STE WILLIAMS

About a year ago I wrote a post at Securosis describing the big changes I see in the practice of security over the next ten years. While there never seems to be a shortage of town criers singing out the doom of our industry, I actually think we are at the start of some insanely positive changes. I don’t mean nebulous concepts like “influencing the business,” “baking in security early,” or “getting a seat at the table.” I mean honest-to-goodness security technologies and techniques that will not only materially change how we approach security, but are pretty darn interesting and compelling.

These days many security professionals are relegated to roles that often are only tenuously related to directly improving the security of the organization. Now I’m drawing some big generalizations here, but if this doesn’t describe your job, the odds are you know someone it does describe. Managing directory servers, pushing user permissions, configuring firewalls, and other similar tasks aren’t the sorts of things you need security experience for. We have already seen those jobs, even some level of packet analysis, being handed off to operations teams.

On the other hand, security isn’t merely going to transition into a policy-building role. Get too far away from technology and the policies don’t reflect reality, and security gets the basement office. The one next to the boiler.

I’m running on the assumption that if you are reading this, you plan on staying in security for ten years, you enjoy the profession, and you don’t want to turn your brain off. There will still be plenty of those jobs out there, but they will keep decreasing over time. No, for those of you that care the future is bright.

First a few technology assumptions. These are the trends (detailed in the post linked above) that I believe will change the practice of security. The first is the growth of big data, and the ability of security teams to collect and analyze large stores of data in real time. The second is the increasing use of cloud computing, and the availability of application programming interfaces to manage everything from software defined networks to point security products. The third is a greater enablement of incident response, including use of tools like active defense and hyper-segregation to reduce attacker’s abilities to operate freely in our environments once they get in the front door.

That is probably a too-trite overview of where we are headed, but each trend is happening today, for real, as we see more and more of the boring stuff being handed over to Ops, who is better at it anyway. So what does this mean for those of us that don’t want to become clueless policy wonks?

There are three sets of skills I suspect will draw the big bucks in security. Security (Big Data) Analysts, Incident Responders, and Security Developers.

Despite the pretty vendor dashboards, winnowing out useful analysis from a big data repository is a significant challenge. It requires a sound understanding of security, the ability to program the analytics, and the common sense to figure out what matters, what doesn’t, and how to translate that for the non-statisticians (mere mortal) of the world. I won’t be surprised if this becomes one of the most sought after skills sets, especially among larger organizations and security service providers. If you did well in stats, this is where the big money will be.

Incident response is already a skills set in demand. The busy shops struggle to find qualified staff and keep them. Even mid size and smaller organizations will need either in house or outsourced incident response now that we have all realized we can’t completely keep all the bad guys out all the time. The less day to day operational adjustments we need to manage, the more time we can spend detecting and responding to incidents.

The last skills set is the one I find most interesting. As everything gains an API, we can build more dynamic and responsive security with code. Think your honeynet is cool? How about an active defense tool that detects and attacker hitting a honeypot, then spins out (using software defined network) a segregated copy of the subnet with same topology, but a bunch of dummy hosts to further identify and classify the potential attacker? Or using a few dozen lines of code to identify every unmanaged server in your cloud, determining the system owner, and potentially quarantining them or pushing out configuration updates? All of this is possible, today, with Software Defined Security. If you can code, understand security, and think DevOps is cool, the odds are you won’t have trouble finding work.

I’m not about to promise you full employment as a cloud security programmer next year, but it seems clear that over time these skills will only be more in demand. On the other hand, odds are the basic management and maintenance of existing security tools will slowly transition to other departments. Security will still set firewall policies, but it makes sense for network operations to implement them. Like any profession there will be a range of required skills, but the more you can align yours with the future, the better your odds of getting higher paying, more interesting work.

Article source: http://www.darkreading.com/views/security-skills-for2023/240162107