Perimeter
10/1/2013
05:06 PM
Rich Mogull
Rich Mogull
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Security Skills For 2023

Align your career with these top security trends

About a year ago, I wrote a post at Securosis describing the big changes I see coming in the practice of security during the next 10 years. Though we never seem to have a shortage of town criers singing out our industry's doom, I actually think we are at the start of some insanely positive changes. I don't mean nebulous concepts like "influencing the business," "baking in security early," or "getting a seat at the table." I mean honest-to-goodness security technologies and techniques that will not only materially change how we approach security, but are pretty darn interesting and compelling.

These days many security professionals are relegated to roles that often are only tenuously related to directly improving an organization's security. Now, I'm drawing some big generalizations here, but if this doesn't describe your job, the odds are you know someone it does describe. You don't need security experience for managing directory servers, pushing user permissions, configuring firewalls, and other similar tasks. We have already seen those jobs, even some level of packet analysis, handed off to operations teams.

On the other hand, security isn't merely going to transition into a policy-building role. Get too far away from technology and the policies don't reflect reality, and security gets the basement office. The one next to the boiler.

I'm running on the assumption that if you are reading this, you plan on staying in security for 10 years, you enjoy the profession, and you don't want to turn your brain off. Plenty of those jobs will still be out there, but they will keep decreasing over time. No, for those of you that care, the future is bright.

First, a few technology assumptions: These are trends (detailed in the post linked above) I believe will change the practice of security. The first is the growth of big data, and the ability of security teams to collect and analyze large stores of data in real time. The second is the increasing use of cloud computing and the availability of application programming interfaces to manage everything from software-defined networks to point security products. The third is a greater enablement of incident response, including use of tools like active defense and hypersegregation to reduce attackers' abilities to operate freely in our environments once they get in the front door.

That is probably a too-trite overview of where we are headed, but each trend is happening today, for real, as we see more and more of the boring stuff being handed over to ops -- who is better at it anyway. So what does this mean for those of us who don't want to become clueless policy wonks?

I suspect three sets of skills will draw the big bucks in security: security (big data) analysts, incident responders, and security developers.

Despite the pretty vendor dashboards, winnowing out useful analysis from a big data repository is a significant challenge. It requires a sound understanding of security, the ability to program the analytics, and the common sense to figure out what matters, what doesn't, and how to translate that for the nonstatisticians (mere mortals) of the world. I won't be surprised if this becomes one of the most sought-after skills sets, especially among larger organizations and security service providers. If you did well in stats, then this is where the big money will be.

Incident response is already a skills set in demand. The busy shops struggle to find qualified staff and keep them. Even midsize and smaller organizations will need either in-house or outsourced incident response now that we have all realized we can't completely keep out all of the bad guys all of the time. The fewer day-to-day operational adjustments we need to manage, the more time we can spend detecting and responding to incidents.

The last skills set is the one I find most interesting. As everything gains an API, we can build more dynamic and responsive security with code. Think your honeynet is cool? How about an active defense tool that detects an attacker hitting a honeypot, then spins out (using a software-defined network) a segregated copy of the subnet with the same topology, but a bunch of dummy hosts to further identify and classify the potential attacker? Or using a few dozen lines of code to identify every unmanaged server in your cloud, determining the system owner, and potentially quarantining them or pushing out configuration updates? All of this is possible, today with software-defined security. If you can code, understand security, and think dev-ops is cool, the odds are you won't have trouble finding work.

I'm not about to promise you full employment as a cloud security programmer next year, but it seems clear that over time these skills will be only more in demand. On the other hand, odds are the basic management and maintenance of existing security tools will slowly transition to other departments. Security will still set firewall policies, but it makes sense for network operations to implement them. Like any profession, there will be a range of required skills, but the more you can align yours with the future, the better your odds of getting higher paying, more interesting work.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
10/22/2013 | 12:05:33 AM
re: Security Skills For 2023
Interesting post. There's a similar discussion happening on the network side as APIs and automation make traditional job requirements, like configuring network gear via the CLI, less relevant.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-0889
Published: 2014-07-29
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through 6.0.3, allow remote atta...

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3020
Published: 2014-07-29
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

Best of the Web
Dark Reading Radio