Operations

How to Solve the Security Skills Shortage

50%
50%

At RSA, security professionals weighed in on how to close the security skills gap -- if there is one -- and solve staffing problems.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
String46
50%
50%
String46,
User Rank: Apprentice
8/1/2016 | 5:18:35 PM
After Watching this Video
It's become apparent why attackers are having such an easy time compromising networks.

Maybe I should stop my autodidact IT Security studies, and get a Math or English degree so companies

will hire me.

Wait, maybe my 19 years in Criminal Justice will do the trick...yeah, that's it, I rely on that instead of almost 5 years of inetensive IT SEC Study.
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
4/1/2014 | 10:15:45 PM
BrightTalk and the skills shortage
I saw this from a LinkedIn security group I'm in. The presentation is from ESET company, which I have no interest in. ESET just happens to be the folks giving the presentation.

https://www.brighttalk.com/webcast/1718/106371
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
4/1/2014 | 4:18:06 PM
Re: Bringing in new perspectives
@SaraPeters. Hi Sara, I am an independent contractor, so I am paying for all my own training. I may have to wait until I finish my current VillanovaU training, and maybe pass either the CompTIA Security+ and/or Network+ exams, before getting 'in the door' on a job. I have more detail located here: http://myjourney2itsecurity.blogspot.com/2014/03/starting-point.html
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:45:35 AM
Re: Bringing in new perspectives
@tmccreight  Very, very cool. It's really great that you could get such value from someone who was just in an intern position.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:42:58 AM
Re: Bringing in new perspectives
@KevinK  Good for you!  "I'm hoping with my work experience and training, that I can convince management of my desire to help make a difference."  Let us know how that goes!


Would you be willing to share a few more details? I'd love to know what kind of work you're volunteering for, what training you're taking, whether you're paying for that training yourself or if your company is paying for it, and how you plan to make your case to management to give you a job in security.
tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/31/2014 | 12:02:30 PM
Re: Bringing in new perspectives
Keep at it, Kevin!  Forward thinking security managers will appreciate the skill sets you have as a BA, and taking additional security courses really shows your interest in the field.

If you get a chance to chat with the security management team, try focusing on the role a BA could play in their organization - linking the business drivers of different units in the organization to the role security plays by supporting business objectives and assessing risks. If you can make that link, most security managers will "get it" and want to chat further!
tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/31/2014 | 11:59:57 AM
Re: Bringing in new perspectives
Hi Sara!  Thanks for the comment. 

The situation I was referring to involved an intern position we posted, and accepted a summer student who had a background in physical security (she was a security guard) but was working towards her certification in analytics.  We had a job opening for an intern in our security operations center and I gambled when I made the call to bring her on board. The job posting was structured to attract junior level candidates into the SOC and gauge their interest in the position.  We'd done this a few times and had some success, but these individuals were already in the infosec field.

It was worth the risk to hire someone outside of the typical infosec realm.  She came in with a fresh perspective and looked at the data we were collecting from a new angle.  She uncovered some very interesting patterns that lead to threats being blocked and some potential APT activity discovered in our network.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
3/31/2014 | 10:47:28 AM
Re: Bringing in new perspectives
@tmccreight  This is great to hear:  "we need to look outside the industry sometimes to find a different perspective.  I've made that judgement call, and was pleasantly surprised with the results.  I selected someone with a business and analytics background and trained them in InfoSec."  Was this someone you knew who already worked for the organization in a different capacity, or was this someone you hired from the outside? How did you structure the job posting to attract this person?
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
3/28/2014 | 7:18:10 PM
Re: Bringing in new perspectives
Absolutely, I like @tmccreight's creative thinking. I have been a Business Analyst in various forms, for 10 years. I have an interest in IT Security and I am taking a series of training classes. I plan to take some related certifications. I'm hoping with my work experience and training, that I can convince management of my desire to help make a difference.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/28/2014 | 2:24:17 PM
Re: Bringing in new perspectives
Would you go as far as embracing liberal arts as well as business a greate rfoccus on business topics? Dave Piscitello, VP Security, ICANN made that point in commentary on InformationWeek late last year. He wrote:

I work in InfoSec alongside respected colleagues who earned philosophy, physics, psychology, and political science degrees. I recently met former concert and improv flautists who are rock-solid privacy experts. STEM-centric education won't fill the short-horizon shortfall of cybersecurity talent -- and my head spins when I imagine the unintended consequences over the long term. For example, consider how critical trust and ethics are in cooperative society in general and InfoSec in particular. If you set yourselves on a course where only science matters, when and how do you teach ethics? If you must evangelize STEM, at the very least change the "T" to trust and "E" to ethics.

This makes a lot of sense to me. What do you think?

Page 1 / 3   >   >>
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Cybercrime has become a well-organized business, complete with job specialization, funding, and online customer service. Dark Reading editors speak to cybercrime experts on the evolution of the cybercrime economy and the nature of today's attackers.