Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Newest First  |  Oldest First  |  Threaded View
REISEN1955
REISEN1955,
User Rank: Ninja
3/18/2019 | 12:36:27 PM
Re: Horse shit
Nothing like good use of language - keep it clean here. 
bwilkes8@gmail.com
[email protected],
User Rank: Moderator
3/14/2019 | 1:52:13 PM
IT Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Hi Kelly, I like your article, but it is a sore point for me.  I was trained not to present a problem without presenting recommendation to address the problem.  Now that does not mean the recommendation was 100% ironclad or that it was even accepted.  Even if the recommendation was rejected you still presented what you believed was a viable solution.  The article talks about the problem but does not elaborate enough on possible solutions.  So, I would like to suggest a solution after I ask a few questions.

Questions for ISACA

- How many registered IT Security certified professionals are registered?

- Of those, how many are entry level?

- Of those, how many are not working in an IT Security related position?

- What are the hurdles?

Why are these entry level Security professionals not able to get hired?  I think this is the question which should be addressed.

Questions for Companies

How many, entry level IT Security professionals, have they invested in?

I believe the notion of there being a drought can be addressed with some creativity by those already in the field, Sr. IT Security professionals and Execs.  Also, if the need is so great why are companies stealing employees from other companies by dangling the $$$ carrot?  That is not a solution, it is only a band-aid which creates a false gap.  Can you tell me the stats on the number of certified IT Security professionals that are under employed or unemployed?

Suggested solution

Create a contractual obligation to bring entry level certified IT Security professionals on board with structured OJT objectives, timelines and support.  By no means is this a silver bullet, but it is an option in conjunction with platforms like Cybrary.  How many of the companies surveyed considered this option or something similar?  Many of these entry level candidates have sacrificed time and hard-earned money to pay for their own courses and sims to earn the certifications.  Myself being one of them.  These personnel must be guided and evaluated on their performance, progress and proficiency which can benefits the company, the senior IT Security staff and the individual.   

I argue, if one can make a case for transitioning from another non-IT role into IT Security, then OJT with an entry level certified IT Security professional is also a viable path. 

That's just my perspective from an entry level point of view.
SotarrTheWizard
SotarrTheWizard,
User Rank: Apprentice
3/14/2019 | 12:26:18 PM
Re: Upward learning curve
And yet, despite a notable shortage, wages are not risng significantly.
StuartG253
StuartG253,
User Rank: Apprentice
3/13/2019 | 11:43:13 PM
Horse shit
:(){:|:&};:
nixonj63
nixonj63,
User Rank: Apprentice
3/13/2019 | 10:59:25 AM
Re: Upward learning curve
Kelly, An excellent update on an ever increasingly difficult situation for the industry.  The talent problem will most likely get worse before it gets better.  Firms need to make the investment in junior level talent and train them up thier own way with incentives to stay onboard. Simply poaching talent from one firm to staff another is a sure fire way to drive up prices and defer a mounting problem.  It will be interesting to see how this Cybersecurity Talent shortage evolves over the next 3-5 years.  
REISEN1955
REISEN1955,
User Rank: Ninja
3/12/2019 | 3:52:29 PM
Upward learning curve
When I was a self-employed consultant in NYState, my basic knowledge of malware was periodic scans with Malwarebytes and anti-virus.  That's it.  Now having spent 18 months with a Malware forensics department, I am shocked at the little amount of experience and knowledge I actually had.  I was never trained.  A Novell CNE used to go a long way - it is history now.  But practical experience with MD5 Threat hunting and Virustotal and all of that was never exposed ot me - well, I survived a ransomware attack for a client with 3 hours of restore and 98% data restoration - not bad indeed.  But that was easy restore from a decided client computer.  Easy.  Now I live in fear of what i was not doing and so the current skills shortage is the same event.  True we have more resources now online but even so ....... it takes years to gain knowledge and hands-on-keyboard work.  


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-45786
PUBLISHED: 2023-02-04
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition ...
CVE-2023-22849
PUBLISHED: 2023-02-04
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling Ap...
CVE-2023-25193
PUBLISHED: 2023-02-04
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVE-2023-0676
PUBLISHED: 2023-02-04
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
CVE-2023-0677
PUBLISHED: 2023-02-04
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.