Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/18/2019 | 12:36:27 PM
Re: Horse shit
Nothing like good use of language - keep it clean here. 
bwilkes8@gmail.com
50%
50%
[email protected],
User Rank: Moderator
3/14/2019 | 1:52:13 PM
IT Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Hi Kelly, I like your article, but it is a sore point for me.  I was trained not to present a problem without presenting recommendation to address the problem.  Now that does not mean the recommendation was 100% ironclad or that it was even accepted.  Even if the recommendation was rejected you still presented what you believed was a viable solution.  The article talks about the problem but does not elaborate enough on possible solutions.  So, I would like to suggest a solution after I ask a few questions.

Questions for ISACA

- How many registered IT Security certified professionals are registered?

- Of those, how many are entry level?

- Of those, how many are not working in an IT Security related position?

- What are the hurdles?

Why are these entry level Security professionals not able to get hired?  I think this is the question which should be addressed.

Questions for Companies

How many, entry level IT Security professionals, have they invested in?

I believe the notion of there being a drought can be addressed with some creativity by those already in the field, Sr. IT Security professionals and Execs.  Also, if the need is so great why are companies stealing employees from other companies by dangling the $$$ carrot?  That is not a solution, it is only a band-aid which creates a false gap.  Can you tell me the stats on the number of certified IT Security professionals that are under employed or unemployed?

Suggested solution

Create a contractual obligation to bring entry level certified IT Security professionals on board with structured OJT objectives, timelines and support.  By no means is this a silver bullet, but it is an option in conjunction with platforms like Cybrary.  How many of the companies surveyed considered this option or something similar?  Many of these entry level candidates have sacrificed time and hard-earned money to pay for their own courses and sims to earn the certifications.  Myself being one of them.  These personnel must be guided and evaluated on their performance, progress and proficiency which can benefits the company, the senior IT Security staff and the individual.   

I argue, if one can make a case for transitioning from another non-IT role into IT Security, then OJT with an entry level certified IT Security professional is also a viable path. 

That's just my perspective from an entry level point of view.
SotarrTheWizard
50%
50%
SotarrTheWizard,
User Rank: Apprentice
3/14/2019 | 12:26:18 PM
Re: Upward learning curve
And yet, despite a notable shortage, wages are not risng significantly.
StuartG253
50%
50%
StuartG253,
User Rank: Apprentice
3/13/2019 | 11:43:13 PM
Horse shit
:(){:|:&};:
nixonj63
100%
0%
nixonj63,
User Rank: Apprentice
3/13/2019 | 10:59:25 AM
Re: Upward learning curve
Kelly, An excellent update on an ever increasingly difficult situation for the industry.  The talent problem will most likely get worse before it gets better.  Firms need to make the investment in junior level talent and train them up thier own way with incentives to stay onboard. Simply poaching talent from one firm to staff another is a sure fire way to drive up prices and defer a mounting problem.  It will be interesting to see how this Cybersecurity Talent shortage evolves over the next 3-5 years.  
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
3/12/2019 | 3:52:29 PM
Upward learning curve
When I was a self-employed consultant in NYState, my basic knowledge of malware was periodic scans with Malwarebytes and anti-virus.  That's it.  Now having spent 18 months with a Malware forensics department, I am shocked at the little amount of experience and knowledge I actually had.  I was never trained.  A Novell CNE used to go a long way - it is history now.  But practical experience with MD5 Threat hunting and Virustotal and all of that was never exposed ot me - well, I survived a ransomware attack for a client with 3 hours of restore and 98% data restoration - not bad indeed.  But that was easy restore from a decided client computer.  Easy.  Now I live in fear of what i was not doing and so the current skills shortage is the same event.  True we have more resources now online but even so ....... it takes years to gain knowledge and hands-on-keyboard work.  


News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22675
PUBLISHED: 2021-05-07
The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attacker to remotely execute code on SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, C...
CVE-2021-22679
PUBLISHED: 2021-05-07
The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK v...
CVE-2020-14009
PUBLISHED: 2021-05-07
Proofpoint Enterprise Protection (PPS/PoD) before 8.17.0 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipar...
CVE-2021-21984
PUBLISHED: 2021-05-07
VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance.
CVE-2021-26122
PUBLISHED: 2021-05-07
LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.