Operations

1/29/2018
10:30 AM
Laura Lee
Laura Lee
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

An Action Plan to Fill the Information Security Workforce Gap

Nothing says #whorunstheworld like an all-female blue team taking down a male-dominated red team in a battle to protect sensitive customer data, and other ideas to entice women into a cyber career.

It has become a familiar, fear-invoking industry statistic: the 2017 Global Information Security Workforce Study from Frost & Sullivan estimates that a jaw-dropping 1.8 million positions will need to be filled globally by 2022. The same report revealed a mere 11% of information security professionals globally are women. This number has remained unchanged for the last few years, even though the number of women in postsecondary education is steadily increasing. Women today feel empowered to attain degrees and establish meaningful careers, but consistently they are not choosing careers in cybersecurity.

If we are going to make a true impact on the cybersecurity workforce shortage, we will need to tap into the largely untapped resource of educated women. But where do we start? We must enable women to envision themselves in a cyber career. Young girls practice for careers in fashion by dressing Barbie dolls and sketching clothing designs. They dress up as doctors, nurses, and teachers and practice these roles with siblings and friends. We must reach women — both young and seasoned — by making cybersecurity a more tangible, appealing career opportunity.

You've heard it before. In order to cultivate interest in cybersecurity as a career field, we must introduce it early to girls and young women. The United States is surprisingly delayed in its introductions to the technical skills that make up cybersecurity, such as computer science. In other countries, including Singapore, Hong Kong, and Israel, elementary schools cover these topics as early as kindergarten.

New Initiatives Launching in 2018
There are groups launching initiatives to fill this gap. During 2018, the Girl Scouts of America, in partnership with Palo Alto Networks, will roll out a program awarding a series of 18 cybersecurity badges to scouts grades K-12. Other groups, such as Girls Who Code, support clubs and summer enrichment programs for female students. At the college level, one- and two-day hackathons are becoming popular as well. This early and continued exposure is an amazing first step, but we cannot stop here.

As technology advances, we must leverage it to engage youth — especially young women — and make cybersecurity a tangible career path. Programs designed for youth, including SoCal Cyber Cup and CyberPatriot, utilize virtual environments, artificial intelligence, and machine learning to put students into real-world situations and actively defend like true practitioners. These programs transform the abstract into actual practice, allowing students to envision a career in cybersecurity and better train as future cyber warriors.

In addition, these programs pair student teams with coaches and mentors, which gives young girls a chance to interact with cyber professionals. Having real-world role models to guide them drives excitement and encourages commitment to the field. These programs often need more practitioners to volunteer their time, so in 2018, consider taking on a role as a mentor to do your part in encouraging young women to join the world of cyber professionals. Coach an all-female cyber team yourself. Nothing says #whorunstheworld like an all-female blue team taking down a male-dominated red team in a battle to protect sensitive customer data.

Proactive Hiring, Cross Training, and Wage Inequities
Exposing girls to a career in cybersecurity is crucial, but it will take time for those efforts to become fruitful. How an organization recruits, compensates, and trains staff can and will directly affect the number of women who join the field in the coming years.

When recruiting women to join their cybersecurity teams, hiring managers must carefully craft job descriptions to ensure they are inclusive of both genders. Although women are entering the cyber profession with higher education levels — 51% have a master's degree or higher, as compared to 45% of men — studies have shown that most women will discourage themselves from applying for technical positions for which they do not meet every qualification listed, whereas men will still put their name in the hat when meeting only a portion of the requirements. Women also are less likely to apply when job descriptions use common male-associated language, such as analytical, assertive, or tactical, even if they fully possess the right characteristics. We must be sure that our hiring practices are not discouraging women.

There are other changes to make beyond recruiting. The largely untapped market of educated women applies to more than just college graduates. Cross-training women from other fields with transferrable skill sets is the fastest way to address the skills gap. To do this, we must make the field more appealing by addressing equal compensation and offering continuous professional development opportunities and mentorship. According to another Frost & Sullivan report, females in nonmanagerial roles earn 6% less than their male counterparts. This wage gap must be addressed if organizations expect to attract and retain skilled women. The same report revealed that women who are encouraged by mentors and have opportunities to hone and build their skills are more satisfied and successful. Women are looking for this level of training and engagement to grow, and these efforts build a more skilled workforce in general.

The cybersecurity workforce shortage will soon reach a critical level, and it is imperative we tap into the market of educated women if we expect to have an impact. By working together — as professionals and organizations — we can ensure more individuals enter the field to fill those million-plus job openings and that the pool of talented, highly skilled cyber professionals continues to grow.

Related Content:

Laura Lee is executive vice president of cyber training and assessments at Circadence. She leads development around the company's AI-powered, multi-player cyber training platform, Project Ares. Lee brings an exceptional record of leadership in the field of cyber exercises and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The State of IT and Cybersecurity
The State of IT and Cybersecurity
IT and security are often viewed as different disciplines - and different departments. Find out what our survey data revealed, read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15504
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
CVE-2018-15505
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
CVE-2018-15492
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVE-2018-15494
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
CVE-2018-15495
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.