Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

7/8/2017
10:46 AM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Desperately Seeking Security: 6 Skills Most In Demand

When people say there's a security skills gap, this is what they really mean.
Previous
1 of 7
Next


Image Source: Adobe Stock

Image Source: Adobe Stock

The last several years have seen a slew of reports coming out lamenting the typical enterprise's ability to recruit and retain quality cybersecurity talent.

Earlier this year, ISACA's Cybersecurity Nexus survey found that more than one in four organizations take six months or longer to fill priority cybersecurity positions. Respondents to the survey said that 40% of organizations report receiving fewer than five applications for cybersecurity positions. And if things keep going the way they're already headed, the problem is only going to get worse. According to the 2017 (ISC)2 Global Information Security Workforce Study conducted by Frost & Sullivan, by 2022 there will be a global shortfall of cybersecurity workers of 1.8 million people.

At the same time, the pain is not necessarily a singular problem; a lot of the issue comes down to the fact that there aren't enough candidates with the right combination of specialized skills to fight the security problem at any given moment. It's a moving target that changes day-by-day.

"There’s definitely a talent shortage of quality information security professionals who are capable of solving emerging problems," says Lee Kushner, president of cybersecurity recruiting firm LJ Kushner & Associates. "It’s not a shortage of general skill or average skill, it’s a shortage of skills that can help companies solve their problems."

As the industry starts to look at the problem, it'd best start putting a finer point on the types of skills most in demand rather than fixating on one overarching security deficiency.

"The problem is more granular than 'look at all the open jobs,'" says Mike Viscuso, CTO and co-founder of Carbon Black.

According to the most recent research, the following specialties and skills are the ones that hiring managers are having the hardest time plugging into their teams.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
7/31/2017 | 2:24:10 PM
Re: I don't buy young and cheap
To humbly disagree, "old and expensive" is a different skill set than "young and cheap".  Those who define and manage process still need those who can tear that process to the ground and force you to refine and release to stay on top of current trends.  Spend some time on the bug bounty sites and read how much detail goes into some of these bug reports written by the "young" who often take these bounties for the challenge alone; it's a crime how little some of the bounties are, yet still these young and cheap hackers are dancing circles around the over-paid CISOs who sometimes have no place on a security team.
TomC764
100%
0%
TomC764,
User Rank: Apprentice
7/19/2017 | 3:21:52 PM
I don't buy young and cheap
I am old and expensive. The main reason that I get gigs is business knowledge. Youngg and cheap are focused on buying more toys. My focus is on cost effective solutions that don't kill the profit of various business. I mostly doo risk assessments and rdidk management not CISSP type work. Those people are young aand cheap AND easily replaceable.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/14/2017 | 3:03:10 PM
Forgetting a couple
A couple items were missing from the slideshow.

"Young" and "cheap".

That's the real "talent shortage" in InfoSec and the tech sector right there, IMHO, based upon what I'm seeing.
mulhearnf
67%
33%
mulhearnf,
User Rank: Apprentice
7/13/2017 | 5:36:42 AM
The lack of skilled people, and the retention thereof.
As long as executives, continue to spend more money on coffee machines, than on security, the problem will continue, and get worse.

To get skilled people, you need to pay them enough, and treat them well.
afarngalo221
100%
0%
afarngalo221,
User Rank: Apprentice
7/11/2017 | 1:59:10 PM
Very good article
This is a very good article and it does highlight the overarching issues with the skills and experiences in the cyber security space.

 

As a recruiter for Navy Federal Credit Union, check out www.navyfederal.org.

 

Thanks,

Agatha
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.
CVE-2020-7222
PUBLISHED: 2020-01-18
An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (...