Welcome!

Agile Computing Authors: Elizabeth White, Yeshim Deniz, Pat Romanski, Liz McMillan, Larry Alton

Blog Feed Post

Five Ways to Hire an InfoSec Consultant

Five Ways to Hire an InfoSec Consultant
By: Bill Mathews

This is not a nice post. This is not a post about posing great interview questions or how to tell if someone can actually do the job. No, this is a post about how to watch out for people you want to hire to help your company. You know the ones – the con-sultants, the slick ones, the rockstars, the ones you should fear. Some of these guys can be worse than the actual bad guys and here are five things to look for when you’re trying to spot them.

1) Shortcuts?

Are they promising you the world? One thing about information security that you should know upfront: there are absolutely no magic bullets. Anyone promising you one from a product or a particular process is lying to you. It requires a blend of products and a blend of methods, no shortcuts will help you – period.

2) Rock Out with Your NOC Out

Are they rockstars? So-called rockstars happen in every industry, it is just human nature and cannot be helped. The problem I’ve seen with most rockstars (almost universally in infosec) is that they are not the least bit interested in your problems. They are interested in getting paid and increasing their already big, and in most cases, undeserved reputations. You really have to be careful with these folks – a lot of them are just naturally talented public speakers so they get it on at various conferences and accumulate massive Twitter followings, making them think that those alone qualify them to dispense advice on applications and networks. In most cases, and sadly I’m not overgeneralizing here, they’ve never had any operational roles so they don’t really know what works and what doesn’t. So if it isn’t in the buzzword dictionary sitting in their blazer pocket, it just isn’t valid in their world. You’ll know these people by their insistence that whatever you’re currently doing is wrong – you should be using the method they developed or their tool they wrote because that is the only way to solve your problem. They won’t really listen to you, usually just nodding along with whatever you say until you hit the keyword they need in order to tell you how cool they are. Of course there are some “good” rockstars, so if you’re set on hiring an allstar look for one who has had operational roles in the past and actually appears to listen. Chance are though if they do that then they are very bad rockstars.

3) Lazy Web

Watch the website. Does it ever change? Chances are if they don’t have time to devote to their own website they’ll never get time to devote to protecting yours. Avoid the companies that never update their website or only list their products and services. Try to find one that offers practical advice and is active in the security community. When you’re looking for an outside company to help with your information security, try to find one that has something of their own to protect – a web service or their own network, many do not. This is a really self-serving one because, well, this is how our website is set up and we have a fairly sophisticated network of our own that we protect.

4) Agree to Disagree

Are they really just that agreeable? Good security people are contrarians, they just are. It is either the industry that attracts them or it creates them, either way few people in it are described as agreeable. If you’re in a pre-sales meeting and the sales person or consultant is constantly agreeing with everything you say, ask them what you need to hire them for if everything you’re doing is so right. I use this technique on a lot of our vendors because they are constantly nodding along and agreeing with everything we’re doing. They’re usually taken aback by that question but it really tells you who you’re dealing with. You need to know, upfront, what they are going to really be able to help you with. It is dangerous to have a security person agreeing with you all the time. Conversely, they shouldn’t be disagreeable for the sake of being disagreeable, you have to strike a balance. This is a tough one because, as I said, the industry is filled with both contrarians and slick-haired salespeople. You need the former but should forego the latter. Someone can be a skeptic or a contrarian without being completely disagreeable or being a miserable person to be around.

5) Auditors in Disguse

Beware the auditor in a security person’s clothing. There are literally thousands of information security consulting companies out there. There are probably as many ways to categorize them as there are letters in the alphabet but let’s take a look at just two. The technical group and the auditor group. Now let me say upfront that I’m not denigrating real auditors here, the people that really do the audit job, I’m denigrating the pretenders here. You will find this very prevalent with companies that do penetration testing or vulnerability assessments. For a proper penetration test you really need a good technical person that can communicate both the technical risks and the business issues associated with that risk or exploit. You’ll be hard pressed to find this in just one person, so you want to hire someone with a penetration testing team as opposed to just some solo testers acting as a team. You’ll have a rough time finding the right team and you’re bound to make a few mistakes, but you really do need the best of both worlds.

Now penetration testing service companies come in two flavors – again the very technical and the not-so-technical auditing tester. Penetration testing is difficult and is very technical, so you cannot rely on a person just checking boxes to call your network well tested. You need someone who is doing more than just running a scanner and calling it done, you need a person who can actually exploit the vulnerabilities found. This is a skill that requires some sophistication and usually doesn’t lend itself well to “normal” people. You never want an auditor performing a penetration test and, vice versa, you would never want a penetration tester performing an audit. Why these two things are fused together so much is beyond me. If you’re hiring for a penetration testing company then hire for that, if you just need some audit work then hire for that – but do not hire one set of people and think you’re done, they are entirely different skills.

Of course, there is no 100% guarantee when it comes to the hiring process – you almost never see their true colors until it’s just too late. Be sure to keep sharp and use a little common sense when following these guidelines. If there’s anything else you think you should look out for, leave it in the comments!

Read the original blog entry...

