(executive MBA class of 2019) • BS Electrical Engineering • CISSP • Information Systems Security Manager • Electronics Hobbyist (love to solder) • DC801 badge maker DC24-26 • Always learning • Open to new opportunities to grow
using it with Cybersecurity? • Why Cybersecurity should be more like Systems Engineering? • How Management can help make Cybersecurity successful • Why Cybersecurity should be separated from IT • Why education is important to Cybersecurity • Questions • References
WITH CYBERSECURITY? • NIST References: • Special Publication 800-160: Systems Security Engineering: Consideration for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems (Volume 1 and 2) • Special Publication 800-53 revision 5 (draft)
WITH CYBERSECURITY? • Systems Engineering takes the full life-cycle into view when making decisions • Cybersecurity needs to be in the full life-cycle of a system • Cradle to grave approach to projects/programs • Embedded into the program process • Cybersecurity needs to take a higher view of things early in the life- cycle
experts should have a broader based education • Helps the field grow in thinking outside the box • Helps Research & Development • Moves the profession forward as ideas become standards
needs to be able to view full picture (10 thousand foot) • Full picture view for incorporation • Collaboration between policy setters • Cybersecurity experts like systems engineers need to look at problems in their entirety • Systems engineering “concentrates on the design and applications of the whole as distinct from the parts … looking at a problem in its entirely, taking into account all the facets and all the variables and relating the social to the technical.” (attributed to Simon Ramo, 1973)
not be under the IT management • Cybersecurity should have requirement direction for hardware/software • Managers should have an understanding of Cybersecurity • Be trained with breadth of the basics • Software • Hardware • Vulnerabilities • Know what is required to fulfill the mission of the group/team • Lead change in the organization
Cybersecurity should be funded appropriately • Staffing • Training • Tools/Equipment • Manage diverse teams • Tailor Business requirements into functional security requirements • Risk Management Framework (RMF) • PCI DSS • Remove obstacles to success
to IT as Engineering is to Technicians • Different way of learning • Defines roles more appropriately • Without a career path the field will stay cyclical • Cybersecurity should focus on improving requirements and policies
by making hard things easy • Engineer yourself out of a job • Make the complex easy • Standardize practices so it is common in the field • Information needs to be shared and vetted in the industry • Cybersecurity is a maturing field • It is saturated with too many duplicate credentials • Career fields are solidifying • Standards are being established • Expanding Cybersecurity Breadth in an organization • Allows better cross vulnerability protection • Integration of security in all key areas
ask yourself on education: • Will a degree help advance my career? • Is the institution accredited by the right organizations? • Will experience be able to replace a degree for future opportunities? • Some questions to ask yourself on certifications: • Is the certification accredited? • Do I already have a higher or equivalent certificate? • Required to have to perform the work you want to do?
than a piece of paper when properly obtained • Degrees provide a willingness to learn and a base to grow from • Engineering degrees are accredited by ABET • Cybersecurity degrees have limited ABET accreditation • Accreditation allows students and employers know what they are getting • Provides a way for licensing • Good for the upcoming generation • Degrees are preferred for positions past mid-career level
a base and do not fully show what a person knows • Human Resources • Not ideal but makes filtering easy • Helps in entry level positions • Move hiring for fit over a show of skills • On the job training is still important • Continual professional education (CPE) is required to maintain expertise • Certifications provide justification for CPE • Membership into organizations
but are they appropriate for what is needed • (ISC)2, SANS, CompTIA, Offensive Security, etc. all play a game to make certification viable • Stop gap in a field with no standard in education • Industry is moving towards standards • DoD has put some order to the certifications to position (DoD 8140 M when released) • Built from many IT related certifications to show competence • IT certifications are less about theory • IT was an easy basis to start with • New certifications are looking more like academic certificates for post graduate study in computer science
then one certification important? • Should only show highest certification not all you passed • Too many providers with no standardization for similar level certification • Limited transferability between certifying ogranizations • Teamed with a degree can provide legality to a field • Professional Engineer (PE) in many fields of engineering • Most applicable to Cybersecurity fields where insurance and liability are at stake (i.e. Forensics)
terapyon
persolserverworks
gionn
rfdnxbro
bitkey
willnet
shuta13
grimoh
shumei_ito
kworkdev
carta_engineering
maimyyym
colly
sergeychernyshev
skipperchong
keavy
uxyall
ks91
codingconduct
frankvandijk
brad_frost
tessaabrams
axbom
reverentgeek
