Plenty of pen testing mega-mart consultancy jobs making 60-90K a year working 70 hours a week in Boston and other ungodly expensive cities though. Guessing all this news about the "shortage" in cyber is just more propaganda to further open up the H1B floodgates and drive salaries down.

I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally.

Software engineers from a top school, who passed the most hardcore interviews in the most selective firms in the world, to live in the most expensive city on the planet where a single bedroom flat is $4k a month.

There is not much demand for people who can run a scanner or set up a firewall. Not to mention that a setup is a single day of work, it's not even close to a full time job.

Maybe they are counting every guy who ever plugged a broadband modem as a security specialist.

Everyone is already trying to pass the buck (quite literally) on information security risk via insurance, and the insurance industry is pushing back. One possibility that might develop out of the standoff is customers pushing the liability onto Cloud vendors and washing their hands of the concern.

What no one outside of information security wants to admit much less promulgate is development and IT teams must grow larger, or security continues as an expensive as hell fat tail risk. The cheap hedge is hiring additional staff; businesses have grown so accustomed to living outside the fat tail that the accumulated technical debt presents the illusion that status quo is normal. The new normal is ever-more expensive attacks.

I wish POSIX would offer a standard way to elide certain parts of a the command string that shows up in a process list. There are piles of legacy programs that won’t get retrofitted to use a file to read a password anytime soon. There are sins aplenty in our fields when it comes to security.

That would be good, the cloud is a lot more secure than everything self hosted or self developed.

If you're doing heavy R&D and you keep things on isolated networks, might not your R&D be at least similarly secure on-premises, if you follow secure practices?

How much visibility do you have into your cloud provider's security? For email, sure go with a known cloud provider. Some SaaS services on the back-end can be less than ideally secure.

All companies who don't have cloud tools have to re invent everything, it's hard and a lot of effort so the result is always terrible. Poor UI, poor security, full of bugs, pick any three.

AWS is better for isolated networks, it can manage strict network access rules way beyond anything iptables can achieve. In fact, cloud is the only way to have well isolated networks, unless we're talking about a computer unplugged from any network.

This is, unfortunately, selling the security industry short. In reality, and especially in cities like DC, the security industry is pretty competitive and the barrier to entry for even entry-level jobs is pretty high. Companies are looking for not just metasploit experience, but a more-than-surface-level understanding of things like networking, OS internals, programming, systems administration, critical thinking, and more. Then on top of that, one needs to be able to look at everything with "vulnerabilities" and "exploitation" in mind. It's not easy. Quite frankly, there is a lot of information that one needs to know, and know well, to be competitive in this field.

With that said, I 100% agree that the certifications are complete bullshit (including SANS). And sure, there are certainly fields that are definitely bullshit-y and mostly for compliance purposes (cough pentesting cough). But there is merit in the security field and it's not all bullshit.

I've been in the field for a couple of years. I work for a global corporation with 10k+ employees and most of our team members in the security department are judge on their skills and various other factors and we filter potential candidates with a small CTF. Certs have very little importance for us, but we're the exception. Most big compagnies require certifications and oddly they are the ones getting hacked.

In the field, we all know that EC-Council certs are bullshit. They are, at best, the laughing stock in infosec because their "Ethical Hacker" certification is a multiple choice answer and requires little technical knowledge and no hands-on.

However, there are a few certs out there that need a lot of work and technical knowledge to be learn for passing it, such as OSCP. It might be easy to get for someone with 10+ years but for relatively new comers, it's a really good challenge to tackle. I started with their lab, thinking it was going to be a piece of cake for me but it's more difficult than I expected, which is a good thing.

But I see your point and I mostly agree.

Care to explain why you think intrusion detection is bullshit?

If they're signature based they're not better than antivirus. I have zero faith in signature based systems.

For the stuff that uses machine learning, I have to admit, I have no idea how that stuff performs. But in general I wouldn't trust a machine learning model to not be fooled.

Edit: Add to that HTTPS, I don't buy any claim that they can spot malware traffic from malware that isn't dumb, and I don't think MITMing all traffic is an acceptable solution.

You can assign 100 students to develop a trojan for a week. At the end of the week, more than 90% of the software are detected as generic trojan by the antivirus.

Probably because 90 of these 100 students have no idea how AV heuristics work and what the trivial tricks are to completely stomp them.

Don't underestimate the students and don't underestimate the AV. The world is full of surprises.

That's ok.

You're in good company with the vendors who sell ML cybersecurity appliances.

I second the IDS and WAF bullshit argument.

See http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf. IDS is considered a speed bump by sophisticated attackers. Which is where you want to focus your energy.

1. Staffing an event management system (probably something with a pretty console that is 1/5th as powerful as an ELK deployment but that costs 10x as much because Security) and investigating alerts.

2. Kicking off routine scanning processes and reviewing the results generated by them.

3. Responding to requests to let this application or that host through some perimeter firewall.

Can you please elaborate?