My professional opinion

I read about a study not done too long ago that said that information security is not really a profession.  Much of their findings had to do with lack of consistency in skills and ongoing education.  At first when I read it, I was mad.  I consider myself an infosec professional, as many of us do.  Heck, we pretty much bleed this profession.  So when someone insults what we've dedicated our lives to, well, it smarts.

But then I started to think about my past and my present.  My career didn't exactly set a standard path of any sort: graduated college a finance major, worked in that field for several years, switched to being a system administrator for many years, then dove into security in various aspects.  When I started down the security road, there was no street signs, no pavement and certainly no lines painted on the road.

Since then, I've taken lots of good training, both technical and leadership focused.  But again, there really aren't standard career path training for techies or leaders in our field.

And now I look at the present.  I am studying for a certification that basically lays out how I should do my job (and no I won't say which one).  Don't get me wrong, this is a very good cert.  But, each page I turn in the book makes me feel overwhelmed.  I mean, if we are destined to take over that much responsibility as infosec leaders then I fear we will continue to fail and not make this the profession that it should be.

I don't have an easy answer for this (I just don't think there is one).  But, I do think there are some things we can do to improve the situation:

1) Set realistic and value-add security programs in our organizations.  If we provide value and can show this by visibly reducing risk, then we will continue to be a partner for business.

2) Help set career paths for our teams.  Its the rare team member who understands what they want and how they want to get there.  Help them define the path and help them get through it.

3) Improve yourself.  If you haven't gotten a cert or taken a class this year yet?  If not, plan to do so soon.

Think about what you can do to to help support our cause and make our profession better- and then do it!  If we don't take action and force improvements, then we all fail together.  What are your thoughts on how to do this?