Re:Introducing Chronicle, a new Alphabet business dedicated ...
by mike_hearn on Thursday January 25, 2018 @07:30AM
(#16230366)
Also London. I recently hired a security engineer capable of doing code audits and other such things. It took about 6-8 months I think.
One reason for the talent shortage is that security work is to a large degree about keeping up with enormous amounts of information on attack types. If you stop drinking from the firehose for even a few months you're going to miss new types of attacks and new information. And there are precious few systems that help reduce the impact of vulnerabilities... there are some but it's still an area dominated by trivia-like knowledge (I don't mean it's trivial but rather, that there are a lot of "just facts" that you have to know and cannot easily learn or derive on your own).
Ultimately the industries approach to security is not sustainable. We need to systematically move away from insecure infrastructures. Unfortunately nobody wants to do that. First thing that'd have to go - the use of web apps for UI.
One reason for the talent shortage is that security work is to a large degree about keeping up with enormous amounts of information on attack types. If you stop drinking from the firehose for even a few months you're going to miss new types of attacks and new information. And there are precious few systems that help reduce the impact of vulnerabilities... there are some but it's still an area dominated by trivia-like knowledge (I don't mean it's trivial but rather, that there are a lot of "just facts" that you have to know and cannot easily learn or derive on your own).
Ultimately the industries approach to security is not sustainable. We need to systematically move away from insecure infrastructures. Unfortunately nobody wants to do that. First thing that'd have to go - the use of web apps for UI.