Operations // Careers & People

How to Solve the Security Skills Shortage

50%
50%

At RSA, security professionals weighed in on how to close the security skills gap -- if there is one -- and solve staffing problems.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
4/1/2014 | 10:15:45 PM
BrightTalk and the skills shortage
I saw this from a LinkedIn security group I'm in. The presentation is from ESET company, which I have no interest in. ESET just happens to be the folks giving the presentation.

https://www.brighttalk.com/webcast/1718/106371
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
4/1/2014 | 4:18:06 PM
Re: Bringing in new perspectives
@SaraPeters. Hi Sara, I am an independent contractor, so I am paying for all my own training. I may have to wait until I finish my current VillanovaU training, and maybe pass either the CompTIA Security+ and/or Network+ exams, before getting 'in the door' on a job. I have more detail located here: http://myjourney2itsecurity.blogspot.com/2014/03/starting-point.html
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:45:35 AM
Re: Bringing in new perspectives
@tmccreight  Very, very cool. It's really great that you could get such value from someone who was just in an intern position.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:42:58 AM
Re: Bringing in new perspectives
@KevinK  Good for you!  "I'm hoping with my work experience and training, that I can convince management of my desire to help make a difference."  Let us know how that goes!


Would you be willing to share a few more details? I'd love to know what kind of work you're volunteering for, what training you're taking, whether you're paying for that training yourself or if your company is paying for it, and how you plan to make your case to management to give you a job in security.
tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/31/2014 | 12:02:30 PM
Re: Bringing in new perspectives
Keep at it, Kevin!  Forward thinking security managers will appreciate the skill sets you have as a BA, and taking additional security courses really shows your interest in the field.

If you get a chance to chat with the security management team, try focusing on the role a BA could play in their organization - linking the business drivers of different units in the organization to the role security plays by supporting business objectives and assessing risks. If you can make that link, most security managers will "get it" and want to chat further!
tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/31/2014 | 11:59:57 AM
Re: Bringing in new perspectives
Hi Sara!  Thanks for the comment. 

The situation I was referring to involved an intern position we posted, and accepted a summer student who had a background in physical security (she was a security guard) but was working towards her certification in analytics.  We had a job opening for an intern in our security operations center and I gambled when I made the call to bring her on board. The job posting was structured to attract junior level candidates into the SOC and gauge their interest in the position.  We'd done this a few times and had some success, but these individuals were already in the infosec field.

It was worth the risk to hire someone outside of the typical infosec realm.  She came in with a fresh perspective and looked at the data we were collecting from a new angle.  She uncovered some very interesting patterns that lead to threats being blocked and some potential APT activity discovered in our network.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
3/31/2014 | 10:47:28 AM
Re: Bringing in new perspectives
@tmccreight  This is great to hear:  "we need to look outside the industry sometimes to find a different perspective.  I've made that judgement call, and was pleasantly surprised with the results.  I selected someone with a business and analytics background and trained them in InfoSec."  Was this someone you knew who already worked for the organization in a different capacity, or was this someone you hired from the outside? How did you structure the job posting to attract this person?
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
3/28/2014 | 7:18:10 PM
Re: Bringing in new perspectives
Absolutely, I like @tmccreight's creative thinking. I have been a Business Analyst in various forms, for 10 years. I have an interest in IT Security and I am taking a series of training classes. I plan to take some related certifications. I'm hoping with my work experience and training, that I can convince management of my desire to help make a difference.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/28/2014 | 2:24:17 PM
Re: Bringing in new perspectives
Would you go as far as embracing liberal arts as well as business a greate rfoccus on business topics? Dave Piscitello, VP Security, ICANN made that point in commentary on InformationWeek late last year. He wrote:

I work in InfoSec alongside respected colleagues who earned philosophy, physics, psychology, and political science degrees. I recently met former concert and improv flautists who are rock-solid privacy experts. STEM-centric education won't fill the short-horizon shortfall of cybersecurity talent -- and my head spins when I imagine the unintended consequences over the long term. For example, consider how critical trust and ethics are in cooperative society in general and InfoSec in particular. If you set yourselves on a course where only science matters, when and how do you teach ethics? If you must evangelize STEM, at the very least change the "T" to trust and "E" to ethics.

This makes a lot of sense to me. What do you think?

tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/28/2014 | 1:58:48 PM
Re: Bringing in new perspectives
I think STEM is a great place to start, but I'd like to see business topics brought into the mix as well.  We've moved more to a risk-based, business focused approach with information security.  The IT Security professionals who can communicate in business terms and understand how business deals with risk bring new skills to the security work force.

 
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3541
Published: 2014-07-29
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

CVE-2014-3542
Published: 2014-07-29
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) is...

Best of the Web
Dark Reading Radio