<story><title>Ask HN: Are Cybersecurity Workers Ok?</title><text>In the last 12 months we have seen the SolarWinds hack, the Microsoft Exchange Server data breach, and since Friday, Log4j. I&amp;#x27;m reading an article on CNN about the US government&amp;#x27;s response to Log4j.&lt;p&gt;&amp;quot;Organizations are now in a race against time to figure out if they have computers running the vulnerable software that were exposed to the internet. Cybersecurity executives across government and industry are working around the clock on the issue.&amp;quot;&lt;p&gt;&amp;quot;&amp;quot;For most of the information technology world, there was no weekend,&amp;quot; Rick Holland, chief information security officer at cybersecurity firm Digital Shadows, told CNN. &amp;quot;It was just another long set of days.&amp;quot;&amp;quot;&lt;p&gt;The sysadmin subreddit is also full of professionals talking about the problem.&lt;p&gt;With so many large scale hacks, 0-days, and breaches happening these days, are cybersecurity professionals ok? Have studies about the mental health and anxiety levels of this group of professionals been conducted?</text></story><parent_chain><item><author>ransom1538</author><text>This. The only person I would trust is a person that was a sysadmin for at least 10 years and decided to specialize in security for another 5 years. So you are looking at minimum of 15 years experience to be decent. Without deep sysadmin skills - I am at a loss of what they would contribute.  You are going to update our firewall without understanding what CIDR notation is? You are going to create a VPC for the dev environment not knowing what a subnet mask is? You are going to monitor security with thousands of VMs with no cloud background? Security is a specialized specialized field. Not only that you need to be a bit of a bully. You are always fighting PMs for more time to vet things and patch things - all while being a cost center.&lt;p&gt;Why do we have so many security disasters? Because those people are rare unicorns, ridiculously expensive, with no way to show added value.</text></item><item><author>dmhmr</author><text>The past few years have made me feel sour on how many organizations run cybersecurity in general. The industry is full of individuals who do not understand the tech they are protecting, and often they barely understand the security tech they use daily. A lot of places are simply doing compliance check-marking and barely have a shred of technical aptitude. They struggle with basic fundamentals like inventory and patch management. It is an industry that is hard to stay upbeat about if you are looking at anything larger than how it benefits your personal paycheck. If you want to get insight into the reality of how the government operates, just look at GAO reports, they are alarming: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.gao.gov&amp;#x2F;highrisk&amp;#x2F;ensuring-cybersecurity-nation&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.gao.gov&amp;#x2F;highrisk&amp;#x2F;ensuring-cybersecurity-nation&lt;/a&gt;</text></item></parent_chain><comment><author>vsareto</author><text>If it takes 15 years to teach someone only to a decent level, the industry needs to start laying out plans for effective training and credentialing. The solution here is not higher years required, but more effective teaching. Learning on the job is practical, but not efficient, one example being you spend time dealing with org issues rather than learning something technical.&lt;p&gt;I don&amp;#x27;t agree that it takes 15 years though. I think you&amp;#x27;re setting the standards way too high for no good reason, especially for &amp;quot;decent&amp;quot;.</text></comment>
<story><title>Ask HN: Are Cybersecurity Workers Ok?</title><text>In the last 12 months we have seen the SolarWinds hack, the Microsoft Exchange Server data breach, and since Friday, Log4j. I&amp;#x27;m reading an article on CNN about the US government&amp;#x27;s response to Log4j.&lt;p&gt;&amp;quot;Organizations are now in a race against time to figure out if they have computers running the vulnerable software that were exposed to the internet. Cybersecurity executives across government and industry are working around the clock on the issue.&amp;quot;&lt;p&gt;&amp;quot;&amp;quot;For most of the information technology world, there was no weekend,&amp;quot; Rick Holland, chief information security officer at cybersecurity firm Digital Shadows, told CNN. &amp;quot;It was just another long set of days.&amp;quot;&amp;quot;&lt;p&gt;The sysadmin subreddit is also full of professionals talking about the problem.&lt;p&gt;With so many large scale hacks, 0-days, and breaches happening these days, are cybersecurity professionals ok? Have studies about the mental health and anxiety levels of this group of professionals been conducted?</text></story><parent_chain><item><author>ransom1538</author><text>This. The only person I would trust is a person that was a sysadmin for at least 10 years and decided to specialize in security for another 5 years. So you are looking at minimum of 15 years experience to be decent. Without deep sysadmin skills - I am at a loss of what they would contribute.  You are going to update our firewall without understanding what CIDR notation is? You are going to create a VPC for the dev environment not knowing what a subnet mask is? You are going to monitor security with thousands of VMs with no cloud background? Security is a specialized specialized field. Not only that you need to be a bit of a bully. You are always fighting PMs for more time to vet things and patch things - all while being a cost center.&lt;p&gt;Why do we have so many security disasters? Because those people are rare unicorns, ridiculously expensive, with no way to show added value.</text></item><item><author>dmhmr</author><text>The past few years have made me feel sour on how many organizations run cybersecurity in general. The industry is full of individuals who do not understand the tech they are protecting, and often they barely understand the security tech they use daily. A lot of places are simply doing compliance check-marking and barely have a shred of technical aptitude. They struggle with basic fundamentals like inventory and patch management. It is an industry that is hard to stay upbeat about if you are looking at anything larger than how it benefits your personal paycheck. If you want to get insight into the reality of how the government operates, just look at GAO reports, they are alarming: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.gao.gov&amp;#x2F;highrisk&amp;#x2F;ensuring-cybersecurity-nation&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.gao.gov&amp;#x2F;highrisk&amp;#x2F;ensuring-cybersecurity-nation&lt;/a&gt;</text></item></parent_chain><comment><author>mistrial9</author><text>you are utterly missing a business dynamic here in America and elsewhere.. Companies that originate in, with strong-ties to, established finance, literally push skill down the pay stack, not up. What does that mean?  If a certain engineering skill is rare, it will cost more money to pay someone, and harder to find. Therefore, commoditize and automate where you can, via cloud accounts and &amp;quot;best practices&amp;quot;, outsource to another company where you can, and promote internally for ruthless cost-cutting, firing and aggressive contract manipulations. This is not extreme, this is normal and daily for decades.&lt;p&gt;The imaginary skilled professional you are describing clearly originates in the mind of an engineering worker.. a person gains skill through experience and is promoted. This is opposite of what management builds over time.. Management specifically and exactly destroys this career path because it costs them more money. As long as you can commoditize and outsource, you drive costs down, not up.&lt;p&gt;Meanwhile, it is &amp;quot;eternal September&amp;quot; in the job world, with streams of 20-somethings lining up to get into the markets. Add lower cost engineers, for example in Eastern Europe, South East Asia and South Asia. Rinse and repeat.</text></comment>