Slashdot Mirror


Security Talent Shortage Hits Cybercrime Groups, Too (csoonline.com)

itwbennett writes: A report released today by Digital Shadows finds that cybercrime organizations "face many of the same hiring problems as defending security organizations, but with their own particular twists," writes Maria Korolov. In particular, the groups are finding a shortage of qualified candidates for jobs such as malware writers, exploit developers, bot net operators, and mules. But, unlike legitimate organizations, "cybercriminals are limited in their ability to properly vet new hires, to widely advertise for needed talent, and to find people who are both trustworthy and are willing to break the law," writes Korolov. One thing the criminals have in common with defending organizations: entry-level skills are the easiest to find. This is one reason why many attackers use simple tools and attack methods.

15 of 40 comments (clear)

  1. Maybe they can take the H1b's! by Joe_Dragon · · Score: 4, Funny

    Maybe they can take the H1b's!

  2. Small pool of talent by rmdingler · · Score: 3, Insightful

    ...find people who are both trustworthy and are willing to break the law.

    It is also difficult to train a hunting dog to bring you ducks but leave the chickens alone.

    You can do it; just remember that dogs are much easier to train and far more loyal than their human counterparts.

    --
    Happiness in intelligent people is the rarest thing I know.

    Ernest Hemingway

  3. Re:Who is sucking up all the top talent and why no by Euphorinaut · · Score: 4, Informative

    The demand is just growing faster than the supply. More things in the world are connected and therefor vulnerable, while most organizations won't start pretending to take security seriously until something bad happens.

  4. Cybercrime needs a stable Windows base by Applehu+Akbar · · Score: 3, Funny

    Cybercrime has gone through a rough patch recently because of the fragmentation of its OS base. So many users still on XP, and the higher-end users cycling rapidly through Windows 7, then 8 and 8.1, and now 10. As soon as the majority of users can be migrated to 10 as Microsoft intends, cybercrime will be off and running again.

    1. Re:Cybercrime needs a stable Windows base by Nunya666 · · Score: 2

      Cybercrime has gone through a rough patch recently because of the fragmentation of its OS base. So many users still on XP, and the higher-end users cycling rapidly through Windows 7, then 8 and 8.1, and now 10. As soon as the majority of users can be migrated to 10 as Microsoft intends, cybercrime will be off and running again.

      In other words, Microsoft is shoving Win10 down our throats for the purpose of alienating their user base, thereby limiting the supply of talent for cybercrime organizations.

      Go Microsoft! Keep alienating your users!

  5. Waitaminute by Marginal+Coward · · Score: 2

    ...the groups are finding a shortage of qualified candidates for jobs such as malware writers, exploit developers, bot net operators, and mules.

    Waitaminute! - I thought Dice recently sold off Slashdot to somebody else...

  6. Re:Who is sucking up all the top talent and why no by Bert64 · · Score: 2

    Very true, and has been the case for a long time...
    Criminals however have a lot less constraints on their hiring, for instance many people with a criminal record will be immediately rejected by most companies as will people without the right immigration status or without the right certifications. Companies may also choose an otherwise less suitable candidate in order to fulfil diversity quotas etc. It's also more difficult for companies to get rid of dead wood.

    The current criminal record process means that someone who has committed a crime in the past is driven towards committing more crimes... They will meet new criminal contacts in jail and find it hard to get any decent paying legitimate work. Someone who made a stupid mistake in their youth may end up facing a choice between committing more crimes or going hungry.

    --
    http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  7. Re:More of a training shortage by Grishnakh · · Score: 2

    Wrong. Trump is absolutely electable: he's sweeping all the GOP primaries right now. How can you possibly say he's not "electable"? That just defies reality.

    Sanders, OTOH, while a great candidate IMO, is just not winning the primaries it appears, so no, it doesn't look like there's a good chance he'll be on the ballot in November.

    My prediction is that Trump will win the election. He's winning the GOP primaries now, and will probably get the nomination. Then he'll be up against Hillary, and given how much everyone who leans even slightly right absolutely despises her, and combined with how much all the Sanders voters (esp. young people) despise her, this means that all these people will either vote for Trump or sit out the race (or write in Bernie's name or vote for Stein or something).

  8. Re:More of a training shortage by RollTRS · · Score: 2

    Sanders is getting his money to campaign from large corporations as Clinton, Cruz, Rubio and the others. They expect a return.

    Campaign/Political finance reform is literally a main tenet of the man's platform. His well documented unwillingness to take donations from banks or corporations is precisely one of the things that has made his campaign so successful. To the point where his campaign has broken multiple records relating to the numbers of small donors, and the amount of money raised.

    --
    "Perl is my favorite... It's like wiping your ass with unix." - Lord Ender
  9. Re:More of a training shortage by will_die · · Score: 2

    Like alphabet Inc, one of his largest contributor?
    Or American Crystal Sugar, another big contributor. It is a CO-OP so definitions include them as corporations, others don't.

  10. Re: More of a training shortage by Hognoxious · · Score: 2

    But what about the Hungarians?

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
  11. nature of things? by umghhh · · Score: 3

    There have been many different things proposed of which many are valid but what about this that I experienced first hand few times in different areas: you outsource as much as you can leaving only the system architects and some other key jobs in house. Theya re competent and well paid. After a while these key staff loses its fresh experience with the stuff they make but more importantly the normal way of raising among the ranks to become a key staff member is not possible anymore - we hire only experts and gurus that also know our systems well enough - guess what - the paths leading there are not possible anymore as bottom of the pyramid is 'in the cloud'. Other interesting side effect is: the bottom of the pyramid people are not going for the best of technical choices as there is no point - the architects of our own company are only one of the many customers. Looks like win win to me...

  12. Re:More of a training shortage by invid · · Score: 2

    Whether someone's voting for Hillary or voting against Trump, the votes go to Hillary. This election is going to be about who people dislike more, and I'm guessing Trump is more disliked than Hillary. Many people don't want to be associated with the white racists supporting Trump.

    --
    The Moore-Murphy Law: The number of things that will go wrong will double every 2 years.
  13. incentive by recharged95 · · Score: 2

    Really, that industry is motivated by incentives.

    The market obviously has spoken the current incentives aren't worth it. It's a buyers market right now if you think about it. Bring on the [real] incentives (e.g. money, power, etc... choose one...), and then you'll see a different story.

  14. Re:More of a training shortage by tsqr · · Score: 2

    OK, Alphabet has contributed about $163,000 to Sanders over his entire political career. That makes them the largest single contributor, making up approximately 0.4% of his contributions for the current election cycle. That's not quite up to the standard of "Sanders is getting his money to campaign from large corporations". It would be more accurate to say "Sanders is one 250th of his money to campaign from large corporations".