I, Cringely

[I, Cringely]

I, Cringely

The Cybersecurity Myth

Posted: 02 Oct 2009 01:54 PM PDT

The Department of Homeland Security (DHS) said this week it will hire
up to 1,000 cybersecurity experts over the next three years to help
protect U.S. computer networks. This was part of National
Cybersecurity Awareness Month and the announcement was made by DHS
Secretary Janet Napolitano, who also said they probably wont need to
hire all 1,000 experts, which is good because I am pretty sure THERE
ARENT ONE THOUSAND CIVILIAN CYBERSECURITY EXPERTS IN THE ENTIRE
FRIGGIN WORLD!!!!

So I polled six old friends who ARE cybersecurity experts and they
kinda-sorta agreed with me.  More on this below.

But first I have to marvel that I even know six cybersecurity experts
and  even more amazing  Im pretty sure they dont know each other.
They seem to be like badgers, solitary creatures who only come out to
mate.

They are cynics, too.  One questioned the term cybersecurity as
being inappropriate.

(It) depends on your definition of expert, said expert number one,
who works deep in the military-industrial complex. If you mean
someone who can spell cyber then sure (there are 1,000). If you mean
those who know that cyber is short for cybernetics and has little
to do with computers then probably not. I still occasionally use the
title Cybernetic Psychophysicist.

Sure enough, theres a very detailed definition of cybernetics here
and it doesnt intrinsically have very much to do with computers or
networks, though dont tell that to the DHS without first taking off
your shoes and placing the definition in a one quart plastic bag.

Duh! said expert number two who has spent his career at telcos and
cable companies. Of course.  You got it right.  I doubt there are
1000 in the world.  There are a lot of wannabees, or folks who think
they are

Define expert, said another friend from behind Door Number Three,
who comes from the security software business. (An expert is) a
person with a high degree of skill in or knowledge of a certain
subject.  Great, but the question is all about scope. I may be an
expert cook  but can I run a kitchen? Same thing with security there
are tons of experts  in specific areas. I was an expert in AV, IDS,
and other areas. But I was not the all knowing security guru. (even
though my knowledge base was very broad). This is where we run into
unintended actuated consequences. An expert will make a choice and
take an action.  The end result may not be what they had anticipated
because of other factors beyond the realm of their expertise caused an
unanticipated consequence.

Example: I am forced to use low sulfur gas because the experts say it
produces 20 percent less harmful emissions. Too bad they did not
notice it has a lower power quotient then a normal gas blend. As a
result I use 30 percent more gas that is 30 percent more expensive
(and puts four percent more sulfur into the air).

So I believe there to be less then 30 real experts in security, but
there may be well over 500 subject matter experts and perhaps another
1000 sous-security people.

Now I brought in the big gun  expert number four, an independent
security consultant to foreign governments:

My bet is that they are going to just pull the bodies from the
Department of Defense and Department of Energy, he said.  DoD has
established a number of credentials required to be classified as a
security specialist like CompTIA Security+, CISSP, etc.  None of this
stuff has any practical application because it is hardware/software
neutral.

Even if a government agency, (over 550 or them) allows you to sniff
their network, are they going to let you evaluate the applications for
bugs?  I dont think so.  Without scrubbing the software with products
like Ounce Labs (owned by IBM),  what is the point of evaluating the
network?

Another item of great importance is a security clearance to do the
work. This is where you will get only one brand of thinking; DoD or
DoE clearance. This will prohibit the security black hat types from
ever being involved in the project without coming from the DoD or
Energy.

So you will end up with 1,000 Security Managers in the government
with Sec+, and CISSP certifications, talking to cisco, Juniper,
CheckPoint, Tipping Point, Microsoft, Oracle, Ounce Labs, etc.
security professionals at $300 an hour doing the actual work. Thats
1,000 jobs for window dressing, releasing reports that end up on
Drudge Report listing the number of breaches in Federal Government
Agencies.

When you look at the private sector protection of data standards for
items like credit cards you have real teeth in your regulations.  You
dont have to take credit cards, but if you do then you need to be PCI
compliant. Dont want to be PCI?  No problem we wont allow you to use
our credit cards. Where will that type of enforcement be with the wall
of 2,000 eyes protecting the USA?

No there wont be (this is Bob again) because governments are required
to provide services to their citizens. Even the DHS cant shut down
the government to cure a security breach, though I am beginning to
believe they havent yet figured that part out.

Im not sure there are even a handful (of experts) with any sort of
broad experience, said expert number five, who is usually associated
with security hardware. There probably are pockets of them, with
specialized narrow experience, e.g. in banking, virus or DOS attacks,
military networks, etc.. And even if there were 1,000, what would they
be doing on behalf of Uncle Sam?

Thats a great question given that we as a nation cant seem to hire
and keep a national cybersecurity czar. So what are we doing hiring
1,000 experts given there is no boss?

While it is great to have a Cybersecurity Awareness Month, whatever
that is, and it might be great to add a thousand experts to protect
our nation, if you look deeper into this story it is for the most part
BS or HS and, I fear, CS to boot.

Look, the number of CCIEs with security as a certification is 2,300
for the entire world. Subtract the 50 percent who work for cisco, then
50 percent again for those not working in the field any longer, and
you get 500 cisco CCIE Security Experts worldwide. The only way to get
another thousand in three years is by training them. But in the last
four months with 800 available seats to sit for the cisco CCIE
Security exam only one person has passed!

The DHS is extremely unlikely to be able to find and train 1,000
cybersecurity experts in three years. Maybe theyll come up with 100
(more likely 5-10), but the DHS environment will make it unlikely 
very unlikely  that all of those 100 will stick around.

Secretary Napolitano says she might not need all 1,000, which to me
says she is really looking for 3-5 people.  And frankly that ought to
be enough if they are truly experts and are both properly led and
supported (which they probably wont be).

So this is the wrong approach entirely. It wont work, the DHS
probably knows it wont work (if they dont know that, well God help
us all) but they see it as better than nothing. That doesnt worry me
so much, though. What really worries me is the point brought up by
cybersecurity expert number six, who himself came in from the cold:

Sure there are 1,000 (cybersecurity experts), he said,  but they
are already employed as hackers.