What I am Reading 2/28/2020 - China Again and The Security Skills Shortage is BS

Books -

Network Forensics Tracking Hackers Through Cyberspace

Wired for War: The Robotics Revolution and Conflict in the 21st Century

The Ten-Day MBA 4th Ed.: A Step-By-Step Guide To Mastering The Skills Taught In America's Top Business Schools

Blogs / News - 

Hot Air - First Female Set To Qualify As An Army Green Beret -

As with all special operators, the military does not release names or identification. But the woman is expected to graduate soon from the rugged, roughly year-long qualification course and become a Special Forces engineer sergeant. Another woman is also making her way through the demanding yearlong course.

Dark Reading - What Your Company Needs to Know About Hardware Supply Chain Security -

Information security programs typically focus on managing software patches and keeping anti-malware engines and network security gear up to date. As a result, hardware components are often deprioritized, even though they are also vulnerable to advanced attackers and nation-state threats. The manipulation of physical components during building stages or transportation routes is a threat to all physical products. Faulty parts cause recalls, and when the part is relied on by global systems and contains sensitive data, the scale of the potential carnage becomes exponential. Successfully attacking firmware can create a vulnerability that attackers covet because, unlike most software-based attacks that can be fixed by resetting a device back to default, many hardware attacks can survive firmware reflashing or operating system reinstallations.

 Tech Crunch - Senate passes ‘rip and replace’ bill to remove old Huawei and ZTE equipment from networks -

“Telecommunications equipment from certain foreign adversaries poses a significant threat to our national security, economic prosperity, and the future of U.S. leadership in advanced wireless technology,” Sen. Roger Wicker of Mississippi said of the bipartisan bill in a statement. “By establishing a ‘rip and replace’ program, this legislation will provide meaningful safeguards for our communications networks and more secure connections for Americans. I thank my colleagues on both sides of the aisle for coming together to help move this bill to the President’s desk.”

 The Verge - Unions are pushing the FTC to investigate Amazon for anti-competitive practices -

A coalition of some of the largest labor unions in the US have formally petitioned the Federal Trade Commission to investigate Amazon for anticompetitive practices. The petition, filed Thursday, is a 28-page document with nearly 150 footnotes, and it asks the FTC to conduct a study exploring Amazon’s effects on the economy and whether the structure of its sprawling empire gives it unfair advantages in the marketplace. 

 Dark Reading - Tense Talk About Supply Chain Risk Yields Few Answers -

 San Francisco -A tense discussion over supply chain risk management at this year's RSA Conference highlighted ongoing questions, but offered few conclusions, around how the nation can ensure the safety of foreign-made tech products used by the US government in critical infrastructure.

 FoxNews - Chinese destroyer aims laser at US Navy plane in 'unsafe' manner, military says -

A People’s Republic of China (PRC) navy destroyer 161 on Feb. 17 aimed a laser at a U.S. Navy P-8A Poseidon maritime patrol aircraft while it flying above international waters, according to the U.S. Pacific Fleet.

 AP - Justice Dept. charges professor with hiding ties to China -

A professor at the University of Tennessee has been arrested on charges that he hid his relationship with a Chinese university while receiving research grants from the federal government, the Justice Department said Thursday.

Anming Hu, an associate professor in the department of mechanical, aerospace and biomedical engineering at the university’s flagship Knoxville campus, was charged with three counts of wire fraud and three counts of making false statements.

Strangenotions.com - Galileo was Right—But So Were His Critics -

CARL OLSON: The story of the heliocentric debate, you conclude later in the book (p. 145), “does not look so much like a morality play about brave reason and villainous superstition, about ‘science vs. religion,’ as it looks like a battle between two scientific theories, about ‘science vs. science,’ with a little ‘religion vs. religion’ thrown in as well.” Are you optimistic that your book will significantly change the common historical view of the Copernican Revolution? Or popular perceptions concerning the incompatibility of Christianity and science? How do you expect the book to be received?

Graney: Historians of science have been saying for a while now that the heliocentric debate was not like the common or popular perception of it, but that perception still sticks around. Everyone likes a “good guy/bad guy” story more than a story about the scientific process at work! So I’m not expecting much there, unless it comes from the science world, which has been very receptive to Riccioli and the star size problem.

Al Jazeera - Dark fishing: Greenpeace investigation uncovers illegal activity -

It is estimated one in five fish brought to markets is illegally caught, often by a so-called “dark” fishing fleet.

Security Boulevard - Is the Security Skills Shortage Overblown? -

(A) recent article in Venture Beat about the skills shortage caught my eye. It was written by Fredrick “Flee” Lee, the CISO of Gusto, a platform for payroll and benefits administration. Titled “Calling BS on the security skills shortage,” in it he argues the skills shortage is not about an actual lack of people who can do security work; rather, it is being felt by hiring managers all over the globe because the process of hiring in security is broken. Lee argues everything from the interview process to the attitude of hiring managers and the industry as a whole needs to be overhauled.

Venture Beat -  Calling BS on the security skills shortage -

Cybersecurity isn’t sorcery. Security-specific skills can be taught. We need to do away with narrow criteria for who will be a good fit for many security roles and shift the way we evaluate resumes so that we look critically at what a candidate is capable or doing instead of looking solely at what they’ve already done. Too often, we look externally for certain skill sets to be filled before a candidate gets to us, either via degrees, certifications, or completed coursework. But the pool of talent that already has those skills is too small. To create the talent supply to fill demand, we need to reach talent that has the aptitude and ability to learn and apply the necessary skills for the job. That means organizations need to get creative and develop their own learning and development initiatives for skill-building, whether it’s a large-scale training initiative aimed at career changers, or something as simple as hosting workshops, meetups, lunch-and-learns, or informational office hours.

I've argued for a long time that the security skills shortage is more a function of poor hiring practices and  a lack of investment investment in people rather than an an actual lack of talent.  I even came up with a basic Cybersecurity Engineering training program, to help get internal hires up to speed, and submitted it to my bass and his boss and never heard a word back.