Addressing the Cyber Skills Gap

Overview

Welcome to the fourth installment of my CISO priority series, where we delve into the cybersecurity industry's most pressing challenges. Today's article is about the cyber talent gap. This issue is not just a short-term hurdle; it's an urgent, long-term threat to the resilience and security of our digital infrastructure. CISOs across the globe are losing sleep over the relentless cycle of finding, recruiting, and retaining skilled cybersecurity professionals—a process that consumes significant time and resources.

In this article, I will outline the problem and explore the proactive steps forward-thinking CISOs and industry leaders are taking to address this challenge including building a sustainable talent pipeline. So, let's get after it. ?

The Challenge

The cybersecurity industry is currently grappling with several critical factors exacerbating the talent shortage. This creates an urgent need for action to prevent organizations from being exposed to cyber threats. It's a shared responsibility that we must all take seriously.

• Hacking is an Industry: Criminal, commercial, and nation-state interests are driving unprecedented cyber-attacks. On the commercial side, this is a growing billion-dollar industry. ?
• Increasing Regulations: The hacker industry has increased the need for increased regulations to protect people and ensure financial stability.? This creates a need for auditors and internal people to assess how to meet the standards and prove compliance.
• Advanced Skills Needed: The cybersecurity industry is increasingly in need of advanced, specialized technical skills that often exceed those with traditional technology backgrounds, especially in threat Intelligence and analysis, digital forensics, vulnerability assessment, and penetration testing.
• Candidate Draught: This is a two-fold issue: one, the need for effective recruitment strategies to attract a diverse pool of talent, and two, the need for additional cyber career training programs and educational pathways.

Why it Matters:

The increased vulnerability to cyberattacks, substantial financial costs, and regulatory compliance challenges all underscore the gravity of this issue, making it a matter of utmost concern for all.?

• Increased Vulnerability: A lack of cybersecurity professionals amplifies vulnerability to cyberattacks, leading to financial losses, data breaches, and disruptions to critical infrastructure.

• Economic Impact: Cyber incidents incur substantial financial costs from paying ransomware to increased recruitment costs. ?Additionally, the shortage hinders digital transformation and competitiveness significantly reducing growth for companies.

• Regulatory and Compliance Challenges: Insufficient cybersecurity talent complicates regulation compliance, increases audit risks, erodes trust, and opens institutions to fines.

• National Security: A robust cybersecurity workforce is essential for protecting national interests and maintaining global stability amidst evolving cyber threats.

Bridging the Cybersecurity Talent Gap

Proactive CISOs are at the forefront of addressing the cybersecurity talent gap. Their focus on immediate and long-term strategies reassures us that the situation's urgency is being met with practical solutions. These leaders are not just reacting to the problem but are actively building a sustainable pipeline of cybersecurity professionals for the future. Here's how they make a difference in the short and long term.

Short-Term Solutions

Leverage AI and Automation

Adopting AI and automation is crucial for alleviating cybersecurity professionals' workload and addressing the skills gap. These technologies can handle routine tasks, freeing human resources to focus on more complex challenges. ?Some of the routine tasks to pass on to AI are:

• Threat Intelligence Analysis:
• Network Traffic Analysis
• Vulnerability Scanning
• Security Incident Detection
• Log Analysis
• Patch Management
• Security Policy Enforcement

For more details on how AI can make an organization cyber-resilient, check out my article "Future-Proofing Security: How AI Supercharges Cyber Resilience" on my LinkedIn page.

IT Talent Transformation and Continuous Learning

Many IT professionals possess transferable skills that can be adapted to cybersecurity roles with the right training and support. CISOs leverage this potential by creating pathways for IT professionals to transition into cybersecurity careers. This transition makes IT professionals a dual threat and increases their value to the organization.

Continuous professional development is not a luxury but a necessity in the rapidly evolving field of cybersecurity. CISOs recognize this and prioritize in-house training and certification support to ensure their teams are always prepared for new challenges. This investment in training instills confidence in cybersecurity teams' preparedness. The most recognized certifications in the industry are CISSP, CEH, and CISM.

The IT professionals who tend to transition and cross-train better are those in the following roles:

• Network Engineers: Their deep understanding of network infrastructure, protocols, and traffic patterns is crucial for identifying and mitigating cyber threats.
• Systems Administrators: Their knowledge of operating systems, servers, and security configurations provides a strong foundation for cybersecurity roles.
• Database Administrators: Their expertise in data management and security practices is essential for protecting sensitive information.
• Software Developers: Their understanding of programming languages, software architecture, and vulnerabilities can be applied to develop secure applications and detect malicious code.

Example: Cisco Networking Academy Cisco's Networking Academy exemplifies a successful career transition program that helps IT professionals move into cybersecurity roles. The program offers comprehensive training in network intrusion analysis, incident response, and mentorship to accelerate skill development and career progression.

My Perspective: This approach is the best short-term solution for everyone involved. The approach treats people as individuals rather than mere assets that can be let go.? Providing new career opportunities keeps people engaged and gives many a purpose: protecting individuals, organizations, and nations from ever-evolving threats.

This purpose fosters what I call "Cyber Stewardship," where each professional becomes a champion for secure and equitable cyberspace. Ron Green instilled this concept in me and consistently emphasized the importance of understanding "who we are protecting and why." Thank you, Ron.

