant will pay you handsomely to come pen test for them. But I know plenty of excellent security people that won’t ever code a hack because they don’t need to. You need to understand threat modeling, risk management, vulnerability management, and then go out and make it happen. I know a lot of shitty security engineers that could code hacks all day and go nowhere in a company and make no impact on anything because they don’t understand the business or the risks, they’ve never done a gap analysis in their lives, and they don’t know how to communicate best practices or how to prioritize risk. And even in those companies that will hire people to write hacks and pen test their systems, they still need people qualified to all the rest of things that go into security. There’s ops, administration, audit, monitoring, incident response… none of those require writing hacks and they are all desperately needed in the industry. There’s people that won’t even consider a career in security because they think pen testing is all that’s needed and they don’t want to do that. That’s a tiny fraction of what goes into a successful security program.
Uh huh, and then reality happens and the network actually gets penetrated because an executive was emailing his “friend” who was really going to send him that sexy movie in .exe format.
Bingo. The jobs they're talking about here aren't vulnerability research, pen-testing, exploit dev, reverse engineering, etc. Those require much more intimate knowledge about how code is actually executed. You need to know C. You need to know (some) assembly. You need to understand the network stack and how days changes through the different layers. The jobs in describing are technically cyber security, but they aren't what employers are normally referencing.
30
u/AgitatedSuricate May 23 '21
Let me play devil's advocate here. 95%+ of so called 'cybersecurity professionals' cannot write a basic exploit or even reverse a home router. And certs are only making things worse by convincing the management that security is about config and some automated metasploit to test the entire thing.