Careers & People

2/24/2016
10:30 AM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

Public Vs. Private: Is A Prestigious Infosec College Degree Worth It?

Today's graduates coming into the information security industry from private universities aren't ready for the workforce.

I’m a big believer in taking security lessons from the analog world, including advice from someone many might consider the most unlikely of people – American rapper Eminem.  Eminem can teach us a lot about information security, especially with respect to the security leaders of tomorrow.

Consider “Lose Yourself,” Eminen’s hit song about taking advantage of the moment:

 Look, if you had, one shot, or one opportunity

To seize everything you ever wanted. In one moment

Would you capture it, or just let it slip?

What does that have to do with educating information security professionals? During the course of my travels, I regularly receive two pieces of feedback related to staffing and talent: It is difficult to find people with the right skills to fill open positions; and, there is more work to do than the number of positions we have to fill.

People, including me, often address the second point through solutions like automation, orchestration, improved workflow and operational efficiency.  I’ve written a fair bit on a number of these topics in the past, as have several others in the field. But it’s far more difficult to solve the cybersecurity skills gap problem.

Sure, I hear a lot of talk about the lack of skilled security professionals. But as for how to address this challenge?  That is something that is almost never discussed.  Perhaps we feel helpless or merely accept it as an unchangeable fact. One way to approach this issue is to “grow” our own.  By that I mean looking for analytical people, providing them the opportunity to gain experience on the job, and turning them into security professionals over a period of time. 

A better way

It seems obvious to me that if we are looking for the next generation of security professionals and security leaders, we should be looking at universities. After all, universities are where young people go to learn the skills that will carry them through their adult professional lives.  Unfortunately, many universities disagree with me on that. 

Let me elaborate by sharing a story. From time to time, university students reach out to me to ask a few questions or discuss a few information security-related issues. I’m always happy to speak with them, as I see it as a great way to try and encourage young people to pursue a career in our field.

Recently, a student at a prestigious private university approached me with this type of request.  The student was looking to perform research for his thesis on current challenges and future directions in information security. The student seemed to be intelligent, well-mannered, and an astute listener. Unfortunately, it was evident from our discussion that this prestigious private university had not prepared the student with any practical exposure to information security involving real-world scenarios and operational problems. 

Something as simple as spending a few hours or days with information security professionals on the job could bring students such relevant experiences.  And what about actively integrating such experiences into the academic curriculum to give students a more focused base from which to invest their creative energies.

Public v. private

Contrast this to public universities that I’ve had the privilege to work with as an advisor and/or speaker, such as University of Colorado Boulder and the University of Maryland. Visits to those universities and discussions with students show that the education they are receiving around information security is far more practical and applicable to the world in which we live.  It’s no surprise that this is the case. Industry experts are consulted regarding the curriculum, experienced practitioners are often invited to speak or meet with students, and classroom and lab environments contain real-world assignments and equipment.

Private universities will tell you that they need to stay true to their research focus, and that they need to be able to recruit faculty fitting to such a prestigious institution. I certainly get an earful of messaging along those lines from my alma mater. That may very well be the case, but allow me to ask a simple question. If a university is going to take $250,000 from hard working families, shouldn’t it produce information security graduates qualified for the positions of today and the leadership roles of tomorrow?  I think most of us in the profession would agree that we need universities to help us out a bit more in that endeavor.  The graduates we’re getting today, particularly from private universities, aren’t ready for the workforce.

Let’s take another look at Eminem’s lyrics in this context. Universities have one shot. One opportunity. One moment. The experience a young person has at university and the skills he or she learns will shape his or her entire adult professional life. If I were a university looking to educate the information security leaders of tomorrow, I would ask myself one question: Will we capture the opportunity, or just let it slip?

More on this topic:

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Josh (Twitter: @ananalytical) is an experienced information security leader with broad experience building and running Security Operations Centers (SOCs). Josh is currently co-founder and chief product officer at IDRRA and also serves as security advisor to ExtraHop. Prior to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
dfunk1
50%
50%
dfunk1,
User Rank: Strategist
2/25/2016 | 9:25:53 AM
Public Vs. Private
I think that, perhaps counter-intuitively, that there is a lot more competition for the dollars with the Public schools than the Private.  With the Private schools, the students go for the name, and mom and dad pay.  With the Public schools, a significant slice of the student population is paying their own way (either their own money, or hard-earned benifits from work), are doing the school after work, and they are VERY interested in results, and they have a better idea of how the work world works than the average High School senior.  Those students have very high expectations, and will leave in a second if they are not being met.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/24/2016 | 11:04:11 PM
public vs private
I'm sure, as with most cases, it depends on the specific public or private universities, but the point is well taken; a quality information-security education (or other education, for that matter) can easily be had for pennies on the dollar from a public university.

Or for free from a private university via edX, for that matter (as long as you don't care about the degree).
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
Why Enterprises Can't Ignore Third-Party IoT-Related Risks
Charlie Miller, Senior Vice President, The Santa Fe Group,  5/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
Surviving the IT Security Skills Shortage
Surviving the IT Security Skills Shortage
Cybersecurity professionals are in high demand -- and short supply. Find out what Dark Reading discovered during their 2017 Security Staffing Survey and get some strategies for getting through the drought. Download the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11232
PUBLISHED: 2018-05-18
The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.
CVE-2017-15855
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, the camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in u...
CVE-2018-3567
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing the HTT_T2H_MSG_TYPE_PEER_MAP or HTT_T2H_MSG_TYPE_PEER_UNMAP messages.
CVE-2018-3568
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, in __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur.
CVE-2018-5827
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing an extscan hotlist event.