Careers & People

2/13/2017
01:00 PM
Jim Zimmermann
Jim Zimmermann
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

You Can't Hire Your Way Out Of A Skills Shortage ... Yet

It will take much effort to fix the IT and cybersecurity talent crisis, but it is possible.

In 2015, 89% of cybersecurity job postings went unfilled due to the high standards that companies imposed for entry and midlevel positions, according to a CareerBuilder survey. Not enough job applicants had the necessary skills and/or certifications that hiring managers were looking for in potential new employees. The problem is perfect cybersecurity workers don't exist — or if they do, they're employed elsewhere.

When companies began outsourcing, there was a decrease in IT graduates because students feared going into the field without the promise of a career. Combine this lack of incentive with the relatively slow adaption of STEM (science, technology, engineering, and math) skills as a part of a revamped education curriculum, and it's evident that young people aren't introduced to IT opportunities until too late. Interest in other subjects and alternative career paths often occur during crucial development years. 

It's frightening that this shortage of IT skills education coincides with the rapid evolution of the Internet of Things and connected devices — cue the onslaught of new cybersecurity threats. These threats have the potential to be more dangerous than ever. Not only can hackers gain access into consumers' lives through personal computers and mobile phones, but thanks to the web-like nature of connected technology, they can now break into cars, homes, and all the way through to banks and traffic lights.

So, where do we turn from here? How can the industry begin to develop a workforce that is prepared to handle the fluidity and pace of today's cybersecurity industry, closing the cybersecurity skills gap?

Encourage Career Growth Outside of Management
In today's workplace, the path to both financial and career success often runs through management — this is especially true when it comes to small and medium-sized businesses and startups. An employee who is technically gifted at his or her craft often reaches a career "ceiling," and the only way to break through and move up the ranks is to jump to the management side. To keep the brightest and most technically gifted IT workers in the trenches, where they're often most effective, we need to give them incentives — whether financial, a change in title, or both.

Set Realistic Expectations at the Entry Level
Employers must be realistic about expectations for entry-level applicants because this can widen the candidate pool. In a field that evolves as rapidly as IT, many entry-level positions require industry certifications and training that a new employee might not necessarily have (especially those just out of school). Employers should consider applicants who may have some but not all the required skills, knowing that they will be fully trained during their employment. At these entry-level positions, employers should focus on other "big picture" qualities and soft skills that may make the candidate a good fit for the role and the company,  including communication skills, business knowledge, and working as part of a team.

Build "Corporate Universities"
This is an area already seeing growth as companies look for ways they can turn generalists into cybersecurity specialists. These corporate universities allow companies to hire less-qualified employees and train them for current tasks. When the tasks are complete, the employee goes back to the university to get training on the next project. This can be a two-way street for both the company and the employee. While the company gives employees access to the resources they need, an employee can request courses and educational tools to continue professional growth.

Promote STEM Boot Camps for Kids
Many organizations are creating STEM boot camps for kids, designed to get them involved at a younger age. These camps help students build a strong STEM foundation by teaching the basics of math, chemistry, and biology, among other subjects. In a time where the demand for cybersecurity professionals is rising as the candidate supply is falling, it's imperative to invest in the future of the industry.

Make IT Fun
IT and cybersecurity are no laughing matter, but that doesn't mean they can't be fun. Organizations are beginning to host networking events and friendly competitions such as hackathons to allow cybersecurity professionals to network and meet industry peers, while sharpening their skills in the process. Not only are the outcomes and discussions from these events a positive step for the industry, but a little professional fun keeps morale high.

As threats continue to grow with the introduction of new innovations and technologies, cybersecurity and IT skills are more important than ever. Through early and continued education and exposure, as well as a few shifts to organizational structure and expectations, we can begin to get a handle on the skills gap, taking a giant step toward filling the growing number of empty cybersecurity positions.

Related Content:

Jim Zimmermann is Skillsoft's Solutions Principal for IT and Digital Skills Portfolios. He works with current and prospective customers to help them address their IT skills challenges through training. In 2016, Jim was awarded Skillsoft's Outstanding Achievement Award for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
utsec12
50%
50%
utsec12,
User Rank: Apprentice
3/3/2017 | 1:41:12 PM
Something to fix now
I agree that entry level, just out of school, no experience is not as helpful.  But there are many other stats that make InfoSec a critical  position at multiple levels.  Got to have the CIO/CISO, and pay them decent, but the things mentioned like companies sponsoring and helping employees grow.  There should be more $$ incentives for certifications and support for education by Gov and Companies.  The Cyber Security professional attainment will only get more crazy with an ever changing tech environment, not to mention that hackers don't have the same rules to comply with:(
IanT113
0%
100%
IanT113,
User Rank: Apprentice
2/13/2017 | 2:15:59 PM
skills shortage in infosec
Hi - good post, thanks.

I'd say we're trying to hire too many people in infosec. We created roles around minute specifications for some reason, not sure why.

Entry level roles in infosec should not exist. We should be demanding 5 years of demonstrated excellence in some IT field with some evidence of the ability to be flexible (e.g. windows/messaging does some coding and *nix) before considering a more holistic IT-biased role in security. There are so many reasons for this, too many to cover here. The counter to this could be that there aren't enough wizards that fit this description, but i believe we need _fewer_ people, not more...but that's a story for another day :)

A team of 400 security staff employed by a large bank coiuld be reduced to 6.

More details at my blog site - seven-stones dot biz 
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19790
PUBLISHED: 2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...
CVE-2018-19829
PUBLISHED: 2018-12-18
Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.
CVE-2018-16884
PUBLISHED: 2018-12-18
A flaw was found in the Linux kernel in the NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel id and cause a use-after-free. Thus a malicious container user can cause a host kernel memory corruption and a system ...
CVE-2018-17777
PUBLISHED: 2018-12-18
An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have acc...
CVE-2018-18921
PUBLISHED: 2018-12-18
PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action.