Operations // Careers & People

How to Solve the Security Skills Shortage

50%
50%

At RSA, security professionals weighed in on how to close the security skills gap -- if there is one -- and solve staffing problems.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
4/1/2014 | 10:15:45 PM
BrightTalk and the skills shortage
I saw this from a LinkedIn security group I'm in. The presentation is from ESET company, which I have no interest in. ESET just happens to be the folks giving the presentation.

https://www.brighttalk.com/webcast/1718/106371
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
4/1/2014 | 4:18:06 PM
Re: Bringing in new perspectives
@SaraPeters. Hi Sara, I am an independent contractor, so I am paying for all my own training. I may have to wait until I finish my current VillanovaU training, and maybe pass either the CompTIA Security+ and/or Network+ exams, before getting 'in the door' on a job. I have more detail located here: http://myjourney2itsecurity.blogspot.com/2014/03/starting-point.html
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:45:35 AM
Re: Bringing in new perspectives
@tmccreight  Very, very cool. It's really great that you could get such value from someone who was just in an intern position.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:42:58 AM
Re: Bringing in new perspectives
@KevinK  Good for you!  "I'm hoping with my work experience and training, that I can convince management of my desire to help make a difference."  Let us know how that goes!


Would you be willing to share a few more details? I'd love to know what kind of work you're volunteering for, what training you're taking, whether you're paying for that training yourself or if your company is paying for it, and how you plan to make your case to management to give you a job in security.
tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/31/2014 | 12:02:30 PM
Re: Bringing in new perspectives
Keep at it, Kevin!  Forward thinking security managers will appreciate the skill sets you have as a BA, and taking additional security courses really shows your interest in the field.

If you get a chance to chat with the security management team, try focusing on the role a BA could play in their organization - linking the business drivers of different units in the organization to the role security plays by supporting business objectives and assessing risks. If you can make that link, most security managers will "get it" and want to chat further!
tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/31/2014 | 11:59:57 AM
Re: Bringing in new perspectives
Hi Sara!  Thanks for the comment. 

The situation I was referring to involved an intern position we posted, and accepted a summer student who had a background in physical security (she was a security guard) but was working towards her certification in analytics.  We had a job opening for an intern in our security operations center and I gambled when I made the call to bring her on board. The job posting was structured to attract junior level candidates into the SOC and gauge their interest in the position.  We'd done this a few times and had some success, but these individuals were already in the infosec field.

It was worth the risk to hire someone outside of the typical infosec realm.  She came in with a fresh perspective and looked at the data we were collecting from a new angle.  She uncovered some very interesting patterns that lead to threats being blocked and some potential APT activity discovered in our network.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
3/31/2014 | 10:47:28 AM
Re: Bringing in new perspectives
@tmccreight  This is great to hear:  "we need to look outside the industry sometimes to find a different perspective.  I've made that judgement call, and was pleasantly surprised with the results.  I selected someone with a business and analytics background and trained them in InfoSec."  Was this someone you knew who already worked for the organization in a different capacity, or was this someone you hired from the outside? How did you structure the job posting to attract this person?
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
3/28/2014 | 7:18:10 PM
Re: Bringing in new perspectives
Absolutely, I like @tmccreight's creative thinking. I have been a Business Analyst in various forms, for 10 years. I have an interest in IT Security and I am taking a series of training classes. I plan to take some related certifications. I'm hoping with my work experience and training, that I can convince management of my desire to help make a difference.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/28/2014 | 2:24:17 PM
Re: Bringing in new perspectives
Would you go as far as embracing liberal arts as well as business a greate rfoccus on business topics? Dave Piscitello, VP Security, ICANN made that point in commentary on InformationWeek late last year. He wrote:

I work in InfoSec alongside respected colleagues who earned philosophy, physics, psychology, and political science degrees. I recently met former concert and improv flautists who are rock-solid privacy experts. STEM-centric education won't fill the short-horizon shortfall of cybersecurity talent -- and my head spins when I imagine the unintended consequences over the long term. For example, consider how critical trust and ethics are in cooperative society in general and InfoSec in particular. If you set yourselves on a course where only science matters, when and how do you teach ethics? If you must evangelize STEM, at the very least change the "T" to trust and "E" to ethics.

This makes a lot of sense to me. What do you think?

tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/28/2014 | 1:58:48 PM
Re: Bringing in new perspectives
I think STEM is a great place to start, but I'd like to see business topics brought into the mix as well.  We've moved more to a risk-based, business focused approach with information security.  The IT Security professionals who can communicate in business terms and understand how business deals with risk bring new skills to the security work force.

 
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant