Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/18/2019 | 12:36:27 PM
Re: Horse shit
Nothing like good use of language - keep it clean here. 
bwilkes8@gmail.com
50%
50%
[email protected],
User Rank: Strategist
3/14/2019 | 1:52:13 PM
IT Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Hi Kelly, I like your article, but it is a sore point for me.  I was trained not to present a problem without presenting recommendation to address the problem.  Now that does not mean the recommendation was 100% ironclad or that it was even accepted.  Even if the recommendation was rejected you still presented what you believed was a viable solution.  The article talks about the problem but does not elaborate enough on possible solutions.  So, I would like to suggest a solution after I ask a few questions.

Questions for ISACA

- How many registered IT Security certified professionals are registered?

- Of those, how many are entry level?

- Of those, how many are not working in an IT Security related position?

- What are the hurdles?

Why are these entry level Security professionals not able to get hired?  I think this is the question which should be addressed.

Questions for Companies

How many, entry level IT Security professionals, have they invested in?

I believe the notion of there being a drought can be addressed with some creativity by those already in the field, Sr. IT Security professionals and Execs.  Also, if the need is so great why are companies stealing employees from other companies by dangling the $$$ carrot?  That is not a solution, it is only a band-aid which creates a false gap.  Can you tell me the stats on the number of certified IT Security professionals that are under employed or unemployed?

Suggested solution

Create a contractual obligation to bring entry level certified IT Security professionals on board with structured OJT objectives, timelines and support.  By no means is this a silver bullet, but it is an option in conjunction with platforms like Cybrary.  How many of the companies surveyed considered this option or something similar?  Many of these entry level candidates have sacrificed time and hard-earned money to pay for their own courses and sims to earn the certifications.  Myself being one of them.  These personnel must be guided and evaluated on their performance, progress and proficiency which can benefits the company, the senior IT Security staff and the individual.   

I argue, if one can make a case for transitioning from another non-IT role into IT Security, then OJT with an entry level certified IT Security professional is also a viable path. 

That's just my perspective from an entry level point of view.
SotarrTheWizard
50%
50%
SotarrTheWizard,
User Rank: Apprentice
3/14/2019 | 12:26:18 PM
Re: Upward learning curve
And yet, despite a notable shortage, wages are not risng significantly.
StuartG253
50%
50%
StuartG253,
User Rank: Apprentice
3/13/2019 | 11:43:13 PM
Horse shit
:(){:|:&};:
nixonj63
100%
0%
nixonj63,
User Rank: Apprentice
3/13/2019 | 10:59:25 AM
Re: Upward learning curve
Kelly, An excellent update on an ever increasingly difficult situation for the industry.  The talent problem will most likely get worse before it gets better.  Firms need to make the investment in junior level talent and train them up thier own way with incentives to stay onboard. Simply poaching talent from one firm to staff another is a sure fire way to drive up prices and defer a mounting problem.  It will be interesting to see how this Cybersecurity Talent shortage evolves over the next 3-5 years.  
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
3/12/2019 | 3:52:29 PM
Upward learning curve
When I was a self-employed consultant in NYState, my basic knowledge of malware was periodic scans with Malwarebytes and anti-virus.  That's it.  Now having spent 18 months with a Malware forensics department, I am shocked at the little amount of experience and knowledge I actually had.  I was never trained.  A Novell CNE used to go a long way - it is history now.  But practical experience with MD5 Threat hunting and Virustotal and all of that was never exposed ot me - well, I survived a ransomware attack for a client with 3 hours of restore and 98% data restoration - not bad indeed.  But that was easy restore from a decided client computer.  Easy.  Now I live in fear of what i was not doing and so the current skills shortage is the same event.  True we have more resources now online but even so ....... it takes years to gain knowledge and hands-on-keyboard work.  


Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
AWS CISO Talks Risk Reduction, Development, Recruitment
Kelly Sheridan, Staff Editor, Dark Reading,  6/25/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10133
PUBLISHED: 2019-06-26
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
CVE-2019-10134
PUBLISHED: 2019-06-26
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
CVE-2019-10154
PUBLISHED: 2019-06-26
A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations.
CVE-2019-9039
PUBLISHED: 2019-06-26
The Couchbase Sync Gateway 2.1.2 in combination with a Couchbase Server is affected by a previously undisclosed N1QL-injection vulnerability in the REST API. An attacker with access to the public REST API can insert additional N1QL statements through the parameters ?startkey? and ?endkey? of the ?_a...
CVE-2018-20846
PUBLISHED: 2019-06-26
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).