30 more

Over the weekend I received a benefits summary from work. They mail it out to remind people of all the non-salary related benefits that we get. The company doesn't pay as well as others, but the retirement benefits are the golden shackles.

They provide retirement projections assuming x,y, or z rate or return and a inflation rate of a. In addition it assumes that my contributions remain porportionally the same, that the retirement program doesn't change, and I get a 4% raise (cost of living adjustment) each year. Looks like I may be working until I'm 65.

Can you imagine working for 30 more years? Looking back at what has changed in the past ten. Looking at what will change in the next 30. Fortunately you dont have to listen to my cracked crystal ball (how do you listen to a crystal ball). Bruce Schneier had some interesting comments in the latest Information Security mag.

In a fit of optimism Bruce says that security will become a requirement of the products. It will be baked in, instead of an add-on solution. One thing that will drive this is SaaS. "IT is infrastructure. Infrastructure is always outsourced. And the details of how the infrastructure works are left to the companies that provide it."

As that happens Bruce sees a consolidation in the security industry. Bad new for us Infosec guys. We'll be replaced by an Indian call center. Just kidding. It doesn't sound good though Richard Bejtlich's blog entry on this subject predicts small companies will jettison their IT staff, and a lot of us may end up working for service providers. That sounds like a net loss of security jobs to me.

Will that happen? Have most companies outsourced their helpdesk? I dont think so. Many that have, found that external helpdesks didn't provide the same level of service. Have most companies outsourced log review? I dont think so. The external company doesn't have the same interest or personal responsibility. Infomation security policy and implementation is still extremely important.