Long-Term Strategies

Enhance Educational Programs and Partnerships

Collaboration between industry, academia, and government is crucial for developing robust educational programs that meet the evolving needs of the cybersecurity industry. Forward-looking CISOs know that partnering with academic institutions will give them access to a talent pipeline of skilled graduates who understand the latest cybersecurity practices and technologies. They can also collaborate on curriculum, ensuring alignment with industry needs and reducing the need for extensive on-the-job training. Additional advantages they gain are access to research and development and potentially continuing education for their current people.

?Here's a brief overview of some of these partnerships:

• Northeastern University and IBM: This partnership is designed to equip students with a comprehensive cybersecurity curriculum emphasizing real-world applications, ensuring they are well-prepared for the industry's challenges.
• Drexel University and Lockheed Martin: This collaboration is focused on creating hands-on training programs that immediately equip students with the skills needed to contribute to the workforce, ensuring a smooth transition from education to employment.
• University of Illinois at Urbana-Champaign and NCSA: This partnership leverages the NCSA's expertise in supercomputing and research to provide students with cutting-edge cybersecurity education and research opportunities.
• Georgia Tech and Cisco Systems: This program has a comprehensive cybersecurity curriculum that integrates Cisco's latest technologies and solutions, providing hands-on experience for the students. The program offers opportunities for internships, industry certifications, and access to Cisco's global network of experts.
• University of Maryland and Microsoft: They run a cybersecurity research center and offer specialized cybersecurity degree programs. These students readily interact with government agencies and federal policymakers focused on cybersecurity. This includes research, education, and internship opportunities with organizations like the U.S. Cyber Command, the National Institute of Standards and Technology, and the Defense Advanced Research Projects Agency (DARPA).

When considering potential partners, please don't overlook the exceptional talent from local community colleges like Macomb Community College in my home state of Michigan. They are right in our backyards and producing graduates who are well-prepared for the cybersecurity field. Here are just a few.

• Macomb Community College (Warren, MI): Offers a Cybersecurity Associate of Applied Science degree. Go Monarchs!
• Santa Fe College (Gainesville, FL): Offers an Associate of Science in Cybersecurity degree program.
• Pierce College (Puyallup, WA): Provides a Cybersecurity Certificate program.
• Sinclair Community College (Dayton, OH): Offers a Cybersecurity Associate of Applied Science degree.
• El Camino College (Torrance, CA): Provides a Cybersecurity Certificate program.

?

Promote Cybersecurity Awareness and Education

By strategically partnering with K-12 education initiatives and launching public awareness campaigns, innovative CISOs are fostering a new generation of cybersecurity experts. By engaging young people in cybersecurity early on, CISOs are investing in the industry cultivating future “Cyber Stewards”.?? Look into local programs or learn how to support programs like these.

• The National Cyber Scholarship Foundation (NCSF) has launched a national initiative to identify and develop a new generation of Cyber Stars. The initiative is designed to identify and foster talent in high schools as well as incoming college students. It includes extensive programs and supports that work together, ensuring a more assured pipeline for building the next generation of cyber talent.

?

• CyberPatriot Program: The CyberPatriot program, created by the Air Force Association, is a national youth cyber education initiative designed to inspire students toward careers in cybersecurity and other STEM disciplines. The program promotes early interest and engagement in the field through competitions that challenge students to identify and resolve cybersecurity vulnerabilities.

Conclusion

The cybersecurity talent shortage is not just an organizational issue; it is a critical challenge that impacts economic stability, regulatory compliance, innovation, national security, and global stability. Addressing this gap is essential for safeguarding our digital future and ensuring that organizations can operate securely and efficiently in an increasingly interconnected world. By understanding why this issue matters, stakeholders across industries can work together to develop solutions that address the talent shortage and build a resilient cybersecurity landscape.

Forward-looking CISOs tackle the cybersecurity talent gap head-on by focusing on immediate actions and long-term strategies. Leveraging AI, facilitating career transitions, and investing in training provide quick relief, while educational partnerships, defined career paths, and awareness campaigns lay the groundwork for a sustainable talent pipeline. These efforts ensure that organizations can handle cybersecurity challenges while preparing for the future.

Most importantly, these CISOs are developing and encouraging "Cyber Stewards," who view their work as a mission to protect people. By defending against digital harm, they uphold the values of security, trust, and equity, ensuring a safe digital environment for all.

Next Up

Ensuring Compliance with Evolving Regulations.

Global privacy laws and regulations are constantly changing, and CISOs are tasked with keeping pace. They actively adjust policies and procedures to comply with new regulations. Ensuring compliance, especially in operations involving emerging technologies like AI and IoT, has become more complex.

#Illinois Cyber Security Scholars Program (ICSSP)

#University of Maryland Globa Campus cybersecurity

#Drexel, #Northeastern, #Grandcanyonuniveristy

#cisconetworkingacademy, #cyberpatriotprogram #cyber,#cyberthreats, #compliance,#CISO,

#CyberSecurity #CISOChallenges #InformationSecurity ?#CyberThreats #Compliance #Budgeting #Automation #TalentRetention #CyberSecurityLeadership #splunk #CISA #Venafi#CDMMedia