Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

3/27/2019
10:30 AM
Ira Winkler
Ira Winkler
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

The 'Twitterverse' Is Not the Security Community

The drama on social media belies the incredible role models, job, training, and networking opportunities found in the real world of traditional cybersecurity.

When you look at social media, you get the impression that there is a serious shortage in security professionals — and at the same time, you can't imagine why anyone would want to work in cybersecurity in the first place. Judging by Twitter, it seems as if security professionals are frequently at each other's throats and, with few prominent role models, it's a terrible place for women. All you have to do is look at last year's DerbyCon controversy for proof of how dysfunctional the community can appear online.

But here's a not-so-secret secret: The large majority of security professionals don't have time for the drama on social media, and social media is not representative of the profession as a whole.

The security professionals who post on Twitter frequently make valuable contributions to the security community as a whole. However, they are not representative of their million or so industry colleagues who go to work and then go back to their families and real life when work is over, and rarely get on social media.

These people don't necessarily go to hacker cons; they do their security related jobs and then leave their work in the office. They work for government agencies such as the NSA, Cyber Command, DISA, the FBI, military commands, NIST, etc. Then there are government contractors, the security teams at major banks made up of hundreds and sometimes thousands of people, professionals who work at the Big Four consulting firms with thousands of security professionals each, thousands of people who perform security work at telecommunications companies such as Verizon and AT&T, on top of the hundreds of thousands of people working in other government agencies around the world. Tech companies such as Cisco, IBM, HP, and others have thousands of employees as well. I'd guess relatively few of these people are active on social media.

The reason I want to highlight the difference is that I recently read a post from a woman on Twitter who said she saw no comparable female role models in the industry who would be making $200,000 per year. I saw one or two people mention someone, but what surprised me was the complete void in recognition of some of the most notable women in the profession — women who are not active on Twitter but active within the security community as a whole.

Quick examples who come immediately to mind include:

  • Myrna Soto, former CISO, Comcast, and now a venture capitalist
  • Renee Guttmann, CISO, Campbell Soup Company, and previously Coca-Cola, Time Warner, and Royal Caribbean
  • Dawn Cappelli, CISO, Rockwell Automation
  • Jennifer Minella, Chair, (ISC)2 Board of Directors and VP Carolina Advanced Digital,
  • Terry Grafenstine, former Chair, ISACA Board of Directors and Managing Director at Deloitte
  • Shelley Westman, Partner, EY
  • Mischel Kwon, CEO, MKACyber, and former director, US-CERT
  • Sandra Toms, General Manager, RSA Conference
  • Illena Armstrong, VP, SC Media
  • Rhonda MacLean, former CISO, Bank of America and Barclays, and board member to several cybersecurity companies
  • Dr. Chenxi Wang, venture capitalist
  • Dr. Cynthia Irvine, Distinguished Professor at the Naval Postgraduate School, who trained a generation of military cybersecurity professionals
  • Dr. Dorothy Denning, an icon of the field, who people refer to as the "Mother of Computer Security"

To be sure, women such as Katie Moussouris and Parisa Tabriz, accomplished and active in both social media and in the larger community, serve as outstanding role models. Yet even with the visibility of these prominent women, social media represents only a subset of the cyber universe. Furthermore, what people who rely solely on Twitter as their window to cybersecurity are missing is not just incredible role models, but also job opportunities, training opportunities, professional networking opportunities, and volunteer opportunities.

Don't get me wrong. I personally get a great deal out of social media, and have developed many friends who I only know through that forum. But I also remain active in the mainstream, including traditional conferences, local ISSA, (ISC)2, ISACA, Infragard chapter meetings, vendor events, and online forums associated with these groups. The bottom line is that it is to everyone's benefit that people within the hacker and traditional cybersecurity communities look beyond their own echo chambers as much as possible.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ira Winkler is president of Secure Mentem and author of Advanced Persistent Security. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
markgrogan
50%
50%
markgrogan,
User Rank: Strategist
4/18/2019 | 1:29:56 AM
Pinch of salt
Social media has always been giving people the wrong impression of so many different things on the face of this earth. Thus, I have chosen not to fully believe what is being portrayed out there in the digital realm. Read what you see online and analyze the info with a pinch of salt.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.