Slashdot Mirror
Want a Security Pro? Get Politically Incorrect and Learn Geek Culture
coondoggie writes "While complaints can be heard far and wide that it's hard to find the right IT security experts to defend the nation's cyberspace, the real problem in hiring security professionals is the roadblocks put up by lawyers and human resources personnel and a complete lack of understanding of geek culture, says security consultant Winn Schwartau. Take Janet Napolitano, U.S. secretary of the Department of Homeland Security, who has said the country can't find the right people for network defense. The real problem is a misunderstanding of computer geeks, their personalities, habits and their backgrounds, said Schwartau today during his talk at the Hacker Halted information security conference."
People who accept an 80k for 40k for the govt.
And the Catholic Church could prop up its declining clergy membership by recruiting straight from the local sex offender registry.
Seriously, what the fuck? "Legal niceties" is another term for these rules are in place because we don't want to get fucked over again by someone we trusted. They're there for a reason, and actively circumventing them to search for applicants is inviting yourself to get burned. Maybe some of them could be relaxed, sure, like the one-time drug offense bit for security clearances. But just saying "they're narrowing our pool of applicants!"...Shit, Sherlock, that's why they exist!
Everything is better with chainsaws.
think they deserve special treatment and don't have to be clean, social, pleasant, accountable workers.
newsflash: they do.
Corps and Gov are right to want to make more geeks, so they don't have to make do with the half-defective ones.
The Cloud - because you don't care if your apps and data are up in the air.
Your assumption is that the government hires people capable to actually solve the problem. It does, but only in war times. In war times you lose ground when you follow the wrong path. When yo sent the horses against the machine guns. Governments are not interested to actually solve the problem but rather to be in charge of the problem. We know that many security issues could be solved. Simply spent a few millions on security reviews of commonly executed code. and order the companies to provide bug fixes or apply punitive damages, make them partly liable for not fixing security issues.
This isn't even specific to the IT field. This is a problem with every organization that hires people. Unless the organization is too small to have lawyers or human resources.
Now, is that because good hackers tend to be drug users--or is it because *you* are a drug user and thus a larger percentage of the people you meet are drug users?
If you've ever worked for the government, you'll know that they ensure it's hard for them to hire anyone.
Network security is a position of trust. There is basically no way around this: implicit in running a network is that you have the tools to see what's on it. Encryption only goes so far in such situations, particularly at agencies tasked, in part, with getting at encrypted data.
This adds up to some employers requiring a greater degree of trust in their employees than is currently the norm. Some geeks, it seems, are unwilling to come to terms with the fact that their life choices may have made them poor security risks in that context. The cases where the risk isn't because of a life choice are sadder, but the risk is just as real, and to ask agencies with bona fide requirements for absolute trust to simply ignore those risks is insane.
...had a Top Secret / SCI (secure, compartmentalized information) clearance.
They crawled up his ass with the Hubble telescope, looked for people he knows, then went and crawled up the ass of *those* people to find out who *they* know that might know Manning. They hooked him up to a polygraph. They checked, re-checked, cross-checked and followed every single link, social media page, every parking ticket, every word on his school records.
It takes months to do a SSBI.
And yet, when Manning encountered something that he knew for a confirmed fact that what he was seeing/hearing/reading was against the law, he tried to do the right thing, but got shot down by his chain of command. Feeling as though he had no other choice, he allegedly turned the info over to Wikileaks.
What the heck do you suppose a "geek", someone who by their very nature has issues with authority, probably has personal issues around justice, and has tendencies towards just about every "ism" that your average government puts people on watchlists for, is going to do when they see/hear/read something that they think is wrong????
Nabbing geeks off the street to "hack the planet" is fine and dandy for movies about the end of the world, but it doesn't work so well in real life.
[End Of Line]
...of security clearances and credit checks and background checks and peeing in cups, although that's a big part of it (official DoD policy is that any marijuana use is a "serious mental disorder.")
The other aspect is that they don't really want their security fixed. They don't want to be told that "TBD" on a security plan isn't acceptable.
To be fair, this sounds exactly like working for any large corporation. =)
For the House of Representatives we should probably draft them, like the Army used to. Walk out to the mail box, open the letter from the gov't, ... damn I have to report to Congress for two years. That way we get a broader sampling of perspectives and experiences. The type of people we want probably would not apply for the job (volunteer). :-)