Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

7/8/2017
10:46 AM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Desperately Seeking Security: 6 Skills Most In Demand

When people say there's a security skills gap, this is what they really mean.
Previous
1 of 7
Next


Image Source: Adobe Stock

Image Source: Adobe Stock

The last several years have seen a slew of reports coming out lamenting the typical enterprise's ability to recruit and retain quality cybersecurity talent.

Earlier this year, ISACA's Cybersecurity Nexus survey found that more than one in four organizations take six months or longer to fill priority cybersecurity positions. Respondents to the survey said that 40% of organizations report receiving fewer than five applications for cybersecurity positions. And if things keep going the way they're already headed, the problem is only going to get worse. According to the 2017 (ISC)2 Global Information Security Workforce Study conducted by Frost & Sullivan, by 2022 there will be a global shortfall of cybersecurity workers of 1.8 million people.

At the same time, the pain is not necessarily a singular problem; a lot of the issue comes down to the fact that there aren't enough candidates with the right combination of specialized skills to fight the security problem at any given moment. It's a moving target that changes day-by-day.

"There’s definitely a talent shortage of quality information security professionals who are capable of solving emerging problems," says Lee Kushner, president of cybersecurity recruiting firm LJ Kushner & Associates. "It’s not a shortage of general skill or average skill, it’s a shortage of skills that can help companies solve their problems."

As the industry starts to look at the problem, it'd best start putting a finer point on the types of skills most in demand rather than fixating on one overarching security deficiency.

"The problem is more granular than 'look at all the open jobs,'" says Mike Viscuso, CTO and co-founder of Carbon Black.

According to the most recent research, the following specialties and skills are the ones that hiring managers are having the hardest time plugging into their teams.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
7/31/2017 | 2:24:10 PM
Re: I don't buy young and cheap
To humbly disagree, "old and expensive" is a different skill set than "young and cheap".  Those who define and manage process still need those who can tear that process to the ground and force you to refine and release to stay on top of current trends.  Spend some time on the bug bounty sites and read how much detail goes into some of these bug reports written by the "young" who often take these bounties for the challenge alone; it's a crime how little some of the bounties are, yet still these young and cheap hackers are dancing circles around the over-paid CISOs who sometimes have no place on a security team.
TomC764
100%
0%
TomC764,
User Rank: Apprentice
7/19/2017 | 3:21:52 PM
I don't buy young and cheap
I am old and expensive. The main reason that I get gigs is business knowledge. Youngg and cheap are focused on buying more toys. My focus is on cost effective solutions that don't kill the profit of various business. I mostly doo risk assessments and rdidk management not CISSP type work. Those people are young aand cheap AND easily replaceable.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/14/2017 | 3:03:10 PM
Forgetting a couple
A couple items were missing from the slideshow.

"Young" and "cheap".

That's the real "talent shortage" in InfoSec and the tech sector right there, IMHO, based upon what I'm seeing.
mulhearnf
67%
33%
mulhearnf,
User Rank: Apprentice
7/13/2017 | 5:36:42 AM
The lack of skilled people, and the retention thereof.
As long as executives, continue to spend more money on coffee machines, than on security, the problem will continue, and get worse.

To get skilled people, you need to pay them enough, and treat them well.
afarngalo221
100%
0%
afarngalo221,
User Rank: Apprentice
7/11/2017 | 1:59:10 PM
Very good article
This is a very good article and it does highlight the overarching issues with the skills and experiences in the cyber security space.

 

As a recruiter for Navy Federal Credit Union, check out www.navyfederal.org.

 

Thanks,

Agatha
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7270
PUBLISHED: 2021-04-15
Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deploye...
CVE-2020-7308
PUBLISHED: 2021-04-15
Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence (GTI) servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining con...
CVE-2021-23884
PUBLISHED: 2021-04-15
Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO administrator to view the unencrypted password of the McAfee Web Gateway (MWG) or the password of the McAfee Web Gateway Cloud Server (MWGCS) read...
CVE-2021-23886
PUBLISHED: 2021-04-15
Denial of Service vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to cause a BSoD through suspending a process, modifying the processes memory and restarting it. This is triggered by the hdlphook driver reading invali...
CVE-2021-23887
PUBLISHED: 2021-04-15
Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting ...