Perimeter
10/1/2013
05:06 PM
Rich Mogull
Rich Mogull
Commentary
50%
50%

Security Skills For 2023

Align your career with these top security trends

About a year ago, I wrote a post at Securosis describing the big changes I see coming in the practice of security during the next 10 years. Though we never seem to have a shortage of town criers singing out our industry's doom, I actually think we are at the start of some insanely positive changes. I don't mean nebulous concepts like "influencing the business," "baking in security early," or "getting a seat at the table." I mean honest-to-goodness security technologies and techniques that will not only materially change how we approach security, but are pretty darn interesting and compelling.

These days many security professionals are relegated to roles that often are only tenuously related to directly improving an organization's security. Now, I'm drawing some big generalizations here, but if this doesn't describe your job, the odds are you know someone it does describe. You don't need security experience for managing directory servers, pushing user permissions, configuring firewalls, and other similar tasks. We have already seen those jobs, even some level of packet analysis, handed off to operations teams.

On the other hand, security isn't merely going to transition into a policy-building role. Get too far away from technology and the policies don't reflect reality, and security gets the basement office. The one next to the boiler.

I'm running on the assumption that if you are reading this, you plan on staying in security for 10 years, you enjoy the profession, and you don't want to turn your brain off. Plenty of those jobs will still be out there, but they will keep decreasing over time. No, for those of you that care, the future is bright.

First, a few technology assumptions: These are trends (detailed in the post linked above) I believe will change the practice of security. The first is the growth of big data, and the ability of security teams to collect and analyze large stores of data in real time. The second is the increasing use of cloud computing and the availability of application programming interfaces to manage everything from software-defined networks to point security products. The third is a greater enablement of incident response, including use of tools like active defense and hypersegregation to reduce attackers' abilities to operate freely in our environments once they get in the front door.

That is probably a too-trite overview of where we are headed, but each trend is happening today, for real, as we see more and more of the boring stuff being handed over to ops -- who is better at it anyway. So what does this mean for those of us who don't want to become clueless policy wonks?

I suspect three sets of skills will draw the big bucks in security: security (big data) analysts, incident responders, and security developers.

Despite the pretty vendor dashboards, winnowing out useful analysis from a big data repository is a significant challenge. It requires a sound understanding of security, the ability to program the analytics, and the common sense to figure out what matters, what doesn't, and how to translate that for the nonstatisticians (mere mortals) of the world. I won't be surprised if this becomes one of the most sought-after skills sets, especially among larger organizations and security service providers. If you did well in stats, then this is where the big money will be.

Incident response is already a skills set in demand. The busy shops struggle to find qualified staff and keep them. Even midsize and smaller organizations will need either in-house or outsourced incident response now that we have all realized we can't completely keep out all of the bad guys all of the time. The fewer day-to-day operational adjustments we need to manage, the more time we can spend detecting and responding to incidents.

The last skills set is the one I find most interesting. As everything gains an API, we can build more dynamic and responsive security with code. Think your honeynet is cool? How about an active defense tool that detects an attacker hitting a honeypot, then spins out (using a software-defined network) a segregated copy of the subnet with the same topology, but a bunch of dummy hosts to further identify and classify the potential attacker? Or using a few dozen lines of code to identify every unmanaged server in your cloud, determining the system owner, and potentially quarantining them or pushing out configuration updates? All of this is possible, today with software-defined security. If you can code, understand security, and think dev-ops is cool, the odds are you won't have trouble finding work.

I'm not about to promise you full employment as a cloud security programmer next year, but it seems clear that over time these skills will be only more in demand. On the other hand, odds are the basic management and maintenance of existing security tools will slowly transition to other departments. Security will still set firewall policies, but it makes sense for network operations to implement them. Like any profession, there will be a range of required skills, but the more you can align yours with the future, the better your odds of getting higher paying, more interesting work.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
10/22/2013 | 12:05:33 AM
re: Security Skills For 2023
Interesting post. There's a similar discussion happening on the network side as APIs and automation make traditional job requirements, like configuring network gear via the CLI, less relevant.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

CVE-2015-0890
Published: 2015-03-03
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2015-2168
Published: 2015-03-03
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.