Virus Aimed at Iran Infected Chevron Network

I'm guessing he's using a fact (factoid?) that there are a small number of people who could recognize Stux in a packet sniff, but that number is much larger of people who could read anomalies out of that same sniff.

Well, the fact that he says "only 18 to 20 people in the [U.S.] who have those fundamental skills" seems bizarre. If only 18-20 people have them, they're not fundamental, they're exceptional. On the other hand, he's pretty vague about those skills specifically. I know a fair number (>> 20, and I'm a recluse) of people who I could imagine implementing some DPI, and knowing "what looks like normal internet traffic" isn't that hard. On the other hand, there aren't that many people doing automated analysis of targeted malware or 0day, in that context his numbers make more sense (but I would stil call them low). It all comes down to tradeoffs and skill levels. You can always set a bar of "having a set of skills" where the skill level is so high that only 20 people have them. But, most companies aren't doing the bare minimum, and security professionals are wiley so it might seem to some like there are only 20 people, because they're all quietly employed or enjoyably semi-employed.