Operations

1/29/2018
10:30 AM
Laura Lee
Laura Lee
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

An Action Plan to Fill the Information Security Workforce Gap

Nothing says #whorunstheworld like an all-female blue team taking down a male-dominated red team in a battle to protect sensitive customer data, and other ideas to entice women into a cyber career.

It has become a familiar, fear-invoking industry statistic: the 2017 Global Information Security Workforce Study from Frost & Sullivan estimates that a jaw-dropping 1.8 million positions will need to be filled globally by 2022. The same report revealed a mere 11% of information security professionals globally are women. This number has remained unchanged for the last few years, even though the number of women in postsecondary education is steadily increasing. Women today feel empowered to attain degrees and establish meaningful careers, but consistently they are not choosing careers in cybersecurity.

If we are going to make a true impact on the cybersecurity workforce shortage, we will need to tap into the largely untapped resource of educated women. But where do we start? We must enable women to envision themselves in a cyber career. Young girls practice for careers in fashion by dressing Barbie dolls and sketching clothing designs. They dress up as doctors, nurses, and teachers and practice these roles with siblings and friends. We must reach women — both young and seasoned — by making cybersecurity a more tangible, appealing career opportunity.

You've heard it before. In order to cultivate interest in cybersecurity as a career field, we must introduce it early to girls and young women. The United States is surprisingly delayed in its introductions to the technical skills that make up cybersecurity, such as computer science. In other countries, including Singapore, Hong Kong, and Israel, elementary schools cover these topics as early as kindergarten.

New Initiatives Launching in 2018
There are groups launching initiatives to fill this gap. During 2018, the Girl Scouts of America, in partnership with Palo Alto Networks, will roll out a program awarding a series of 18 cybersecurity badges to scouts grades K-12. Other groups, such as Girls Who Code, support clubs and summer enrichment programs for female students. At the college level, one- and two-day hackathons are becoming popular as well. This early and continued exposure is an amazing first step, but we cannot stop here.

As technology advances, we must leverage it to engage youth — especially young women — and make cybersecurity a tangible career path. Programs designed for youth, including SoCal Cyber Cup and CyberPatriot, utilize virtual environments, artificial intelligence, and machine learning to put students into real-world situations and actively defend like true practitioners. These programs transform the abstract into actual practice, allowing students to envision a career in cybersecurity and better train as future cyber warriors.

In addition, these programs pair student teams with coaches and mentors, which gives young girls a chance to interact with cyber professionals. Having real-world role models to guide them drives excitement and encourages commitment to the field. These programs often need more practitioners to volunteer their time, so in 2018, consider taking on a role as a mentor to do your part in encouraging young women to join the world of cyber professionals. Coach an all-female cyber team yourself. Nothing says #whorunstheworld like an all-female blue team taking down a male-dominated red team in a battle to protect sensitive customer data.

Proactive Hiring, Cross Training, and Wage Inequities
Exposing girls to a career in cybersecurity is crucial, but it will take time for those efforts to become fruitful. How an organization recruits, compensates, and trains staff can and will directly affect the number of women who join the field in the coming years.

When recruiting women to join their cybersecurity teams, hiring managers must carefully craft job descriptions to ensure they are inclusive of both genders. Although women are entering the cyber profession with higher education levels — 51% have a master's degree or higher, as compared to 45% of men — studies have shown that most women will discourage themselves from applying for technical positions for which they do not meet every qualification listed, whereas men will still put their name in the hat when meeting only a portion of the requirements. Women also are less likely to apply when job descriptions use common male-associated language, such as analytical, assertive, or tactical, even if they fully possess the right characteristics. We must be sure that our hiring practices are not discouraging women.

There are other changes to make beyond recruiting. The largely untapped market of educated women applies to more than just college graduates. Cross-training women from other fields with transferrable skill sets is the fastest way to address the skills gap. To do this, we must make the field more appealing by addressing equal compensation and offering continuous professional development opportunities and mentorship. According to another Frost & Sullivan report, females in nonmanagerial roles earn 6% less than their male counterparts. This wage gap must be addressed if organizations expect to attract and retain skilled women. The same report revealed that women who are encouraged by mentors and have opportunities to hone and build their skills are more satisfied and successful. Women are looking for this level of training and engagement to grow, and these efforts build a more skilled workforce in general.

The cybersecurity workforce shortage will soon reach a critical level, and it is imperative we tap into the market of educated women if we expect to have an impact. By working together — as professionals and organizations — we can ensure more individuals enter the field to fill those million-plus job openings and that the pool of talented, highly skilled cyber professionals continues to grow.

Related Content:

Laura Lee is executive vice president of cyber training and assessments at Circadence. She leads development around the company's AI-powered, multi-player cyber training platform, Project Ares. Lee brings an exceptional record of leadership in the field of cyber exercises and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
To Click or Not to Click: The Answer Is Easy
Kowsik Guruswamy, Chief Technology Officer at Menlo Security,  11/14/2018
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19279
PUBLISHED: 2018-11-14
PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater.
CVE-2018-19280
PUBLISHED: 2018-11-14
Centreon 3.4.x has XSS via the resource name or macro expression of a poller macro.
CVE-2018-19281
PUBLISHED: 2018-11-14
Centreon 3.4.x allows SNMP trap SQL Injection.
CVE-2018-17960
PUBLISHED: 2018-11-14
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
CVE-2018-19278
PUBLISHED: 2018-11-14
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed lengt...