Operations

How to Solve the Security Skills Shortage

50%
50%

At RSA, security professionals weighed in on how to close the security skills gap -- if there is one -- and solve staffing problems.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
String46
50%
50%
String46,
User Rank: Apprentice
8/1/2016 | 5:18:35 PM
After Watching this Video
It's become apparent why attackers are having such an easy time compromising networks.

Maybe I should stop my autodidact IT Security studies, and get a Math or English degree so companies

will hire me.

Wait, maybe my 19 years in Criminal Justice will do the trick...yeah, that's it, I rely on that instead of almost 5 years of inetensive IT SEC Study.
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
4/1/2014 | 10:15:45 PM
BrightTalk and the skills shortage
I saw this from a LinkedIn security group I'm in. The presentation is from ESET company, which I have no interest in. ESET just happens to be the folks giving the presentation.

https://www.brighttalk.com/webcast/1718/106371
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
4/1/2014 | 4:18:06 PM
Re: Bringing in new perspectives
@SaraPeters. Hi Sara, I am an independent contractor, so I am paying for all my own training. I may have to wait until I finish my current VillanovaU training, and maybe pass either the CompTIA Security+ and/or Network+ exams, before getting 'in the door' on a job. I have more detail located here: http://myjourney2itsecurity.blogspot.com/2014/03/starting-point.html
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:45:35 AM
Re: Bringing in new perspectives
@tmccreight  Very, very cool. It's really great that you could get such value from someone who was just in an intern position.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
4/1/2014 | 10:42:58 AM
Re: Bringing in new perspectives
@KevinK  Good for you!  "I'm hoping with my work experience and training, that I can convince management of my desire to help make a difference."  Let us know how that goes!


Would you be willing to share a few more details? I'd love to know what kind of work you're volunteering for, what training you're taking, whether you're paying for that training yourself or if your company is paying for it, and how you plan to make your case to management to give you a job in security.
tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/31/2014 | 12:02:30 PM
Re: Bringing in new perspectives
Keep at it, Kevin!  Forward thinking security managers will appreciate the skill sets you have as a BA, and taking additional security courses really shows your interest in the field.

If you get a chance to chat with the security management team, try focusing on the role a BA could play in their organization - linking the business drivers of different units in the organization to the role security plays by supporting business objectives and assessing risks. If you can make that link, most security managers will "get it" and want to chat further!
tmccreight
50%
50%
tmccreight,
User Rank: Apprentice
3/31/2014 | 11:59:57 AM
Re: Bringing in new perspectives
Hi Sara!  Thanks for the comment. 

The situation I was referring to involved an intern position we posted, and accepted a summer student who had a background in physical security (she was a security guard) but was working towards her certification in analytics.  We had a job opening for an intern in our security operations center and I gambled when I made the call to bring her on board. The job posting was structured to attract junior level candidates into the SOC and gauge their interest in the position.  We'd done this a few times and had some success, but these individuals were already in the infosec field.

It was worth the risk to hire someone outside of the typical infosec realm.  She came in with a fresh perspective and looked at the data we were collecting from a new angle.  She uncovered some very interesting patterns that lead to threats being blocked and some potential APT activity discovered in our network.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
3/31/2014 | 10:47:28 AM
Re: Bringing in new perspectives
@tmccreight  This is great to hear:  "we need to look outside the industry sometimes to find a different perspective.  I've made that judgement call, and was pleasantly surprised with the results.  I selected someone with a business and analytics background and trained them in InfoSec."  Was this someone you knew who already worked for the organization in a different capacity, or was this someone you hired from the outside? How did you structure the job posting to attract this person?
KevinK-
50%
50%
KevinK-,
User Rank: Apprentice
3/28/2014 | 7:18:10 PM
Re: Bringing in new perspectives
Absolutely, I like @tmccreight's creative thinking. I have been a Business Analyst in various forms, for 10 years. I have an interest in IT Security and I am taking a series of training classes. I plan to take some related certifications. I'm hoping with my work experience and training, that I can convince management of my desire to help make a difference.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/28/2014 | 2:24:17 PM
Re: Bringing in new perspectives
Would you go as far as embracing liberal arts as well as business a greate rfoccus on business topics? Dave Piscitello, VP Security, ICANN made that point in commentary on InformationWeek late last year. He wrote:

I work in InfoSec alongside respected colleagues who earned philosophy, physics, psychology, and political science degrees. I recently met former concert and improv flautists who are rock-solid privacy experts. STEM-centric education won't fill the short-horizon shortfall of cybersecurity talent -- and my head spins when I imagine the unintended consequences over the long term. For example, consider how critical trust and ethics are in cooperative society in general and InfoSec in particular. If you set yourselves on a course where only science matters, when and how do you teach ethics? If you must evangelize STEM, at the very least change the "T" to trust and "E" to ethics.

This makes a lot of sense to me. What do you think?

Page 1 / 3   >   >>
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Cisco Talos Summit: Network Defenders Not Serious Enough About Attacks
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2018
Meet 'Bro': The Best-Kept Secret of Network Security
Greg Bell, CEO, Corelight,  6/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The State of IT and Cybersecurity
The State of IT and Cybersecurity
IT and security are often viewed as different disciplines - and different departments. Find out what our survey data revealed, read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12294
PUBLISHED: 2018-06-19
WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.
CVE-2018-12519
PUBLISHED: 2018-06-19
An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious file to a Node.js application. An attacker can upload a malicious HTML file that contains a JavaScript payload to steal a user's credentials.
CVE-2018-12588
PUBLISHED: 2018-06-19
Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-1 before 3.1.1-2 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the S...
CVE-2018-10811
PUBLISHED: 2018-06-19
strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.
CVE-2018-10945
PUBLISHED: 2018-06-19
The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash, or NULL pointer dereference) via an HTTP request, related to the mbuf_insert function.