Today is the deadline for RSA speaker submissions, so the entire team was scrambling to get our presentation topics submitted before the server crash late rush. One of the things that struck me about the submission suggestions is that general topics are discouraged. RSA notes in the submission guidelines that 60% of the attendees have 10 or more years of security experience. I think the idea is that, if your audience is more advanced, introductory or general audience presentations don’t hold the audience’s attention so intermediate and advanced sessions are encouraged. And I bet they are right about that, given the success of other venues like BlackHat, Defcon, and Security B-Sides. Still, I wonder if that is the right course of action. Has security become a private club? Are we so caught up in the security ‘echo chamber’ we forget about the mid-market folks without the luxury of full-time security experts on staff? Perhaps security just is not very interesting without some novel new hack. Regardless, it seems like it’s the same group of us, year after year, talking about the same set of issues and problems.
From my perspective software developers are the weakest link in the security chain. Most coders don’t have 10 years of security experience. Heck, they don’t have two! Only a handful of people I know have been involved in secure code development practices for 10 years or more. But developers coming up to speed with security is one of the biggest wins, and advanced security topics may not be inaccessible to them. The balancing act between cutting-edge security discussions that keep researchers up to date, versus educating the people who can benefit most, is at issue.
I was thinking about this during our offsite this week while Rich and Mike talked about having their kids trained in martial arts when they are old enough. They were talking about how they want the kids to be able to protect themselves when necessary. They were discussing likely scenarios and what art forms they felt would be most useful for, well, not getting their asses kicked. And they also want the kids to derive many of the same secondary benefits of respect, commitment, confidence, and attention to detail many of us unwittingly gained when our parents sent us to martial arts classes. As the two were talking about their kids’ basic introduction to personal security, it dawned on me that this is really the same issue for developers. Not to be condescending and equate coders to children, but what was bugging me was the focus on the leaders in the security space at the expense of opening up the profession to a wider audience. Basic education on security skills doesn’t just help build up a specific area of education every developer needs – the entire approach to secure code development makes for better programmers. It reinforces the basic development processes we are taught to go through in a meaningful way.
I am not entirely sure what the ‘right’ answer is, but RSA is the biggest security conference, and application developers seem to be a very large potential audience that would greatly benefit from basic exposure to general issues and techniques. Secure code development practices and tools are, and hopefully will remain for the foreseeable future, a major category for growth in security awareness and training. Knowledge of these tools, processes, and techniques makes for better code.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Rich and Adrian in Essentials Guide to Data Protection.
- Rich on Top Three Steps to Simplify DLP without Compromise.
- Rich quoted at Dark Reading on University Data Breaches.
Favorite Securosis Posts
- Adrian Lane: School’s out for Summer.
- Mike Rothman: Incite 7/7/2010: The Mailbox Vigil. Normally I don’t toot my own horn, but this was a good deal of analysis. Fairly balanced and sufficiently snarky…
- David Mortman: School’s out for Summer.
- Rich: Understanding and Selecting SIEM/LM: Selection Process.
Other Securosis Posts
- Uh, not so much.
Favorite Outside Posts
- Adrian Lane: Atlanta Has Dubious Honor of Highest Malware Infection Rate. This was probably not meant to be humorous, but the map of giant bugs just cracked me up. Does this help anyone?
- Rich: Top Apps Largely Forgo Windows Security Protections. There is more to vulnerability than the operating system. We can only hope these apps get on board with tactics that will make them (and us) harder to pwn.
- Mike Rothman: RiskIT – Does ISACA Suffer from Dunning-Kruger?. Hutton is at it again, poking at another silly risk management certification. I’m looking forward to my “Apparently OK” Risk Certificate arriving any day now.
- Pepper: HSBC mailing activated debit cards. And to make it better, they didn’t agree that this is a serious problem.
- David Mortman: The New Distribution of The 3-Tiered Architecture Changes Everything.
Project Quant Posts
- DB Quant: Protect Metrics, Part 2, Patch Management.
- DB Quant: Manage Metrics, Part 1, Configuration Management.
- DB Quant: Protection Metrics, Part 4, Web Application Firewalls.
Research Reports and Presentations
- White Paper: Endpoint Security Fundamentals.
- Understanding and Selecting a Database Encryption or Tokenization Solution.
- Low Hanging Fruit: Quick Wins with Data Loss Prevention.
Top News and Posts
- Regional Trojan Threat Targeting Online Banks.
- Is Breaking a CAPTCHA a crime?
- A little more on Cyberwar.
Blog Comment of the Week
This week’s winner is … no one. We had a strong case of ‘blog post fail’ so I guess we cannot expect comments.
Reader interactions
2 Replies to “Friday Summary: July 9, 2010”
I agree with your comments regarding RSA presentations. In addition to training inexperience security professionals, another compelling reason for introductory sessions is to ensure the growth of the security industry. Without new, enthusiastic recruits we will eventually lose talent due to attrition. As an added bonus, fresh minds bring new ideas – dare I say, innovation.
Maybe that’s what we need — a “Developer Martial Arts” class! It would sound so much more enticing, so cool, so … Rugged. 😉