The entire security industry has a serious skill problem. We’re technically able, but we have no soft skills. We can’t talk to normal people at all. We can barely even talk to each other, and it’s killing our industry. Every successful industry relies on the transfer of skills from the experienced to the inexperienced. Security lacks this today.
If I asked you how you learned what you know about security, what would your answer be? In most cases you learned everything you know on your own. There was minimal learning from someone else. This has left us with an industry full of magicians, but even worse it puts us in a place where there is no way to transfer skill and knowledge from one generation to the next. Magicians don’t scale.
If we think about this in the context of how we engage non security people it’s even worse! Most non security people have no idea what security is, what security does, or even why security is important. It’s easy to laugh at the horrible security problems almost everything has today, but in reality we’re laughing at ourselves. Historically we’ve blamed everything else for this problem when in reality it’s 100% our fault.
One of the our great weaknesses is failing to get the regular people to understand security and why it’s important. This isn’t a surprise if you think about how the industry communicates. We can barely talk to each other, how can we possibly talk to someone who doesn’t know anything about security? Normal people are confused and scared, they want to do the right thing but they have no idea what that is.
The future leaders in security are going to have to be able to teach and talk to their security peers, but more importantly they will have to engage everyone else. Security is being paid attention to like never before, and yet we have nothing to say to anyone. What has changed in the last few years? If we don’t do our jobs, someone else will do them for us, and we’re not going to like the results.
Security isn’t a technical problem, technical problems are easy, security is a communication problem. Communications problems are difficult. Let’s figure out how we can fix that.
