Okay, so I can’t let this one go. I know I’m way late to the
game on this since I wasn’t able to blog about it when it happened. One of my
big takeaways from the Equifax hack is that we still have a long way to go in
the information security community in educating the public and the media about
who we are particularly as it pertains to the digital forensics and incident
response world.
What spun me up this time wasn’t the predictable
post-incident speculative blamestorming and vendor preening. I suspect most of
us have long since grown numb to self-appointed information security experts
trying to bring attention to themselves by speculating on things they don’t
have much knowledge or credibility to speak on.
What vexed me about the post-game analysis on this one was
the freak out in regards to Equifax’s Chief Security Officer having a - gasp - music degree. Not to put too fine a point on it, but
questioning someone’s qualifications in the information security world because
they don’t have a technical degree is flaming nonsense on stilts. There are tools and knowledge that we use
daily in this community that were created and taught to us by people who didn’t
have technical degrees or any college degrees at all. Some of the finest technical people I’ve
worked with didn’t have anything more than a high school degree or had college
degrees that had nothing to do with technology.
What they did have was a burning passion for information security which drove
them to become great at what they did and to contribute to the larger
community. One of the reasons why some
of these people don’t have college degrees is because they just didn’t see the
point in spending time going into crushing debt while languishing in general
elective classes on Babylonian astrology while they could be teaching themselves
skills like networking, coding, and how operating systems worked.
That isn’t to say that we haven’t gained an immense amount from people in our
community who have highly technical degrees.
People whose last names I don’t need to use such as Harlan, Lenny, and
Kristinn all have engineering degrees and we’re all the better for their
academic backgrounds and their contributions when it comes to education and
tools.
I’m all about people who are passionate about getting into
digital forensics and information security taking advantage of all of the
various academic paths and options they have available these days. With the increased demand for information
security talent, we’ve seen plenty of quality purpose built information security
degree programs in addition to the traditional degree programs in computer
science, electrical engineering, computer engineering, and the like. If you are interested in getting into fields
like information security or digital forensics, you’ve got many more options
than I ever did. You’re only limited by
your imagination and debt management.
Speaking of technical degrees, I think one of the things
that really rubbed me the wrong way on this was the lack of understanding on
what a long, hard slog a music degree is for someone to complete. I don’t think music degrees are considered
STEM degrees, but completing one tells me that your brain is formatted for
working in technology because of all of the analytical work you had to do for
the degree. I remember back in the 1990s
when employers were desperate for technical employees and hiring anyone with a
Microsoft certification. The employers
in my area figured out that music majors made for awesome technical hires and
started to actively recruit people with these degrees.
Even the United States Navy has gotten into the act. It doesn’t surprise me at all that in 2016,
they accepted
someone with a music composition degree to their highly selective Navy Nuclear
Propulsion Officer Program. This is a program
where the Navy seeks out the best and brightest people early in their college
careers to get them onto the path of joining the nuclear portion of the United
States Navy.
So, what is the take away for us? Be sullen and angry when
the media gets it wrong? Nope. We need to be happy information security
warriors and just realize when this sort of thing happens, we have to use it as
an opportunity to educate others about our community and all of the wonderful
people with diverse interests, abilities, and career paths who make it great.
