Perimeter
10/1/2013
05:06 PM
Rich Mogull
Rich Mogull
Commentary
50%
50%

Security Skills For 2023

Align your career with these top security trends

About a year ago, I wrote a post at Securosis describing the big changes I see coming in the practice of security during the next 10 years. Though we never seem to have a shortage of town criers singing out our industry's doom, I actually think we are at the start of some insanely positive changes. I don't mean nebulous concepts like "influencing the business," "baking in security early," or "getting a seat at the table." I mean honest-to-goodness security technologies and techniques that will not only materially change how we approach security, but are pretty darn interesting and compelling.

These days many security professionals are relegated to roles that often are only tenuously related to directly improving an organization's security. Now, I'm drawing some big generalizations here, but if this doesn't describe your job, the odds are you know someone it does describe. You don't need security experience for managing directory servers, pushing user permissions, configuring firewalls, and other similar tasks. We have already seen those jobs, even some level of packet analysis, handed off to operations teams.

On the other hand, security isn't merely going to transition into a policy-building role. Get too far away from technology and the policies don't reflect reality, and security gets the basement office. The one next to the boiler.

I'm running on the assumption that if you are reading this, you plan on staying in security for 10 years, you enjoy the profession, and you don't want to turn your brain off. Plenty of those jobs will still be out there, but they will keep decreasing over time. No, for those of you that care, the future is bright.

First, a few technology assumptions: These are trends (detailed in the post linked above) I believe will change the practice of security. The first is the growth of big data, and the ability of security teams to collect and analyze large stores of data in real time. The second is the increasing use of cloud computing and the availability of application programming interfaces to manage everything from software-defined networks to point security products. The third is a greater enablement of incident response, including use of tools like active defense and hypersegregation to reduce attackers' abilities to operate freely in our environments once they get in the front door.

That is probably a too-trite overview of where we are headed, but each trend is happening today, for real, as we see more and more of the boring stuff being handed over to ops -- who is better at it anyway. So what does this mean for those of us who don't want to become clueless policy wonks?

I suspect three sets of skills will draw the big bucks in security: security (big data) analysts, incident responders, and security developers.

Despite the pretty vendor dashboards, winnowing out useful analysis from a big data repository is a significant challenge. It requires a sound understanding of security, the ability to program the analytics, and the common sense to figure out what matters, what doesn't, and how to translate that for the nonstatisticians (mere mortals) of the world. I won't be surprised if this becomes one of the most sought-after skills sets, especially among larger organizations and security service providers. If you did well in stats, then this is where the big money will be.

Incident response is already a skills set in demand. The busy shops struggle to find qualified staff and keep them. Even midsize and smaller organizations will need either in-house or outsourced incident response now that we have all realized we can't completely keep out all of the bad guys all of the time. The fewer day-to-day operational adjustments we need to manage, the more time we can spend detecting and responding to incidents.

The last skills set is the one I find most interesting. As everything gains an API, we can build more dynamic and responsive security with code. Think your honeynet is cool? How about an active defense tool that detects an attacker hitting a honeypot, then spins out (using a software-defined network) a segregated copy of the subnet with the same topology, but a bunch of dummy hosts to further identify and classify the potential attacker? Or using a few dozen lines of code to identify every unmanaged server in your cloud, determining the system owner, and potentially quarantining them or pushing out configuration updates? All of this is possible, today with software-defined security. If you can code, understand security, and think dev-ops is cool, the odds are you won't have trouble finding work.

I'm not about to promise you full employment as a cloud security programmer next year, but it seems clear that over time these skills will be only more in demand. On the other hand, odds are the basic management and maintenance of existing security tools will slowly transition to other departments. Security will still set firewall policies, but it makes sense for network operations to implement them. Like any profession, there will be a range of required skills, but the more you can align yours with the future, the better your odds of getting higher paying, more interesting work.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
10/22/2013 | 12:05:33 AM
re: Security Skills For 2023
Interesting post. There's a similar discussion happening on the network side as APIs and automation make traditional job requirements, like configuring network gear via the CLI, less relevant.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.