Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

4/19/2018
08:08 PM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Firms More Likely to Tempt Security Pros With Big Salaries than Invest in Training

Booz Allen survey shows most organizations' answer to the security skills shortage may be unsustainable.

RSA CONFERENCE 2018 - San Francisco - Invest in more expensive security technology, ask security pros to work longer hours, offer them more money, even train non-cyber employees to do some of the security tasks - those are all methods organizations use to address their shortage of skilled security staff. And according to a new report, they all rank higher on the priority list than providing training to help their security staff learn new skills. 

The national survey of 250 IT decision-makers, released today by Booz Allen and KRC Research, found that 83% of respondents have open cybersecurity positions to fill at their company, with 72% saying it is especially challenging to fill advanced roles like threat hunters and malware reverse engineers.  

In an interview with Dark Reading, here, Booz Allen vice president Anil Markose said, "You walk the show floor here [at the RSA Conference] and see, these products are getting more complicated. So the technical chops to use them," are something companies must have, either on their own teams or through service providers.

"These findings are rooted in what Booz Allen has understood for quite some time – products alone won’t make organizations secure, tools are only effective when a skilled workforce is in place to use them," said Booz Allen’s U.S. Commercial Lead, Bill Phelps, in a statement.

However, the report states, that organizations are using "short-term staffing fixes to protect their business, often making the problem worse. 

To address the shortage of skilled staff, respondents say their business prioritizes turning to tools and software (56%), training non-cyber employees (52%), and asking employees to work longer hours (45% percent). To be more competitive in the market for the best cybersecurity talent, respondents say they prioritize offering candidates the higher compensation (54%) and investing continuously in the latest cyber technologies (51%) over training and apprenticeship opportunities (35%) and paying for further education at colleges, universities or boot camps (34%).

Interop ITX 2018

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
4/20/2018 | 10:37:27 AM
Re: Academy Corporations vs. Big Salary Temptation
Cybersecurity is a very high stress job due to the number of villains to be dealt with.  It is also the one IT field that has yet to be decimated by outsourcing to Bangalore - though that has happened in some firms to their regret.  Merck, if memory serves, outsourced IT and paid a heavy price for it.   Salary helps alot but solid education in the field (and there are a ton of really weird degrees available) is also a key.  And the C-Suite has to be aware of the importance of cybersecurity as a policy and not just another damn IT department full of geeks doing nothing.
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
4/20/2018 | 8:32:55 AM
Academy Corporations vs. Big Salary Temptation
I find this to be commonplace. Unfortunately, facilitating the Big Salary model doesn't close the skill gap. Openly offering trainings that "academy corporations" allows for the employee to become trained in the skill sets required for the company to close the skill gap while allowing them to pursue their interest. One major pitfall to both models is even with salary progression and training alotment if internal advancement isn't offered you will have difficulty with employee retention.
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We are really excited about our new two tone authentication system!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29440
PUBLISHED: 2020-11-30
Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module (BCM). This allows an attacker (who is inside a vehicle, or is otherwise able to send data over the CAN bus) to start and drive the vehicle with a spoof...
CVE-2020-29441
PUBLISHED: 2020-11-30
An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An unauthenticated attacker can upload arbitrary files. In some cases, this attack may consume the available database space (Denial of Service), corrupt legitimate data if files are being processed asynchronou...
CVE-2020-4127
PUBLISHED: 2020-11-30
HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or use an intranet user's system to access internal systems from the internet. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 F...
CVE-2020-11867
PUBLISHED: 2020-11-30
Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there.
CVE-2020-16849
PUBLISHED: 2020-11-30
An issue was discovered on Canon MF237w 06.07 devices. An "Improper Handling of Length Parameter Inconsistency" issue in the IPv4/ICMPv4 component, when handling a packet sent by an unauthenticated network attacker, may expose Sensitive Information.