With OpenSec 2017 ten days away, we are catching up with a few of this year’s panelists to hear the breadth of opinions surrounding the current state of open source cybersecurity, and where it is heading.
This week we spoke with Craig Chamberlain, Director of Security at Cogito. Craig is well known in the security space, working as a security consultant for various financial, defense, and government entities, as well as publishing security research.
To hear more from Craig and other leaders in the open source community, sign up for OpenSec 2017 on May 15th.
Craig Chamberlain of @randomuserid
What aspects of cyber security got you interested in the space? How did you get your start?
I remember being on a tour of MIT once and hearing them describe how they had to disconnect the student grade tracking system because it was impossible to keep the students out of it. I remember thinking, they have one of the world's best collections of computer science knowledge and talent and they can't keep the students from hacking the grade system? I was sort of fascinated. Later I had more under-fire experience running Internet facing servers through the 2000 - 2005 period when the world experienced a series of historic security fire drills. The changing and adversarial nature of the problem set pulled me in. I went on to help build some security products and had amazing experiences along the way.
What advice would you have for people moving into or up in the Cybersecurity space?
Look for employers willing to invest in training and continuous education that is important to building skills and being successful. Share research; give talks at conferences and participate in the community. To quote Yoda, "Mind what you have learned. Save you it can. Pass on what you have learned.."
Once you get established, and feel comfortable mentoring, start looking for team members who show interest in, or aptitude for, security. Nurture this. Take them to conferences and meetups with you and hep them get started in security. The cost / benefit curve of building talent, rather then buying, is astronomical. Growing talent will become more and more strategic as talent inflation worsens.
What are some products or solution spaces you're watching and excited to see grow?
At the moment everything revolves around data science and machine learning. One practical application for these technologies I'd like to see is the application of graph analysis and entity-relationship based anomaly detection for threat hunting and intrusion detection; I'm working on a blog post to elaborate on how I would use this.
Where do you see cybersecurity going in the next 5-10 years?
Probably a shift towards automation and algorithmic security management and incident response tooling. The problem of talent inflation has become acute as threats evolve and proliferate. Throwing people at the problems isn't working due to scarcity and what I call "inflation fatigue" among business leaders.
Why do you think open source can make a huge impact on security?
Many security product companies are too focused on simple sales cycles in order to quickly build valuations. Product road maps are too often dominated by marketing managers who are either unwilling or unable to build really compelling and useful features and capabilities. Open source products allow well-resourced security teams to groom and customize tooling to meet sophisticated workflows and increase velocity in the process.
Interested in hearing Craig expand on his thoughts? Hear him and other Opensource security experts talk at OpenSec 2017!