My professional opinion

I read about a study not done too long ago that said that information security is not really a profession.  Much of their findings had to do with lack of consistency in skills and ongoing education.  At first when I read it, I was mad.  I consider myself an infosec professional, as many of us do.  Heck, we pretty much bleed this profession.  So when someone insults what we've dedicated our lives to, well, it smarts.

But then I started to think about my past and my present.  My career didn't exactly set a standard path of any sort: graduated college a finance major, worked in that field for several years, switched to being a system administrator for many years, then dove into security in various aspects.  When I started down the security road, there was no street signs, no pavement and certainly no lines painted on the road.

Since then, I've taken lots of good training, both technical and leadership focused.  But again, there really aren't standard career path training for techies or leaders in our field.

And now I look at the present.  I am studying for a certification that basically lays out how I should do my job (and no I won't say which one).  Don't get me wrong, this is a very good cert.  But, each page I turn in the book makes me feel overwhelmed.  I mean, if we are destined to take over that much responsibility as infosec leaders then I fear we will continue to fail and not make this the profession that it should be.

I don't have an easy answer for this (I just don't think there is one).  But, I do think there are some things we can do to improve the situation:

1) Set realistic and value-add security programs in our organizations.  If we provide value and can show this by visibly reducing risk, then we will continue to be a partner for business.

2) Help set career paths for our teams.  Its the rare team member who understands what they want and how they want to get there.  Help them define the path and help them get through it.

3) Improve yourself.  If you haven't gotten a cert or taken a class this year yet?  If not, plan to do so soon.

Think about what you can do to to help support our cause and make our profession better- and then do it!  If we don't take action and force improvements, then we all fail together.  What are your thoughts on how to do this?

Why so serious?

Let's face it: we as Infosec professionals are a pretty serious bunch.  We have the serious wrinkles marking up our faces and the gray hair to accompany it.  We throw around terms like threat, risk, vulnerability, acceptable loss and mitigation like candy at a parade.  We joke about starting comedy shows when we retire because you just can't make this stuff up.

We have to be serious, or we won't get taken seriously.

I had a weird thing happen to me though: The other day, I started on a project that brought me a feeling I wasn't wholly familiar with.  My head felt a little light, my fingers typed madly (one might say with passion), I had energy surging throughout my body and I had this odd thing across my face.  It was a smile.

We have to remember that not only do we have to laugh once and a while, but we need to enjoy what we do (and yes, the above incident actually happened while working, although I am not sure anyone witnessed it.)

If you aren't having fun doing your job, then you are going to make everyone else miserable too.  That's just human nature.

No, I am not telling you to chuck it all and run wild through the streets.  I want you to stay in the fight and do good work!  I am simply saying that sometimes, we have to work at finding a little joy in our day.  Here are a couple of thoughts:

1) Did your security awareness program generate an unexpected incident report (e.g . did the light bulb go off from a tough customer?)

2) Did you win a risk mitigation argument with someone for the better of the organization by actually convincing that someone it was the right thing to do?

3) Did you have a smart, interesting debate with someone about a challenging issue, and you worked it out together?

3) Did you learn something?

Or maybe you just visit http://icanhas.cheezburger.com/lolcats? once a day to put a smile on your face.  Whatever it takes: commiserating with peers, going home on time to spend time with your family or telling jokes, do something that lightens your mood.  Having fun on the job with a positive attitude does wonders and has interesting side-effects.  Did I just catch you smiling right now as you read this?