Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Newest First  |  Oldest First  |  Threaded View
REISEN1955
REISEN1955,
User Rank: Ninja
3/18/2019 | 12:36:27 PM
Re: Horse shit
Nothing like good use of language - keep it clean here. 
bwilkes8@gmail.com
[email protected],
User Rank: Moderator
3/14/2019 | 1:52:13 PM
IT Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Hi Kelly, I like your article, but it is a sore point for me.  I was trained not to present a problem without presenting recommendation to address the problem.  Now that does not mean the recommendation was 100% ironclad or that it was even accepted.  Even if the recommendation was rejected you still presented what you believed was a viable solution.  The article talks about the problem but does not elaborate enough on possible solutions.  So, I would like to suggest a solution after I ask a few questions.

Questions for ISACA

- How many registered IT Security certified professionals are registered?

- Of those, how many are entry level?

- Of those, how many are not working in an IT Security related position?

- What are the hurdles?

Why are these entry level Security professionals not able to get hired?  I think this is the question which should be addressed.

Questions for Companies

How many, entry level IT Security professionals, have they invested in?

I believe the notion of there being a drought can be addressed with some creativity by those already in the field, Sr. IT Security professionals and Execs.  Also, if the need is so great why are companies stealing employees from other companies by dangling the $$$ carrot?  That is not a solution, it is only a band-aid which creates a false gap.  Can you tell me the stats on the number of certified IT Security professionals that are under employed or unemployed?

Suggested solution

Create a contractual obligation to bring entry level certified IT Security professionals on board with structured OJT objectives, timelines and support.  By no means is this a silver bullet, but it is an option in conjunction with platforms like Cybrary.  How many of the companies surveyed considered this option or something similar?  Many of these entry level candidates have sacrificed time and hard-earned money to pay for their own courses and sims to earn the certifications.  Myself being one of them.  These personnel must be guided and evaluated on their performance, progress and proficiency which can benefits the company, the senior IT Security staff and the individual.   

I argue, if one can make a case for transitioning from another non-IT role into IT Security, then OJT with an entry level certified IT Security professional is also a viable path. 

That's just my perspective from an entry level point of view.
SotarrTheWizard
SotarrTheWizard,
User Rank: Apprentice
3/14/2019 | 12:26:18 PM
Re: Upward learning curve
And yet, despite a notable shortage, wages are not risng significantly.
StuartG253
StuartG253,
User Rank: Apprentice
3/13/2019 | 11:43:13 PM
Horse shit
:(){:|:&};:
nixonj63
nixonj63,
User Rank: Apprentice
3/13/2019 | 10:59:25 AM
Re: Upward learning curve
Kelly, An excellent update on an ever increasingly difficult situation for the industry.  The talent problem will most likely get worse before it gets better.  Firms need to make the investment in junior level talent and train them up thier own way with incentives to stay onboard. Simply poaching talent from one firm to staff another is a sure fire way to drive up prices and defer a mounting problem.  It will be interesting to see how this Cybersecurity Talent shortage evolves over the next 3-5 years.  
REISEN1955
REISEN1955,
User Rank: Ninja
3/12/2019 | 3:52:29 PM
Upward learning curve
When I was a self-employed consultant in NYState, my basic knowledge of malware was periodic scans with Malwarebytes and anti-virus.  That's it.  Now having spent 18 months with a Malware forensics department, I am shocked at the little amount of experience and knowledge I actually had.  I was never trained.  A Novell CNE used to go a long way - it is history now.  But practical experience with MD5 Threat hunting and Virustotal and all of that was never exposed ot me - well, I survived a ransomware attack for a client with 3 hours of restore and 98% data restoration - not bad indeed.  But that was easy restore from a decided client computer.  Easy.  Now I live in fear of what i was not doing and so the current skills shortage is the same event.  True we have more resources now online but even so ....... it takes years to gain knowledge and hands-on-keyboard work.  


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Black Hat USA 2022 Attendee Report
Black Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-35942
PUBLISHED: 2022-08-12
Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data ...
CVE-2022-35949
PUBLISHED: 2022-08-12
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js con...
CVE-2022-35953
PUBLISHED: 2022-08-12
BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be vulnerable to tabnabbing, a form of phishing that gives attackers an opportunity to redirect a user to a malicious site. The issue was patche...
CVE-2022-35956
PUBLISHED: 2022-08-12
This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgra...
CVE-2022-35943
PUBLISHED: 2022-08-12
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter ...