Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

4/19/2018
08:08 PM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Firms More Likely to Tempt Security Pros With Big Salaries than Invest in Training

Booz Allen survey shows most organizations' answer to the security skills shortage may be unsustainable.

RSA CONFERENCE 2018 - San Francisco - Invest in more expensive security technology, ask security pros to work longer hours, offer them more money, even train non-cyber employees to do some of the security tasks - those are all methods organizations use to address their shortage of skilled security staff. And according to a new report, they all rank higher on the priority list than providing training to help their security staff learn new skills. 

The national survey of 250 IT decision-makers, released today by Booz Allen and KRC Research, found that 83% of respondents have open cybersecurity positions to fill at their company, with 72% saying it is especially challenging to fill advanced roles like threat hunters and malware reverse engineers.  

In an interview with Dark Reading, here, Booz Allen vice president Anil Markose said, "You walk the show floor here [at the RSA Conference] and see, these products are getting more complicated. So the technical chops to use them," are something companies must have, either on their own teams or through service providers.

"These findings are rooted in what Booz Allen has understood for quite some time – products alone won’t make organizations secure, tools are only effective when a skilled workforce is in place to use them," said Booz Allen’s U.S. Commercial Lead, Bill Phelps, in a statement.

However, the report states, that organizations are using "short-term staffing fixes to protect their business, often making the problem worse. 

To address the shortage of skilled staff, respondents say their business prioritizes turning to tools and software (56%), training non-cyber employees (52%), and asking employees to work longer hours (45% percent). To be more competitive in the market for the best cybersecurity talent, respondents say they prioritize offering candidates the higher compensation (54%) and investing continuously in the latest cyber technologies (51%) over training and apprenticeship opportunities (35%) and paying for further education at colleges, universities or boot camps (34%).

Interop ITX 2018

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
4/20/2018 | 10:37:27 AM
Re: Academy Corporations vs. Big Salary Temptation
Cybersecurity is a very high stress job due to the number of villains to be dealt with.  It is also the one IT field that has yet to be decimated by outsourcing to Bangalore - though that has happened in some firms to their regret.  Merck, if memory serves, outsourced IT and paid a heavy price for it.   Salary helps alot but solid education in the field (and there are a ton of really weird degrees available) is also a key.  And the C-Suite has to be aware of the importance of cybersecurity as a policy and not just another damn IT department full of geeks doing nothing.
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
4/20/2018 | 8:32:55 AM
Academy Corporations vs. Big Salary Temptation
I find this to be commonplace. Unfortunately, facilitating the Big Salary model doesn't close the skill gap. Openly offering trainings that "academy corporations" allows for the employee to become trained in the skill sets required for the company to close the skill gap while allowing them to pursue their interest. One major pitfall to both models is even with salary progression and training alotment if internal advancement isn't offered you will have difficulty with employee retention.
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...