Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

3/27/2019
10:30 AM
Ira Winkler
Ira Winkler
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

The 'Twitterverse' Is Not the Security Community

The drama on social media belies the incredible role models, job, training, and networking opportunities found in the real world of traditional cybersecurity.

When you look at social media, you get the impression that there is a serious shortage in security professionals — and at the same time, you can't imagine why anyone would want to work in cybersecurity in the first place. Judging by Twitter, it seems as if security professionals are frequently at each other's throats and, with few prominent role models, it's a terrible place for women. All you have to do is look at last year's DerbyCon controversy for proof of how dysfunctional the community can appear online.

But here's a not-so-secret secret: The large majority of security professionals don't have time for the drama on social media, and social media is not representative of the profession as a whole.

The security professionals who post on Twitter frequently make valuable contributions to the security community as a whole. However, they are not representative of their million or so industry colleagues who go to work and then go back to their families and real life when work is over, and rarely get on social media.

These people don't necessarily go to hacker cons; they do their security related jobs and then leave their work in the office. They work for government agencies such as the NSA, Cyber Command, DISA, the FBI, military commands, NIST, etc. Then there are government contractors, the security teams at major banks made up of hundreds and sometimes thousands of people, professionals who work at the Big Four consulting firms with thousands of security professionals each, thousands of people who perform security work at telecommunications companies such as Verizon and AT&T, on top of the hundreds of thousands of people working in other government agencies around the world. Tech companies such as Cisco, IBM, HP, and others have thousands of employees as well. I'd guess relatively few of these people are active on social media.

The reason I want to highlight the difference is that I recently read a post from a woman on Twitter who said she saw no comparable female role models in the industry who would be making $200,000 per year. I saw one or two people mention someone, but what surprised me was the complete void in recognition of some of the most notable women in the profession — women who are not active on Twitter but active within the security community as a whole.

Quick examples who come immediately to mind include:

  • Myrna Soto, former CISO, Comcast, and now a venture capitalist
  • Renee Guttmann, CISO, Campbell Soup Company, and previously Coca-Cola, Time Warner, and Royal Caribbean
  • Dawn Cappelli, CISO, Rockwell Automation
  • Jennifer Minella, Chair, (ISC)2 Board of Directors and VP Carolina Advanced Digital,
  • Terry Grafenstine, former Chair, ISACA Board of Directors and Managing Director at Deloitte
  • Shelley Westman, Partner, EY
  • Mischel Kwon, CEO, MKACyber, and former director, US-CERT
  • Sandra Toms, General Manager, RSA Conference
  • Illena Armstrong, VP, SC Media
  • Rhonda MacLean, former CISO, Bank of America and Barclays, and board member to several cybersecurity companies
  • Dr. Chenxi Wang, venture capitalist
  • Dr. Cynthia Irvine, Distinguished Professor at the Naval Postgraduate School, who trained a generation of military cybersecurity professionals
  • Dr. Dorothy Denning, an icon of the field, who people refer to as the "Mother of Computer Security"

To be sure, women such as Katie Moussouris and Parisa Tabriz, accomplished and active in both social media and in the larger community, serve as outstanding role models. Yet even with the visibility of these prominent women, social media represents only a subset of the cyber universe. Furthermore, what people who rely solely on Twitter as their window to cybersecurity are missing is not just incredible role models, but also job opportunities, training opportunities, professional networking opportunities, and volunteer opportunities.

Don't get me wrong. I personally get a great deal out of social media, and have developed many friends who I only know through that forum. But I also remain active in the mainstream, including traditional conferences, local ISSA, (ISC)2, ISACA, Infragard chapter meetings, vendor events, and online forums associated with these groups. The bottom line is that it is to everyone's benefit that people within the hacker and traditional cybersecurity communities look beyond their own echo chambers as much as possible.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ira Winkler is president of Secure Mentem and author of Advanced Persistent Security. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
markgrogan
50%
50%
markgrogan,
User Rank: Apprentice
4/18/2019 | 1:29:56 AM
Pinch of salt
Social media has always been giving people the wrong impression of so many different things on the face of this earth. Thus, I have chosen not to fully believe what is being portrayed out there in the digital realm. Read what you see online and analyze the info with a pinch of salt.
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7843
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7846
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7847
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successful exploitation could lead to Arbitrary read access to the file system in the context of the current user.
CVE-2019-7848
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7850
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.