Do reformed hackers make the best IT security people?
The answer to that question varies depending on whom you ask. When The Donald based a season of The Apprentice around "Book Smarts vs. Street Smarts" he could have been talking about the security field. The debate hinges around whether reformed hackers are best qualified to protect your computer systems or whether those with formal training are better choices.
The Trends
Internet security has never been more important than it is right now. Malware is proliferating faster than a flu bug on a cruise ship. Public and private companies are experiencing so many network instructions that many are allocating substantial resources to ensure that their systems are as foolproof as possible. The Internet is now such a prevalent business tool that companies are requiring security professionals to have the same high-level security clearance that the military requires. Even Microsoft has recruited security experts to help the company address security issues.
We are also seeing trends in which backbone security specialists and software developers work hand in hand to ensure robust, 'hacker-proof" codes.
World event similarly influence the need for computer security. For example, the 2010 Vancouver Olympics is expected to attract hackers and, therefore, has created a demand for people with strong Internet backbone skill sets. ("Internet backbone" refers to the intricate system of wiring, switches and routers, etc.)
These trends have created a burgeoning field of security professionals. "It's not just about viruses or spam anymore," said Marie-Helen Sakowski, the managing director of Effective Placement, a corporate-recruiting company for the technology industry. "We are concerned with nasties that haven't yet been given names." Sakowski predicts that the security field will continue to grow in the foreseeable future, and that emerging issues will include security for cell phones, PDAs, and other Internet-enabled devices. "Today's security analyst has to look at technology not as it is currently, but where the technology is going in five to ten years," she comments. "The security field is being turned on its ear."
Book Smarts vs. Street Smarts
Calvin H. Woosnam is a high-tech security consultant. His resume includes such impressive feats as designing the B1 secure network - a network that he says is "one step above the red telephone on the president's desk." Woodsman warns that many self-proclaimed "security professionals" have minimal training and are providing inadequate protection - sometimes recommending a solution that is 1 percent better than a common phone line. "When somebody tells me they use a virtual private network to provide secure communications to a home or business, my answer is, 'Only from a novice hacker. Not from a serious hacker."
Employers contract with Woosnam to help recruit and screen their security people. His expectations are high. Reformed hackers are unlikely to hear, 'You're hired!" The security pro explains that hackers have found ways to break into systems, but security people must be able to identify and repair vulnerabilities before hacking occurs. The latter requires a more ink-depth knowledge. Reformed hackers often discover that they lack the full range of skills needed to work in the security field, and end up returning to school to flesh out their skill sets. "Education allows you to look beyond what is already known, by opening the potential of what can be," says Woosnam.
However, practical experience is also crucial. Many systems administrators are largely self-taught, but the self-taught person may encounter career roadblocks. Conversely, those with degrees in computer science may face roadblocks if they lack hands-on experience. Individuals who combine both training and experience are in great demand, often drawing six-figure incomes.
So what about the Catch 22? How do you get the experience you need? Woosnam says it's a matter of trust, apprenticeship and luck. Expect to be hired at an entry-level position and move upward as you gain the experience and prove yourself.
The Skills Needed
According to Woosnam, the most crucial things to know are ATM technology, fiber optics and an understanding of the layers of the technologies.
ATM technology has replaced SONET (synchronous optical network) as the baking machine technology that prevents people from breaking into the system and rerouting your financial information. It is the technology used in North America's major backbones, and there is a huge need for capable people in this area. (Speaking of SONET, don't show up for an interview with Woosnam unless you understand fully the difference between SONET and Ethernet).
In the interest of preventing hacking, ATM technology training is not readily available in educational institutions. However, computer science professors have been known to share the knowledge with advanced students who have gained their trust. Upon delving into ATM technology, the student quickly discovers that this is the tip of the iceberg.
Fiber optics is the next step, and it leads to a starburst of information that shoots off in many different directions.
Describing fiber optics as the "future of telecommunications," Woosnam stresses the importance of understanding the different protocols and methodologies. He points to DWDM (dense wave division multiplexing) as an example. DWDM is an optical technology used to increase bandwidth over existing fiber-optic backbones, and sometimes to make the backbone more secure. It is basically the division of a fiber-optic line into 32, 64 or 128 different-colored lights. Each can run in any data rate and be totally separate from any other colored light - thereby multiplying the capacity of a single fiber.
With telecommunications security, you must also understand the medium sufficiently to know how easily you can detect when data has been tampered with. For example, in a B1 network, known as a Common Criteria 5 security level, the ability to tamper must be totally thwarted, rendering the information secure.
Understanding the layers of technology is the third critical thing to know when dealing with protocols like TCP/IP. The lower the layer number, the more secure the system will be. The hardware layer (i.e. the physical layer) is number one. "If you secure at a higher layer, like five or six, it can be compromised quickly by a hacker coming in at layers one through four," explained Woosnam.
It goes without saying that you need a good understanding of the various operating systems, including Linux. It may surprise some people to know that communication skills and "people' skills are also very important. Woosnam advocates taking a few psychology courses as fillers. "I have found that those with the best technical knowledge tend to have the weakest people skills," he remarked. ''But seldom does a person's genius override his ability to communicate."
An Easier Way?
But hey isn't all this too much work? Couldn't you just hack into somebody's system to show them their vulnerabilities? Wouldn't that convince them to hire you? System administrator M.P Prakash R. Lewis from North Carolina doesn't think much of that idea. He points out that while this approach might have worke3d once, it's unlikely to work against today's well-protected systems. "A good security admin rarely leaves any weaknesses," he points out. "And we constantly check for new potential vulnerabilities."
================================================
How to Write Business Plans, Business Proposals,
JV Contracts, Human Resource Package, More!
No-cost ebook "Beginners Guide to Ecommerce".
Business Writing by Nightcats Multimedia Productions
http://www.nightcats.com
================================================
0 comments:
Post a Comment