Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

2/25/2020
02:00 AM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Wanted: Hands-On Cybersecurity Experience

Organizations lament a lack of qualified job candidates as they continue to struggle to hire and retain security teams, the new ISACA State of Cybersecurity 2020 report shows.

RSA CONFERENCE 2020 - San Francisco - Nearly 80% of organizations will need even more technical security staff - security engineers, security architects, analysts, incident responders, forensic analysts, for instance - in the next 12 months, according to new data from ISACA.

The data comes from a survey of mostly ISACA members as well as other organizations, more than half of whom say their security teams today are understaffed. Most are not satisfied with the qualifications of the job applicants they get: some 73% cite hands-on security experience as a key job qualification, followed by security credentials (35%), and hands-on training (25%). The study is based on data gathered from more than 2,000 respondents from more than 100 countries.

Greg Touhill, ISACA board director and president of Cyxtera Federal Group, says the evolution of security's defense-in-depth technology has helped lead to this conundrum: "We invested in a strategy of defense-in-depth, so we added another layer upon another layer, and all of these layers cost tremendous amounts of manpower - and [require] a lot of highly skilled" talent for each tool and platform that get added to those layers, he explains.

Interestingly, non-security skills are also high on employers' list: one-third of the respondents cite one of the main gaps they see in job candidates are soft skills - aka non-technical proficiencies such as communication, social, and leadership qualities - followed by IT knowledge and experience (30%).

ISACA Director Pam Nigro, who is also the senior director of information security in the GRC practice at Heath Care Service Corporation (HCSC), says even traditional security professionals need to be able to communicate the impact of a vulnerability to a business. "Leadership's eyes are going to glaze over" if you can't clearly articulate what that security flaw could mean for the organization, she says.

Nigro says HCSC runs a six-month rotation program for it security teams to help hone and expand skills. Red, blue, and purple teams, vulnerability scanning and firewall staff rotate into different teams to help brush up on skills or learn new ones. So red teamers can join the blue team to better understand how to defend against attacks they typically perform, and blue teams can sit in the red team seat and think like an attacker. "When you broaden horizons, you start to look at all the things that go into cybersecurity, and you start to be able to do really good critical thinking," Nigro says.

Meantime, organizations need to be more realistic about the qualifications they expect candidates to have for security positions, notes Touhill. "This drives a greater need for a workforce development plan ... and synchronization with the human resources folks" in the recruitment process, he says.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "SSRF 101: How Server-Side Request Forgery Sneaks Past Your Web Apps."

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15703
PUBLISHED: 2020-10-31
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivile...
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
CVE-2020-15277
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.