Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

7/8/2017
10:46 AM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Desperately Seeking Security: 6 Skills Most In Demand

When people say there's a security skills gap, this is what they really mean.
Previous
1 of 7
Next


Image Source: Adobe Stock

Image Source: Adobe Stock

The last several years have seen a slew of reports coming out lamenting the typical enterprise's ability to recruit and retain quality cybersecurity talent.

Earlier this year, ISACA's Cybersecurity Nexus survey found that more than one in four organizations take six months or longer to fill priority cybersecurity positions. Respondents to the survey said that 40% of organizations report receiving fewer than five applications for cybersecurity positions. And if things keep going the way they're already headed, the problem is only going to get worse. According to the 2017 (ISC)2 Global Information Security Workforce Study conducted by Frost & Sullivan, by 2022 there will be a global shortfall of cybersecurity workers of 1.8 million people.

At the same time, the pain is not necessarily a singular problem; a lot of the issue comes down to the fact that there aren't enough candidates with the right combination of specialized skills to fight the security problem at any given moment. It's a moving target that changes day-by-day.

"There’s definitely a talent shortage of quality information security professionals who are capable of solving emerging problems," says Lee Kushner, president of cybersecurity recruiting firm LJ Kushner & Associates. "It’s not a shortage of general skill or average skill, it’s a shortage of skills that can help companies solve their problems."

As the industry starts to look at the problem, it'd best start putting a finer point on the types of skills most in demand rather than fixating on one overarching security deficiency.

"The problem is more granular than 'look at all the open jobs,'" says Mike Viscuso, CTO and co-founder of Carbon Black.

According to the most recent research, the following specialties and skills are the ones that hiring managers are having the hardest time plugging into their teams.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
afarngalo221
100%
0%
afarngalo221,
User Rank: Apprentice
7/11/2017 | 1:59:10 PM
Very good article
This is a very good article and it does highlight the overarching issues with the skills and experiences in the cyber security space.

 

As a recruiter for Navy Federal Credit Union, check out www.navyfederal.org.

 

Thanks,

Agatha
mulhearnf
67%
33%
mulhearnf,
User Rank: Apprentice
7/13/2017 | 5:36:42 AM
The lack of skilled people, and the retention thereof.
As long as executives, continue to spend more money on coffee machines, than on security, the problem will continue, and get worse.

To get skilled people, you need to pay them enough, and treat them well.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/14/2017 | 3:03:10 PM
Forgetting a couple
A couple items were missing from the slideshow.

"Young" and "cheap".

That's the real "talent shortage" in InfoSec and the tech sector right there, IMHO, based upon what I'm seeing.
TomC764
100%
0%
TomC764,
User Rank: Apprentice
7/19/2017 | 3:21:52 PM
I don't buy young and cheap
I am old and expensive. The main reason that I get gigs is business knowledge. Youngg and cheap are focused on buying more toys. My focus is on cost effective solutions that don't kill the profit of various business. I mostly doo risk assessments and rdidk management not CISSP type work. Those people are young aand cheap AND easily replaceable.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
7/31/2017 | 2:24:10 PM
Re: I don't buy young and cheap
To humbly disagree, "old and expensive" is a different skill set than "young and cheap".  Those who define and manage process still need those who can tear that process to the ground and force you to refine and release to stay on top of current trends.  Spend some time on the bug bounty sites and read how much detail goes into some of these bug reports written by the "young" who often take these bounties for the challenge alone; it's a crime how little some of the bounties are, yet still these young and cheap hackers are dancing circles around the over-paid CISOs who sometimes have no place on a security team.
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8071
PUBLISHED: 2019-10-17
Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2019-10752
PUBLISHED: 2019-10-17
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
CVE-2019-12611
PUBLISHED: 2019-10-17
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the miniupn...
CVE-2019-13657
PUBLISHED: 2019-10-17
CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
CVE-2019-15626
PUBLISHED: 2019-10-17
The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.