Mamas, don't let your babies grow up to be cowboys,
Don't let 'em pick guitars or drive them old trucks,
Let 'em be doctors and lawyers and such.
During my recent trip to Las Vegas for Black Hat I once again heard a lot of frustration from my fellow InfoSec people about the challenges of security incidents that seem to scream from our headlines every day. For a certain segment of the industry it seems like a thankless, no-win job. I began to ask my colleagues if, in spite of all these challenges, they would want their children to follow in their footsteps with a career in Information Security. The answers I received may surprise you.
Despite our frustration, it is evident that many information security pros take great pride in fighting the good fight and keeping the bad guys out. From their answers, you can garner the feeling that security gives people to stretch their brains, do something that helps society as a whole, and is a noble, well-paying and in-demand career.
Some of this is best expressed by Joe White, who said "Above all else, I think a career in infosec teaches the value of integrity and doing the right thing. I am not talking about the basterdized version of integrity that comes from signing a piece of paper that says you will always do things a certain way. What I am talking about is closer to the words Uncle Ben told Peter Parker, 'with great power comes great responsibility.'"
In other words, doing the right thing *independent* of external influences. A corporation may pay my salary, but I will always fight for doing the right thing to protect the end user.
But there is more:
My friend Erin "SecBarbie" Jacobs laments the fact that "The industry seemed to self-police itself and have a lot more 'proving' yourself a few years ago. I miss that. I feel that currently we are turning into a happy-fuzzy, everyone should be your friend industry of mediocrity."
My buddy Eric Irvin is worried that InfoSec people are too cynical about everything. He says, "I don't want my children to become as cynical as we are."
Another InfoSec friend, Martin Fisher, is worried about the sexism that his daughter could face in the industry. "I would want her to work in the field provided she understood (and knew how to deal with) the sexism that pervades the field," he says. "I'd want her to walk in knowing that she has to prove herself every day. I'd also hope that she'd be committed to helping change it."
Another view expressed by a few people but best said by my friend Tom Stamulis is this:
"I think your first question should be whether Infosec will be a standalone industry in 10 years. I am not sure if it will be or if it will be absorbed and become an element of another. It is not enough to be good technically and in order for this industry to flourish its members will require business skills as well as technical/security skills. A paradigm shift is necessary in order to make it appealing to the younger generation beyond wearing black t-shirts and breaking things."
Will InfoSec be absorbed into general IT? Could elements of it be part of the crime-fighting infrastructure, as my friend Gal Shpantzer thinks?
Overall, like most parents everywhere, my friends in InfoSec want their kids to do what makes them happy and is worthwhile. My buddy Mike Rothman of Securosis says of his kids going into InfoSec, "as long as they are passionate about it, I'd be supportive. Of course, I'd be able to paint a very candid picture of what life in the security trenches is all about (and I would). If that doesn't scare them off, and they show both competence and passion - I think it's a great field."
Mikes's partner at Securosis Rich Mogull perhaps said it best:
"I want them to work in whatever field sparks their interest, and provides them the intellectual and financial satisfaction I hope they deserve as they mature. Security is an amazing field, and I will certainly encourage them in the best ways I can if that's what they choose, but it was also my choice, and not yet theirs. But it's hard to knock a field that is both central to the functioning of society, and provides intense intellectual stimulation that constantly changes.
What about you? Would you want your son or daughter to follow you into your field? That is perhaps the most telling question of how your view yourself, your career, and what you do.