My organization takes security seriously but and the end of the day we serve customers who don’t. That’s been the bulk of our issues this year.
log4shell has just been the icing on the cake.
That's the rhetoric from young people with no strings attached. People who are older, often with families, always with local connections and long-term relationships, have far more variables when it comes to making that sort of decision.
Pay and working environment (unless either are truly terrible) are rarely even at the top when it comes to enumerating the factors that go into deciding to stay or uproot your entire life and start again elsewhere. If you have a spouse with a good job in a niche area, doubly difficult.
EDIT: Unless you live in an area where you have many nearby options, of course. But those sorts of areas are sometimes harder to move around because the competition for 'good' employers is much fiercer.
- Remote work is now standard, you don't have to relocate
- US companies and well-funded startups opening up outside of US and hiring remote devs (though this is not always officially advertised, but for senior-enough people it's almost always negotiable)
- Tons of reports of people getting 30/50/100% raises (by changing jobs, or counter-offers)
Source: first-hand on all above (I'm frontend dev though, not in security)
Since the last two companies have been headquartered in different cities, this wouldn't have been possible before COVID.
The silver lining on this damned pandemic has been a lot more options for people, like software developers, in the privileged position of being in demand with work that can be done remotely.
1. Try to identify if you are vulnerable
2. Inform people in your company
3. Contact vendors of vulnerable products and ask for a patch
4. Have sysadmins install said patch
Cybersecurity people don't do anything. You're not patching. You're not finding the new flaws. You're reactively trying to solve problems when they make the news.
This is actually a bit of a fun exercise!
What do programmers even do?
1. Client tells them what they want solved.
2. Stack overflow has code examples for these problems.
3. IDE tells you what will compile, what wont, even highlights stuff for you (programmer just copy/pastes).
4. Compiler makes the program, and warns you if it doesn't work. If it doesn't work, go back to step 2.
Programmers don't do anything.
See how dumb that sounds when you skip over a bunch of the minutiae? Or when only looking at a single event? Or generalize to the point of nothingness?