Careers & People
01:00 PM
Connect Directly

The Cybersecurity Talent You Seek May Be In-House

IT staff in many cases are already performing security-related work -- with proper training, they could be converted to the security team.

Cybersecurity jobs are in demand across all industry sectors and government agencies.  As organizations struggle to address the shortage of skilled cyber talent, there may be existing employees within the IT department who can be trained to defend networks and critical assets from adversaries, experts say.

Tapping internal IT resources is one among several strategies managers can employ to find good security people, experts say. Companies should also partner with academia and educational organizations to ensure that college and university students receive training in real-world scenarios and technology to make them better equip to handle existing and future threats.

Casey O’Brien, executive director and principal investigator with The National CyberWatch Center, says security managers should tap the talents of network administrators, system administrators, and programmers because they have strong foundational skills in their specialty areas.

“So it is really a matter of giving them the right type of training and education and ways to continue to develop those skills where you are baking security into what they already do,” O’Brien says. “For the most part, they are already doing information security-related work as part of their job. This is the easiest way for organizations to start."

Based in Largo, Maryland-based National CyberWatch Center is a consortium of higher education institutions, businesses, and government agencies focused on collaborative efforts to advance information security education and research as well as strengthen the national cybersecurity workforce. The consortium is funded by the National Science Foundation's Advanced Technological Education Program.

Two programs in particular help train the next-generation of security professionals, providing a skilled pool of talent for potential employers: The Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC), which provides hands-on application of information security skills to enhance students’ understanding of both theory and practice; and The National Cyber League (NCL), which  provides an ongoing virtual training ground for faculty and students to develop and validate cybersecurity skills using content aligned with individual and team games. This approach allows students to test their cybersecurity knowledge and skills in a competitive environment.

Students work in teams on real-world, high-fidelity simulated environments in specific areas such as energy or healthcare, O’Brien says. “Pick a critical infrastructure or vertical and chances are we are running an event where students are not only showing technical capabilities but soft skills,” such as writing reports making a case for new technologies, or dealing with budget constraints or interfacing with C-level management who are not versed in technology, O’Brien explains.

The National CyberWatch Center’s events allow companies to recruit, receive resumes and individualized performance reports that show how individuals did across competencies such as analyzing log files or discovering vulnerabilities. “We call them scouting reports,” O’Brien says. 

Companies like Facebook are looking at these events to hire security professionals, he says. In fact, Microsoft, Raytheon, and government agencies such as the Homeland Security Department and National Security Agency, were partners and sponsors of the 2015 MACCDC. Still, “Many companies don’t know about these events. We have to do a better job at outreach,” he says.

Establish the Right Playbook, Team

The goal of all security programs should be to have that group of experts, like Navy Seals, who can create the playbook, who understand the threat and can put in place the necessary procedures and tools to defend their organizations, says Adam Vincent, CEO of ThreatConnect, developer of a comprehensive threat intelligence platform used in security operation centers globally.

After security manager establishes a team and playbook, then “I believe in promoting the junior generation in getting more experience and training them into becoming senior folks,” Vincent says. “The reality is there is not enough senior folks to go around. We need to raise people within and make them the players we want them to be instead of waiting for the right senior person to come along."

Government and the private sector are competing for the same resources, which is driving up the price for security professionals tremendously, Vincent notes. The median annual wage for information security analysts was $88,890 in May 2014, according to the Bureau of Labor Statistics. Salaries for security professionals with certifications could range as high as $103,117 annually, according to The 2015 (ISC)² Global Information Security Workforce Study,

ThreatConnect is in partnership with 15 colleges in the US and is part of The National CyberWatch Center, where company officials helped create curriculum for the process of looking at data from a threat intelligence perspective. The company also lets schools use the ThreatConnect platform to teach the classes.

Haiyan Song, senior vice president of security markets at Splunk, also sees the cross-training of technical people and solutions architects as a way to tackle the talent shortage and find good security people. Splunk develops software for searching, monitoring, and analyzing machine-generated big data, via a Web-style interface.

“We’ve entered an era of fusion of technology, data, people, and domains,” Song says.

For instance, among Splunk’s own customer base, Song sees synergy between the cybersecurity and fraud prevention teams, which often are engaged in similar use cases.

Splunk’s professional services organization is taking on more security-related projects, so the company established a boot camp program to cross train those consultants who are well-versed in Splunk’s technology on security issues such as anomaly detection, behavior analytics, and common security language and technologies, and in some cases, sending them for security certification.  “This is a great way to get [good security] people fast," Song says.

Talent is also coming in from government, such as personnel who have retired or left the Defense Department to seek opportunities in industry or commercial companies. Splunk's chief of staff was previously with US Cyber Command, for instance. He brings a wealth of knowledge on threat intelligence and, at the same time, is learning a lot about how to develop new technologies for cybersecurity, according to Song. 

“I think cross training people who come from a security intelligence background is another way we are expanding our reach to the talent pool,” Song says.

Rutrell Yasin has more than 30 years of experience writing about the application of information technology in business and government. View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/3/2016 | 11:30:21 PM
While getting my CS degree and earning industry certifications in security I worked in a Deaktop Support role in an enterprise organization. My end goal was to join a security team. I learned a lot in this role with respect to sysadmin functions and server builds. As I learned more about security I could see it in my daily workplace and put context to the theory. And I'll readily admit that a network admin, server admin, and endpoint administrator are perfect candidates to lure into any security team. They are already most of the way there they just don't know it yet. If you are one of these people and are interested in security, by all means give it a go. You will not be disappointed as you'll be the one explaining to some of the senior people just what is really going on behind that alert traffic and why. I work with quite a few and I pick their brains daily, sometimes hourly. Good article, sir!
Register for Dark Reading Newsletters
White Papers
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.