maybe in some fields. Cyber has dramatic skill and capabilities gaps almost anywhere I visit as a consultant. This seems to have as much to do with HR trying to hire the kitchen sink, as much as inability to recruit and retain talent. The pain is real, the gap maybe 'artificial' but it is there none-the-less.
I am not sure I care if Google has finally invented something for the public good. Because they are so fucking evil, I no longer trust them to the point that if I was dying of cancer, and they claimed to have invented the cure that I would trust them to cure me.
* Make a will.
* Pay off your credit cards.
* Get term life insurance if you have a family to support.
* Fund your 401k to the maximum.
* Fund your IRA to the maximum.
* Buy a house if you want to live in a house and can afford it.
* Put six months worth of expenses in a money-market account.
* Take whatever money is left over and invest 70% in a stock index fund and 30% in a bond fund through any discount broker and never touch it until retirement.
If any of this confuses you, or you have something special going on (retirement, college planning, tax issues), hire a fee-based financial planner, not one who charges a percentage of your portfolio.
I had a google Fi phone, and I was paying for insurance on my pixel handset. Which I used exclusively for work. I also had the 2 year warranty. That is when my phone quit making calls. (prior to this it had been knocked off of my desk, and the glass cracked on one of the corners. Google says the camera is broken, which it isn't and that is due to my abuse and that is their reason. In fact the camera is the only thing that actually works as advertised! So, I asked for a supervisor. Google then changed the warranty on my purchase to 90 days and said the repair was out of warranty. I said "wow, wtf - but no worries I pay them insurance" they would not honor it and told me I had to contact out of warranty repair - they had two options and neither would service a phone in my state...
I subsequently terminated FI, gave away my pixelbook and the(which doesn't work with the pixel2, and don't even get started about bluetooth - that doesn't work - of course that made the matching ear buds useless...) You have been warned. Google are fucking cunts. Maybe others have had different experiences, fair enough. Mine was a nightmare.
I now switched to voip because all of the major carries ATT, Tmobile, and Version (who said they required the deed to my home to start service with me???) are absolutely appalling in their treatment of customers.
Incidentally, world-wide voip has cost me $200 for the year so far (9 months, just purchased as second gig) with unlimited calling, texting. I use a different device for data - which I pipe over a VPN($ cash for VPN) from my handset to the PBX ($ for hosting) - and it works anywhere on the globe at $9/gig (golocalme for global voip data) as I regularly make overseas calls as part of my job.
So far the VPN uses the most data, but the voip is so frugal that gig lasted me 6 months without any thoughts to being frugal with calls or minutes. I don't use data otherwise with my phone and aggressively drop all data that isn't my voip app. New phone is a Nexus 5 running ubuntu touch.
Anyhow - that $200 used to be my monthly bill. Although, it was painful to have to engineer my own solution, but in the end it has been substantially more satisfying and cheaper.
Perhaps you have heard of DevSecOps? This is cyber securities version of DevOps. (also sometimes called SecDevOps and a variety of other terms).
As developers continue to move toward CI/CD (AI and ML) I believe that in the future many more Cybersecurity professionals will have to be fluent in a language as automation of detection, reaction, remediation will be required skills. And that is just for the 'testing' side of application security. Network security, has long ago had this automation with tools like Metasploit, Nmap and others which are getting chained together into very amazing automated attack platforms.
Application security is catching up. Burp & OWASP Zap in particular and expanding feature sets to include automation as a core function. You can right click an attack in Burp to get the curl command for that attack to use in automation for example. Simon, Zaps lead developer, inventor and all round great community leader, was hired by Mozilla back in 2010 precisely to continue to improve Zaps automation to be able to automate the testing of Mozilla software.
On a personal note, I recommend starting with Python - there are good books about hacking with python like "grey hat python, black hat python, violent python" that will get you started down a good path.
Of course there are many disciplines in cyber security, reverse engineering, API Testing, IoT testing, Compliance, Governance, incident response, reverse engineering malware, to name just a few. I believe Spaf said that he identified 54 unique skills in our field in a conversation we had recently. Not all of those are going to require you to program, but if you do learn to program some of the more interesting and sexy jobs in cyber open up to you.
Despite the attractiveness of a distributed web - which we already have it (you do know how it works don't you?)
And it is incredibly difficult to upgrade and patch; leaving it incredibly insecure. How many of those distributed web servers are still vulnerable to Heartbleed as just one example? We need better ideas...
It is so odd to me that the second highest budget outlay is for a system "known as healthcare" for which, I receive none, unless I pay for insurance, which also doesn't pay for anything - rather they require I pay. This same system lost 272 billion to fraud last year.
Rather than clean up the fraud and corruption - we are getting a website?!?, and fines if we don't pay an insurance company to take our money and provide no benefits.
America doesn't have a health care system it has an illness system whence you become ill they are allowed to relieve you of all of your assets and leave you to die.
Levinson DID backup his security claims by pulling the plug.
Dennis's Law: The very best security controls are practices not
products. :)
I believe the bigger problem is that people no longer know what
security is. We are indoctrinated to think it is tools and technology
if we can only find that elusive 0-day then we can be secure!
The only security is OPSEC - it has always been OPSEC. But the new
kids aboard the money-train of security don't know this. And so we
get developers turning out more and more buggy software, each a
security tool that maybe the elusive magic bullet that will save us
all. It is a Utopian dream that doesn't exist - and that is perfect if
you want to sell snake-oil! (And to be clear: I am not of the opinion that Matasano is one of the security snake-oil salesmen!)
Tools can only be useful if you know what and how to use them? And
how do we know how and what to use them for? OPSEC.
Products fail, tools fail, mistakes can and will be made - what keeps
us safe is not the products, tools and pursuit of perfection: rather it
is our detection, response and adaptation to the change. Again that is
OPSEC.
Wow, unfortunately this finally comes to Mac after I have given up on commercial software entirely, and moved back to linux and free-software fulltime.
The real answer of course is SmartOS:
* ZFS for storage virtualization
* Crossbow (dladm) for network virtualization
* Zones for virtualization and containment
* DTrace for introspection
* SMF for service management
* RBAC/BSM for auditing and role based security
yes and yes. I read it in high school, and twice again in the 25+ years since. Now reading Surfaces and Essences: Analogy as the Fuel and Fire of Thinking.
"Responsible disclosure" is just corporate marketing to brainwash security researchers into allowing corporations to eliminate any 'bad press' of their negligence to protect customer data that they vacuum up.
Are they paying you for your work? I didn't think so. No free bugs. Stop pandering to corporations who are to greedy to spend on even the most basic security systems to protect customer data because it cuts into their profits.