An Information Security Place

A while back I tweeted about my acceptance of the Security Technology Advocate role at Accuvant.

To be clear, I am not going to be fully transitioned into the role until Jan 1, 2012. But I have been doing some work in the new gig, and I have already experienced a lot of changes on how I approach security and how I view my chosen profession. Let me ‘splain.

So part of my new role entails evangelizing Accuvant to the world. And one of the ways I will do that is to create content for the world to see, meaning blog posts, podcasts, webcasts, etc. And the best thing about creating that content is that I have a near endless source of expertise from Accuvant. We have l33t peeps from all angles of InfoSec, including security research, risk, compliance, network and web app pen testing, security technologies, secure infrastructure, development, and on and on (you can go view some of this material at http://www.accuvant.com/results/podcasts – forgive the shakiness please).

And while this is rewarding, it is also giving me a way of looking at InfoSec that I never have had before. What I mean by that is that I have almost always been an active part of InfoSec. I have either been a security consultant, engineer, or manager. I have had to delve into the world because I was immersed in it by necessity. I was looking for ways to improve my security or the security of others. I was looking for solutions to problems that plagued me or others. And while that entailed often talking to experts, be they from Accuvant or somewhere else, I was usually viewing their input as directly related to fixing something that was broken. And while I have interviewed a few folks over the years for the podcast or blog, I still was thinking of how their answers applied to issues with which I was dealing.

But now, for the first time, I am not always talking to security experts for the direct purpose of solving a problem (well, I am solving the problem of needing content to perform the duties of my job, but you get where I am coming from hopefully). I am talking to them to get opinions on topics that are relevant to the topic of security in order to solve the problems of others with whom I do not have a direct relation. Does that make sense?

Let me use Charlie Miller as an example (cuz he’s famous and stuff). I interviewed Dr. Miller a few months back at DerbyCon. It was a fun interview comparing IOS and Android security, and I approached it as one security professional talking to another security professional. But at the same time, it struck me that I was not really talking to Charlie as a fellow security professional in the traditional sense. I was not getting information from Charlie to take back to a client. I was simply performing an information gathering task for the purposes of indirectly giving other folks information. I was not going to directly take that data and apply it to a problem on which a client or I were working. I was going to let others do that. I was now becoming an “information broker” of sorts (most of what I have read defines “information broker” as someone who finds and provides analysis of the information, which I have not really done to this point).

I am not sure if the impact of this is coming out in this article. It is kind of difficult to define this feeling if you the reader have not been there (or maybe it isn’t difficult to define and you are nodding your head an saying “dang, this guy writing down some awesome thoughts here – I wish I could be that awesome”). And I know that Brian Kerbs, Bill Brenner, and folks like them that do this all the time (albeit much better than I), will be expressing a collective “duh”. But it really has made a difference in how I see the industry, even in just a short period of time.

Honestly, though I say it has affected how I view the industry, I really don’t have a grip on what those effects will be yet. I don’t know what this will do to my career. I sincerely do not want to move out of being an information security professional, so I will do my best to keep up my skills to some degree. And I don’t know how this will affect how I approach problems in the future, or how I will interact with people who ask my advice on security issues. I mentioned two of the top journalists in the InfoSec field above. To the best of my knowledge, neither of them were security practitioners before they started covering InfoSec (that is not meant to be a knock on either of those gentlemen – both have my highest respect). So it makes me wonder how that will affect my approach.

Will it make me ensure that those experts I interview know of my experience before we talk? In the past, I experienced disdain from “experts” during interviews when I was wearing a press badge at a conference. I wanted deeper insight, so I asked very technical questions that they were not used to getting from journalists, and that made them change the way they looked at me pretty quickly (and prompted a couple of “who are you” kind of questions).

I’m just not sure yet. But however I move forward, I am excited about the change.