Perimeter
10/1/2013
05:06 PM
Rich Mogull
Rich Mogull
Commentary
50%
50%

Security Skills For 2023

Align your career with these top security trends

About a year ago, I wrote a post at Securosis describing the big changes I see coming in the practice of security during the next 10 years. Though we never seem to have a shortage of town criers singing out our industry's doom, I actually think we are at the start of some insanely positive changes. I don't mean nebulous concepts like "influencing the business," "baking in security early," or "getting a seat at the table." I mean honest-to-goodness security technologies and techniques that will not only materially change how we approach security, but are pretty darn interesting and compelling.

These days many security professionals are relegated to roles that often are only tenuously related to directly improving an organization's security. Now, I'm drawing some big generalizations here, but if this doesn't describe your job, the odds are you know someone it does describe. You don't need security experience for managing directory servers, pushing user permissions, configuring firewalls, and other similar tasks. We have already seen those jobs, even some level of packet analysis, handed off to operations teams.

On the other hand, security isn't merely going to transition into a policy-building role. Get too far away from technology and the policies don't reflect reality, and security gets the basement office. The one next to the boiler.

I'm running on the assumption that if you are reading this, you plan on staying in security for 10 years, you enjoy the profession, and you don't want to turn your brain off. Plenty of those jobs will still be out there, but they will keep decreasing over time. No, for those of you that care, the future is bright.

First, a few technology assumptions: These are trends (detailed in the post linked above) I believe will change the practice of security. The first is the growth of big data, and the ability of security teams to collect and analyze large stores of data in real time. The second is the increasing use of cloud computing and the availability of application programming interfaces to manage everything from software-defined networks to point security products. The third is a greater enablement of incident response, including use of tools like active defense and hypersegregation to reduce attackers' abilities to operate freely in our environments once they get in the front door.

That is probably a too-trite overview of where we are headed, but each trend is happening today, for real, as we see more and more of the boring stuff being handed over to ops -- who is better at it anyway. So what does this mean for those of us who don't want to become clueless policy wonks?

I suspect three sets of skills will draw the big bucks in security: security (big data) analysts, incident responders, and security developers.

Despite the pretty vendor dashboards, winnowing out useful analysis from a big data repository is a significant challenge. It requires a sound understanding of security, the ability to program the analytics, and the common sense to figure out what matters, what doesn't, and how to translate that for the nonstatisticians (mere mortals) of the world. I won't be surprised if this becomes one of the most sought-after skills sets, especially among larger organizations and security service providers. If you did well in stats, then this is where the big money will be.

Incident response is already a skills set in demand. The busy shops struggle to find qualified staff and keep them. Even midsize and smaller organizations will need either in-house or outsourced incident response now that we have all realized we can't completely keep out all of the bad guys all of the time. The fewer day-to-day operational adjustments we need to manage, the more time we can spend detecting and responding to incidents.

The last skills set is the one I find most interesting. As everything gains an API, we can build more dynamic and responsive security with code. Think your honeynet is cool? How about an active defense tool that detects an attacker hitting a honeypot, then spins out (using a software-defined network) a segregated copy of the subnet with the same topology, but a bunch of dummy hosts to further identify and classify the potential attacker? Or using a few dozen lines of code to identify every unmanaged server in your cloud, determining the system owner, and potentially quarantining them or pushing out configuration updates? All of this is possible, today with software-defined security. If you can code, understand security, and think dev-ops is cool, the odds are you won't have trouble finding work.

I'm not about to promise you full employment as a cloud security programmer next year, but it seems clear that over time these skills will be only more in demand. On the other hand, odds are the basic management and maintenance of existing security tools will slowly transition to other departments. Security will still set firewall policies, but it makes sense for network operations to implement them. Like any profession, there will be a range of required skills, but the more you can align yours with the future, the better your odds of getting higher paying, more interesting work.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
10/22/2013 | 12:05:33 AM
re: Security Skills For 2023
Interesting post. There's a similar discussion happening on the network side as APIs and automation make traditional job requirements, like configuring network gear via the CLI, less relevant.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3407
Published: 2014-11-27
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

CVE-2014-4829
Published: 2014-11-27
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests tha...

CVE-2014-4831
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.

CVE-2014-4832
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.

CVE-2014-4883
Published: 2014-11-27
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?