Oh, hi. Long time no blog, eh? Well, it is time to sunset this blog, I will be deleting it in the next few weeks. So long, and thanks for all the fish. Jack ..read more

Ten years, a decade, it’s a very long time, and yet passes in the blink of an eye. I joined Tenable ten years ago, and somehow they have not tired of me yet. I had known Ron Gula and Jack Huffard for a few years before I joined, we had tried to find a fit for me at Tenable a few times before, but in 2011 Astaro was being acquired and we decided that there was a good fit for me as the first person to fill the role of product manager at Tenable. In 2011 I joined a company of just over 120 people, big enough and mature enough to be stable and profitable, but small enough that it had the excitemen ..read more

 Delayed by holidays and the madness of the past month, but here it is. First, the very short summary: most of us in the security realm are pretty lucky to be where we are during the pandemic. Most of us have employers who have been at least somewhat supportive and flexible as we deal with the pandemic and its impact on our lives. Most, but not all, had positive things to report. Some have lost hours, taken pay cuts, or lost their jobs. Some work for inflexible orgs, some have had working conditions deteriorate. A link to the sanitized full data set of 216 answers is at the end of this p ..read more

 The second survey is now live, this one is an inquiry into how, and how well, employers are supporting their employees during the pandemic. Anecdotally, I've heard great things about many companies, and sadly some not great things about others. Please take a few minutes, take the survey, and share with others. Answers are anonymous, highlights and details of the results will be shared here. The survey is here ..read more

Today I'll share a few of the quotes received in the comments section of the survey. Let's start with this commentary on PhD and advanced degrees: "A PhD is a full-time job, not an extension to college/school. During my PhD I've published more papers, gotten more patents & more press coverage, and generally contributed more code, tools, and know-how to the security community then my entire relatively-routine work at my current Top 4 tech company. The distinction between getting a degree and working in the field is not that clear cut while pursuing advanced degrees Note that this is about P ..read more

As promised, here are the raw data files as of the weekend, somewhat cleaned up: Here's the .xlsx version: https://1drv.ms/x/s!ADU9TlQrSzm4h8cc And here's a .csv https://1drv.ms/u/s!ADU9TlQrSzm4h8cd If you play with the data and decide to do anything with it, please let me know so I can share it here and elsewhere. The survey is still open at https://docs.google.com/forms/d/e/1FAIpQLSfztzGL2ludN9qm7dAcOb6bjUy_Y9WCwHtJd0kg6MlSn4WAHQ/viewform, I will share more data files once the results have grown enough to be significant beyond this set of 438 respondents ..read more

Of the 61 respondents who ID as female: 89% have a degree, 11% do not. Compared to the 359 who ID as male: 72% have a degree, 28% do not. Age/degree breakdowns: Under 26, 21 respondents, 43% no degree, 57% degree 26-35, 92 respondents, 24/76% no/yes degree 36-45, 168 respondents, 27/73% no/yes degree 46-55, 121 respondents, 26/74% no/yes degree 56 and up, 34 respondents, 24/76% no/yes degree Age/gender ID breakdown: Under 26, 21/79% ID as female/male 26-35, 22/78% female/male 36-45, 14/86% female/male 46/55, 9/91% female/male 56 and up ..read more

Here are some initial demographics from the survey. Out of 416 respondents thus far (the survey is still open) results are: Age ranges: 21 are 25 and under (20% of these identify as female) 84 are 26-35 (21% female) 163 are 36-45 (14% female) 113 are 46-55 (10% female) 34 are 56 and over (36% female) Gender: 60 female 341 male 5 non-binary 6 no answer 2 other Race/Ethnicity: 2 American Indian / Alaskan Native 14 Asian 1 Asian;Caucasian / White 12 Black / African 3 Black / African;Caucasian / White 350 Caucasian / W ..read more

Let's take a quick look at some non-degree data, certifications and self study: What security certifications have you earned (current and/or lapsed)? Please add certs not listed under “Other”. Which non-security certifications have you earned (current or lapsed)? Please add certs not listed under “Other”. Have you done any of the following self-study or non-traditional training? Please use the “Other” option to add other methods. These answer say a lot about many people drawn to the security realm, we study and learn in a wide variety of ways. As the past NOC lead for a hacker con, I ..read more

Well, it says a lot of things, and as expected it answers some questions and asks more. First, thank you to everyone who completed the survey and shared it, there are over 400 responses so far and I plan on leaving it open for a few more weeks. I will hold off on sharing my interpretations and opinions, I just want to share some data for now. And yes, raw data will be available as a .CSV in coming weeks, I just want to gather more answers and sanitize it before sharing publicly. Also, thanks to Jay Jacobs of the Cyentia Institute, he has done some data visualization work on the initial data ..read more