More Stories By Hurricane Labs

Christina O’Neill has been working in the information security field for 3 years. She is a board member for the Northern Ohio InfraGard Members Alliance and a committee member for the Information Security Summit, a conference held once a year for information security and physical security professionals.

@ThingsExpo Stories
SYS-CON Events announced today that Avere Systems, a leading provider of hybrid cloud enablement solutions, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Avere Systems was created by file systems experts determined to reinvent storage by changing the way enterprises thought about and bought storage resources. With decades of experience behind the company’s founders, Avere got its ...
High-velocity engineering teams are applying not only continuous delivery processes, but also lessons in experimentation from established leaders like Amazon, Netflix, and Facebook. These companies have made experimentation a foundation for their release processes, allowing them to try out major feature releases and redesigns within smaller groups before making them broadly available. In his session at 21st Cloud Expo, Brian Lucas, Senior Staff Engineer at Optimizely, will discuss how by using...
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lead...
SYS-CON Events announced today that CAST Software will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CAST was founded more than 25 years ago to make the invisible visible. Built around the idea that even the best analytics on the market still leave blind spots for technical teams looking to deliver better software and prevent outages, CAST provides the software intelligence that matter ...
SYS-CON Events announced today that Daiya Industry will exhibit at the Japanese Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Ruby Development Inc. builds new services in short period of time and provides a continuous support of those services based on Ruby on Rails. For more information, please visit https://github.com/RubyDevInc.
As businesses evolve, they need technology that is simple to help them succeed today and flexible enough to help them build for tomorrow. Chrome is fit for the workplace of the future — providing a secure, consistent user experience across a range of devices that can be used anywhere. In her session at 21st Cloud Expo, Vidya Nagarajan, a Senior Product Manager at Google, will take a look at various options as to how ChromeOS can be leveraged to interact with people on the devices, and formats th...
SYS-CON Events announced today that Yuasa System will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Yuasa System is introducing a multi-purpose endurance testing system for flexible displays, OLED devices, flexible substrates, flat cables, and films in smartphones, wearables, automobiles, and healthcare.
SYS-CON Events announced today that Taica will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Taica manufacturers Alpha-GEL brand silicone components and materials, which maintain outstanding performance over a wide temperature range -40C to +200C. For more information, visit http://www.taica.co.jp/english/.
Enterprises have taken advantage of IoT to achieve important revenue and cost advantages. What is less apparent is how incumbent enterprises operating at scale have, following success with IoT, built analytic, operations management and software development capabilities – ranging from autonomous vehicles to manageable robotics installations. They have embraced these capabilities as if they were Silicon Valley startups. As a result, many firms employ new business models that place enormous impor...
SYS-CON Events announced today that SourceForge has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. SourceForge is the largest, most trusted destination for Open Source Software development, collaboration, discovery and download on the web serving over 32 million viewers, 150 million downloads and over 460,000 active development projects each and every month.
SYS-CON Events announced today that Dasher Technologies will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Dasher Technologies, Inc. ® is a premier IT solution provider that delivers expert technical resources along with trusted account executives to architect and deliver complete IT solutions and services to help our clients execute their goals, plans and objectives. Since 1999, we'v...
As popularity of the smart home is growing and continues to go mainstream, technological factors play a greater role. The IoT protocol houses the interoperability battery consumption, security, and configuration of a smart home device, and it can be difficult for companies to choose the right kind for their product. For both DIY and professionally installed smart homes, developers need to consider each of these elements for their product to be successful in the market and current smart homes.
SYS-CON Events announced today that MIRAI Inc. will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MIRAI Inc. are IT consultants from the public sector whose mission is to solve social issues by technology and innovation and to create a meaningful future for people.
SYS-CON Events announced today that Massive Networks, that helps your business operate seamlessly with fast, reliable, and secure internet and network solutions, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. As a premier telecommunications provider, Massive Networks is headquartered out of Louisville, Colorado. With years of experience under their belt, their team of...
SYS-CON Events announced today that TidalScale, a leading provider of systems and services, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. TidalScale has been involved in shaping the computing landscape. They've designed, developed and deployed some of the most important and successful systems and services in the history of the computing industry - internet, Ethernet, operating s...
Widespread fragmentation is stalling the growth of the IIoT and making it difficult for partners to work together. The number of software platforms, apps, hardware and connectivity standards is creating paralysis among businesses that are afraid of being locked into a solution. EdgeX Foundry is unifying the community around a common IoT edge framework and an ecosystem of interoperable components.
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, will discuss how from store operations...
In a recent survey, Sumo Logic surveyed 1,500 customers who employ cloud services such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). According to the survey, a quarter of the respondents have already deployed Docker containers and nearly as many (23 percent) are employing the AWS Lambda serverless computing framework. It’s clear: serverless is here to stay. The adoption does come with some needed changes, within both application development and operations. Tha...
SYS-CON Events announced today that IBM has been named “Diamond Sponsor” of SYS-CON's 21st Cloud Expo, which will take place on October 31 through November 2nd 2017 at the Santa Clara Convention Center in Santa Clara, California.
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, will lead you through the exciting evolution of the cloud. He'll look at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering ...