Careers & People

2/1/2016
01:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Cybersecurity Talent You Seek May Be In-House

IT staff in many cases are already performing security-related work -- with proper training, they could be converted to the security team.

Cybersecurity jobs are in demand across all industry sectors and government agencies.  As organizations struggle to address the shortage of skilled cyber talent, there may be existing employees within the IT department who can be trained to defend networks and critical assets from adversaries, experts say.

Tapping internal IT resources is one among several strategies managers can employ to find good security people, experts say. Companies should also partner with academia and educational organizations to ensure that college and university students receive training in real-world scenarios and technology to make them better equip to handle existing and future threats.

Casey O’Brien, executive director and principal investigator with The National CyberWatch Center, says security managers should tap the talents of network administrators, system administrators, and programmers because they have strong foundational skills in their specialty areas.

“So it is really a matter of giving them the right type of training and education and ways to continue to develop those skills where you are baking security into what they already do,” O’Brien says. “For the most part, they are already doing information security-related work as part of their job. This is the easiest way for organizations to start."

Based in Largo, Maryland-based National CyberWatch Center is a consortium of higher education institutions, businesses, and government agencies focused on collaborative efforts to advance information security education and research as well as strengthen the national cybersecurity workforce. The consortium is funded by the National Science Foundation's Advanced Technological Education Program.

Two programs in particular help train the next-generation of security professionals, providing a skilled pool of talent for potential employers: The Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC), which provides hands-on application of information security skills to enhance students’ understanding of both theory and practice; and The National Cyber League (NCL), which  provides an ongoing virtual training ground for faculty and students to develop and validate cybersecurity skills using content aligned with individual and team games. This approach allows students to test their cybersecurity knowledge and skills in a competitive environment.

Students work in teams on real-world, high-fidelity simulated environments in specific areas such as energy or healthcare, O’Brien says. “Pick a critical infrastructure or vertical and chances are we are running an event where students are not only showing technical capabilities but soft skills,” such as writing reports making a case for new technologies, or dealing with budget constraints or interfacing with C-level management who are not versed in technology, O’Brien explains.

The National CyberWatch Center’s events allow companies to recruit, receive resumes and individualized performance reports that show how individuals did across competencies such as analyzing log files or discovering vulnerabilities. “We call them scouting reports,” O’Brien says. 

Companies like Facebook are looking at these events to hire security professionals, he says. In fact, Microsoft, Raytheon, and government agencies such as the Homeland Security Department and National Security Agency, were partners and sponsors of the 2015 MACCDC. Still, “Many companies don’t know about these events. We have to do a better job at outreach,” he says.

Establish the Right Playbook, Team

The goal of all security programs should be to have that group of experts, like Navy Seals, who can create the playbook, who understand the threat and can put in place the necessary procedures and tools to defend their organizations, says Adam Vincent, CEO of ThreatConnect, developer of a comprehensive threat intelligence platform used in security operation centers globally.

After security manager establishes a team and playbook, then “I believe in promoting the junior generation in getting more experience and training them into becoming senior folks,” Vincent says. “The reality is there is not enough senior folks to go around. We need to raise people within and make them the players we want them to be instead of waiting for the right senior person to come along."

Government and the private sector are competing for the same resources, which is driving up the price for security professionals tremendously, Vincent notes. The median annual wage for information security analysts was $88,890 in May 2014, according to the Bureau of Labor Statistics. Salaries for security professionals with certifications could range as high as $103,117 annually, according to The 2015 (ISC)² Global Information Security Workforce Study,

ThreatConnect is in partnership with 15 colleges in the US and is part of The National CyberWatch Center, where company officials helped create curriculum for the process of looking at data from a threat intelligence perspective. The company also lets schools use the ThreatConnect platform to teach the classes.

Haiyan Song, senior vice president of security markets at Splunk, also sees the cross-training of technical people and solutions architects as a way to tackle the talent shortage and find good security people. Splunk develops software for searching, monitoring, and analyzing machine-generated big data, via a Web-style interface.

“We’ve entered an era of fusion of technology, data, people, and domains,” Song says.

For instance, among Splunk’s own customer base, Song sees synergy between the cybersecurity and fraud prevention teams, which often are engaged in similar use cases.

Splunk’s professional services organization is taking on more security-related projects, so the company established a boot camp program to cross train those consultants who are well-versed in Splunk’s technology on security issues such as anomaly detection, behavior analytics, and common security language and technologies, and in some cases, sending them for security certification.  “This is a great way to get [good security] people fast," Song says.

Talent is also coming in from government, such as personnel who have retired or left the Defense Department to seek opportunities in industry or commercial companies. Splunk's chief of staff was previously with US Cyber Command, for instance. He brings a wealth of knowledge on threat intelligence and, at the same time, is learning a lot about how to develop new technologies for cybersecurity, according to Song. 

“I think cross training people who come from a security intelligence background is another way we are expanding our reach to the talent pool,” Song says.

Rutrell Yasin has more than 30 years of experience writing about the application of information technology in business and government. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jc01480
50%
50%
jc01480,
User Rank: Apprentice
2/3/2016 | 11:30:21 PM
Agreed
While getting my CS degree and earning industry certifications in security I worked in a Deaktop Support role in an enterprise organization. My end goal was to join a security team. I learned a lot in this role with respect to sysadmin functions and server builds. As I learned more about security I could see it in my daily workplace and put context to the theory. And I'll readily admit that a network admin, server admin, and endpoint administrator are perfect candidates to lure into any security team. They are already most of the way there they just don't know it yet. If you are one of these people and are interested in security, by all means give it a go. You will not be disappointed as you'll be the one explaining to some of the senior people just what is really going on behind that alert traffic and why. I work with quite a few and I pick their brains daily, sometimes hourly. Good article, sir!
6 Ways Greed Has a Negative Effect on Cybersecurity
Joshua Goldfarb, Co-founder & Chief Product Officer, IDRRA ,  6/11/2018
Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Surviving the IT Security Skills Shortage
Surviving the IT Security Skills Shortage
Cybersecurity professionals are in high demand -- and short supply. Find out what Dark Reading discovered during their 2017 Security Staffing Survey and get some strategies for getting through the drought. Download the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12026
PUBLISHED: 2018-06-17
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in tur...
CVE-2018-12027
PUBLISHED: 2018-06-17
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said ...
CVE-2018-12028
PUBLISHED: 2018-06-17
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an e...
CVE-2018-12029
PUBLISHED: 2018-06-17
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...
CVE-2018-12071
PUBLISHED: 2018-06-17
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.