Slashdot Mirror
Security Talent Shortage Hits Cybercrime Groups, Too (csoonline.com)
itwbennett writes: A report released today by Digital Shadows finds that cybercrime organizations "face many of the same hiring problems as defending security organizations, but with their own particular twists," writes Maria Korolov. In particular, the groups are finding a shortage of qualified candidates for jobs such as malware writers, exploit developers, bot net operators, and mules. But, unlike legitimate organizations, "cybercriminals are limited in their ability to properly vet new hires, to widely advertise for needed talent, and to find people who are both trustworthy and are willing to break the law," writes Korolov. One thing the criminals have in common with defending organizations: entry-level skills are the easiest to find. This is one reason why many attackers use simple tools and attack methods.
Maybe they can take the H1b's!
Are we on the edge of something big?
Exploit toolkits have greatly simplified and steamlined the task of creating malware, which means nearly anyone can create reasonably effective product in 2016. Also, a lot of the work has moved offshore and is done in places like China or the former Soviet Union, which has driven down wages here in the USA for this type of work. It's more cost effective these days to focus on things that are difficult to farm out like social engineering hacks or inside job security breaches.
...find people who are both trustworthy and are willing to break the law.
It is also difficult to train a hunting dog to bring you ducks but leave the chickens alone.
You can do it; just remember that dogs are much easier to train and far more loyal than their human counterparts.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
From what I can see. Oh well, whatever gets then more H1-bs, right? Sad thing is we've got exactly two presidential candidates (Trump and Sanders) opposed to this junk and neither is electable.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
The demand is just growing faster than the supply. More things in the world are connected and therefor vulnerable, while most organizations won't start pretending to take security seriously until something bad happens.
Cybercrime has gone through a rough patch recently because of the fragmentation of its OS base. So many users still on XP, and the higher-end users cycling rapidly through Windows 7, then 8 and 8.1, and now 10. As soon as the majority of users can be migrated to 10 as Microsoft intends, cybercrime will be off and running again.
almost anecdotal... cease fire...
But, unlike legitimate organizations, "cybercriminals are limited in their ability to properly vet new hires, to widely advertise for needed talent, and to find people who are both trustworthy and are willing to break the law," writes Korolov.
Maybe they can start recruiting from all the piracy sites? They all are "trustworthy".
I doubt it. More like fewer and fewer people are available with the specialized knowledge at each level.
Entry? Lots of people. ... even fewer.
1 step above entry? Fewer people.
2 steps
etc.
Also, from TFA:
Travel is hazardous. And fame/notoriety means that LEO's are looking for you.
Which reduces the pool of available talent at each level (which is already a small pool at the upper levels).
But crime doesn't pay. Or does it. I'm confused.
Is there anyone feeling sorry for these scumbags?
...the groups are finding a shortage of qualified candidates for jobs such as malware writers, exploit developers, bot net operators, and mules.
Waitaminute! - I thought Dice recently sold off Slashdot to somebody else...
Those cybercrime groups can just offshore their tale...oh wait
Very true, and has been the case for a long time...
Criminals however have a lot less constraints on their hiring, for instance many people with a criminal record will be immediately rejected by most companies as will people without the right immigration status or without the right certifications. Companies may also choose an otherwise less suitable candidate in order to fulfil diversity quotas etc. It's also more difficult for companies to get rid of dead wood.
The current criminal record process means that someone who has committed a crime in the past is driven towards committing more crimes... They will meet new criminal contacts in jail and find it hard to get any decent paying legitimate work. Someone who made a stupid mistake in their youth may end up facing a choice between committing more crimes or going hungry.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Maybe the criminals could hand out fliers in th Disney parking lot? I hear there are lots of talented people there being forced out of their jobs and desperately seeking work.
Nobody is. On the one hand you've got Disney and everyone else outsourcing to India regardless of actual skill level (witness Disney's staff being required to train the H1Bs replacing them), leading to people deciding they'd rather go into flower arrangement then spend tens of thousands of dollars and years of time to learn a useless skill. On the other hand you've got the criminal cartels slaughtering their participants, further shrinking the supply pool of people who both know what they're doing and valuing their life so little that they'd work for the cartels. I'd suspect that anyone with actual skill would rather work to enrich themselves rather than a mexican drug gang or russian mafia don.
They asked me how well I understood theoretical physics. I said I had a theoretical degree in physics. They said welcome aboard.
Well maybe pay more then. The crims at the top dont need that second yacht.
and to find people who are both trustworthy and are willing to break the law...... You know where to find me.,
Demand? I guess I am not looking ib the right place because I can only find job postings I ever see are for basic moving computers and plugging them on jobs. No company I have spoken with seems to care that much about a computer forensics certification and a bachelors in computer security and information assurance...
There have been many different things proposed of which many are valid but what about this that I experienced first hand few times in different areas: you outsource as much as you can leaving only the system architects and some other key jobs in house. Theya re competent and well paid. After a while these key staff loses its fresh experience with the stuff they make but more importantly the normal way of raising among the ranks to become a key staff member is not possible anymore - we hire only experts and gurus that also know our systems well enough - guess what - the paths leading there are not possible anymore as bottom of the pyramid is 'in the cloud'. Other interesting side effect is: the bottom of the pyramid people are not going for the best of technical choices as there is no point - the architects of our own company are only one of the many customers. Looks like win win to me...
Really, that industry is motivated by incentives.
The market obviously has spoken the current incentives aren't worth it. It's a buyers market right now if you think about it. Bring on the [real] incentives (e.g. money, power, etc... choose one...), and then you'll see a different story.