Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

3/27/2019
10:30 AM
Ira Winkler
Ira Winkler
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

The 'Twitterverse' Is Not the Security Community

The drama on social media belies the incredible role models, job, training, and networking opportunities found in the real world of traditional cybersecurity.

When you look at social media, you get the impression that there is a serious shortage in security professionals — and at the same time, you can't imagine why anyone would want to work in cybersecurity in the first place. Judging by Twitter, it seems as if security professionals are frequently at each other's throats and, with few prominent role models, it's a terrible place for women. All you have to do is look at last year's DerbyCon controversy for proof of how dysfunctional the community can appear online.

But here's a not-so-secret secret: The large majority of security professionals don't have time for the drama on social media, and social media is not representative of the profession as a whole.

The security professionals who post on Twitter frequently make valuable contributions to the security community as a whole. However, they are not representative of their million or so industry colleagues who go to work and then go back to their families and real life when work is over, and rarely get on social media.

These people don't necessarily go to hacker cons; they do their security related jobs and then leave their work in the office. They work for government agencies such as the NSA, Cyber Command, DISA, the FBI, military commands, NIST, etc. Then there are government contractors, the security teams at major banks made up of hundreds and sometimes thousands of people, professionals who work at the Big Four consulting firms with thousands of security professionals each, thousands of people who perform security work at telecommunications companies such as Verizon and AT&T, on top of the hundreds of thousands of people working in other government agencies around the world. Tech companies such as Cisco, IBM, HP, and others have thousands of employees as well. I'd guess relatively few of these people are active on social media.

The reason I want to highlight the difference is that I recently read a post from a woman on Twitter who said she saw no comparable female role models in the industry who would be making $200,000 per year. I saw one or two people mention someone, but what surprised me was the complete void in recognition of some of the most notable women in the profession — women who are not active on Twitter but active within the security community as a whole.

Quick examples who come immediately to mind include:

  • Myrna Soto, former CISO, Comcast, and now a venture capitalist
  • Renee Guttmann, CISO, Campbell Soup Company, and previously Coca-Cola, Time Warner, and Royal Caribbean
  • Dawn Cappelli, CISO, Rockwell Automation
  • Jennifer Minella, Chair, (ISC)2 Board of Directors and VP Carolina Advanced Digital,
  • Terry Grafenstine, former Chair, ISACA Board of Directors and Managing Director at Deloitte
  • Shelley Westman, Partner, EY
  • Mischel Kwon, CEO, MKACyber, and former director, US-CERT
  • Sandra Toms, General Manager, RSA Conference
  • Illena Armstrong, VP, SC Media
  • Rhonda MacLean, former CISO, Bank of America and Barclays, and board member to several cybersecurity companies
  • Dr. Chenxi Wang, venture capitalist
  • Dr. Cynthia Irvine, Distinguished Professor at the Naval Postgraduate School, who trained a generation of military cybersecurity professionals
  • Dr. Dorothy Denning, an icon of the field, who people refer to as the "Mother of Computer Security"

To be sure, women such as Katie Moussouris and Parisa Tabriz, accomplished and active in both social media and in the larger community, serve as outstanding role models. Yet even with the visibility of these prominent women, social media represents only a subset of the cyber universe. Furthermore, what people who rely solely on Twitter as their window to cybersecurity are missing is not just incredible role models, but also job opportunities, training opportunities, professional networking opportunities, and volunteer opportunities.

Don't get me wrong. I personally get a great deal out of social media, and have developed many friends who I only know through that forum. But I also remain active in the mainstream, including traditional conferences, local ISSA, (ISC)2, ISACA, Infragard chapter meetings, vendor events, and online forums associated with these groups. The bottom line is that it is to everyone's benefit that people within the hacker and traditional cybersecurity communities look beyond their own echo chambers as much as possible.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ira Winkler is president of Secure Mentem and author of Advanced Persistent Security. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
markgrogan
50%
50%
markgrogan,
User Rank: Strategist
4/18/2019 | 1:29:56 AM
Pinch of salt
Social media has always been giving people the wrong impression of so many different things on the face of this earth. Thus, I have chosen not to fully believe what is being portrayed out there in the digital realm. Read what you see online and analyze the info with a pinch of salt.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15037
PUBLISHED: 2020-07-07
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st[] parameter.
CVE-2019-4323
PUBLISHED: 2020-07-07
"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."
CVE-2019-4324
PUBLISHED: 2020-07-07
"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."
CVE-2020-15036
PUBLISHED: 2020-07-07
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Linked.php dv parameter.
CVE-2020-15577
PUBLISHED: 2020-07-07
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Cameralyzer allows attackers to write files to the SD card. The Samsung ID is SVE-2020-16830 (July 2020).