Careers & People
2/1/2016
01:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Cybersecurity Talent You Seek May Be In-House

IT staff in many cases are already performing security-related work -- with proper training, they could be converted to the security team.

Cybersecurity jobs are in demand across all industry sectors and government agencies.  As organizations struggle to address the shortage of skilled cyber talent, there may be existing employees within the IT department who can be trained to defend networks and critical assets from adversaries, experts say.

Tapping internal IT resources is one among several strategies managers can employ to find good security people, experts say. Companies should also partner with academia and educational organizations to ensure that college and university students receive training in real-world scenarios and technology to make them better equip to handle existing and future threats.

Casey O’Brien, executive director and principal investigator with The National CyberWatch Center, says security managers should tap the talents of network administrators, system administrators, and programmers because they have strong foundational skills in their specialty areas.

“So it is really a matter of giving them the right type of training and education and ways to continue to develop those skills where you are baking security into what they already do,” O’Brien says. “For the most part, they are already doing information security-related work as part of their job. This is the easiest way for organizations to start."

Based in Largo, Maryland-based National CyberWatch Center is a consortium of higher education institutions, businesses, and government agencies focused on collaborative efforts to advance information security education and research as well as strengthen the national cybersecurity workforce. The consortium is funded by the National Science Foundation's Advanced Technological Education Program.

Two programs in particular help train the next-generation of security professionals, providing a skilled pool of talent for potential employers: The Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC), which provides hands-on application of information security skills to enhance students’ understanding of both theory and practice; and The National Cyber League (NCL), which  provides an ongoing virtual training ground for faculty and students to develop and validate cybersecurity skills using content aligned with individual and team games. This approach allows students to test their cybersecurity knowledge and skills in a competitive environment.

Students work in teams on real-world, high-fidelity simulated environments in specific areas such as energy or healthcare, O’Brien says. “Pick a critical infrastructure or vertical and chances are we are running an event where students are not only showing technical capabilities but soft skills,” such as writing reports making a case for new technologies, or dealing with budget constraints or interfacing with C-level management who are not versed in technology, O’Brien explains.

The National CyberWatch Center’s events allow companies to recruit, receive resumes and individualized performance reports that show how individuals did across competencies such as analyzing log files or discovering vulnerabilities. “We call them scouting reports,” O’Brien says. 

Companies like Facebook are looking at these events to hire security professionals, he says. In fact, Microsoft, Raytheon, and government agencies such as the Homeland Security Department and National Security Agency, were partners and sponsors of the 2015 MACCDC. Still, “Many companies don’t know about these events. We have to do a better job at outreach,” he says.

Establish the Right Playbook, Team

The goal of all security programs should be to have that group of experts, like Navy Seals, who can create the playbook, who understand the threat and can put in place the necessary procedures and tools to defend their organizations, says Adam Vincent, CEO of ThreatConnect, developer of a comprehensive threat intelligence platform used in security operation centers globally.

After security manager establishes a team and playbook, then “I believe in promoting the junior generation in getting more experience and training them into becoming senior folks,” Vincent says. “The reality is there is not enough senior folks to go around. We need to raise people within and make them the players we want them to be instead of waiting for the right senior person to come along."

Government and the private sector are competing for the same resources, which is driving up the price for security professionals tremendously, Vincent notes. The median annual wage for information security analysts was $88,890 in May 2014, according to the Bureau of Labor Statistics. Salaries for security professionals with certifications could range as high as $103,117 annually, according to The 2015 (ISC)² Global Information Security Workforce Study,

ThreatConnect is in partnership with 15 colleges in the US and is part of The National CyberWatch Center, where company officials helped create curriculum for the process of looking at data from a threat intelligence perspective. The company also lets schools use the ThreatConnect platform to teach the classes.

Haiyan Song, senior vice president of security markets at Splunk, also sees the cross-training of technical people and solutions architects as a way to tackle the talent shortage and find good security people. Splunk develops software for searching, monitoring, and analyzing machine-generated big data, via a Web-style interface.

“We’ve entered an era of fusion of technology, data, people, and domains,” Song says.

For instance, among Splunk’s own customer base, Song sees synergy between the cybersecurity and fraud prevention teams, which often are engaged in similar use cases.

Splunk’s professional services organization is taking on more security-related projects, so the company established a boot camp program to cross train those consultants who are well-versed in Splunk’s technology on security issues such as anomaly detection, behavior analytics, and common security language and technologies, and in some cases, sending them for security certification.  “This is a great way to get [good security] people fast," Song says.

Talent is also coming in from government, such as personnel who have retired or left the Defense Department to seek opportunities in industry or commercial companies. Splunk's chief of staff was previously with US Cyber Command, for instance. He brings a wealth of knowledge on threat intelligence and, at the same time, is learning a lot about how to develop new technologies for cybersecurity, according to Song. 

“I think cross training people who come from a security intelligence background is another way we are expanding our reach to the talent pool,” Song says.

Rutrell Yasin has more than 30 years of experience writing about the application of information technology in business and government. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jc01480
50%
50%
jc01480,
User Rank: Apprentice
2/3/2016 | 11:30:21 PM
Agreed
While getting my CS degree and earning industry certifications in security I worked in a Deaktop Support role in an enterprise organization. My end goal was to join a security team. I learned a lot in this role with respect to sysadmin functions and server builds. As I learned more about security I could see it in my daily workplace and put context to the theory. And I'll readily admit that a network admin, server admin, and endpoint administrator are perfect candidates to lure into any security team. They are already most of the way there they just don't know it yet. If you are one of these people and are interested in security, by all means give it a go. You will not be disappointed as you'll be the one explaining to some of the senior people just what is really going on behind that alert traffic and why. I work with quite a few and I pick their brains daily, sometimes hourly. Good article, sir!
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Things Every Business Executive Should Know About Cybersecurity
Don't get lost in security's technical minutiae - a clearer picture of what's at stake can help align business imperatives with technology execution.
Flash Poll
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Social engineering, ransomware, and other sophisticated exploits are leading to new IT security compromises every day. Dark Reading's 2016 Strategic Security Survey polled 300 IT and security professionals to get information on breach incidents, the fallout they caused, and how recent events are shaping preparations for inevitable attacks in the coming year. Download this report to get a look at data from the survey and to find out what a breach might mean for your organization.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Security researchers are finding that there's a growing market for the vulnerabilities they discover and persistent conundrum as to the right way to disclose them. Dark Reading editors will speak to experts -- Veracode CTO and co-founder Chris Wysopal and HackerOne co-founder and CTO Alex Rice -- about bug bounties and the expanding market for zero-day security vulnerabilities.