Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/27/2016
08:38 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cybersecurity Skills Shortage Puts Organizations At Risk, Study Shows

The oft-discussed and lamented cybersecurity skills gap isn't just a hiring issue, it's putting your organization at risk, Intel Security-CSIS study finds.

A report published today by Intel Security in partnership with the Center for Strategic and International Studies (CSIS) confirms the perceived cybersecurity skills shortage and the real risk that poses for organizations. 

The study, which surveyed eight countries -- Australia, France, Germany, Israel, Japan, Mexico, the United Kingdom (UK), and the United States (US) -- found that respondents overwhelmingly reported that a cybersecurity skills shortage does exist in their organizations (82%). 

What’s disconcerting about this study, says Candace Worley, vice president and general manager for enterprise endpoint security at Intel, is that respondents reported that “the lack of enough cybersecurity staff is contributing to security risk in their organization.” This should be a concern for all of us, she warns. 

Seventy-one percent of respondents said that this shortage in cybersecurity skills does direct and measurable damage: 25% lost proprietary data through cyberattacks, 33% say they are a target for hackers because of weak cybersecurity defenses, and 22% say they’ve suffered reputation damage due to the workforce shortage. 

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

While governments have begun to take an increased interest in cybersecurity -- the US President’s Budget for fiscal year 2017 proposes $19 billion in Federal resources for cybersecurity -- 76% of respondents still feel that their governments aren’t investing enough in building cybersecurity talent.    

The study revealed that part of the skills shortage can be pinned on the gap between available cybersecurity education and the minimum credentials required for entry-level positions. Four in 10 respondents said that a bachelor’s degree would be required from job applicants seeking an entry-level cybersecurity position, and 38% of respondents from France and 32% from Germany said they’d require a master’s degree as their minimum credential. The researchers of this study found that only 7% of top universities in the countries researched offer undergraduate studies (major or minor) in cybersecurity. 

And while considered a requirement to apply, a bachelor’s degree in a technical field isn’t viewed as effective for acquiring cybersecurity skills as hands-on experience (such as internships or hack-a-thons) or professional certifications. 

Worley says that it’s important to drive excitement about cybersecurity in high school students, but that even if that education began today, “at best, those folks would be coming out of college in one to two, to three years. We’re going to have a talent shortage in the next three years and we need to make sure that it’s not a systemic issue.” 

In order to prevent that, Worley says closing the security skills gap is a challenge for all invested parties.

“This is putting pressure on government and organizations and companies that have security practices and vendors in this field to come together and address this as a community,” she says. In the interim, organizations should asses their risk tolerance and automate and outsource what they can to take the pressure off in-house teams, she says.

This buys some time to tackle the bigger, more complex projects, she says, like intrusion detection, secure software development, and attack mitigation, which were listed as the scarcest cybersecurity skills in the report

While building the cybersecurity workforce is not an easy challenge, Worley says, “We’re at a point now where we as a community, we win as an industry if we solve it.”

Related Content:

Emily Johnson is the digital content editor for InformationWeek. Prior to this role, Emily worked within UBM America's technology group as an associate editor on their content marketing team. Emily started her career at UBM in 2011 and spent four and a half years in content ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
mmccul
50%
50%
mmccul,
User Rank: Apprentice
7/27/2016 | 8:01:33 PM
Point missed in article
As a professional who has interviewed candidates for jobs in information security at multiple levels, I feel qualified to comment on the issues of finding good candidates.  There are multiple low level positions with very minimal requirements, but these positions (such as members of a SOC) are often ignored by these surveys, even though they often require extremely minimal background and provide a solid foundation in the field.  To say that such positions do not exist is to play the ostrich game.

The real problem I see is lack of training of management of what a professional in the field needs to be effective.  I often get unreasonable requests for job responsibilities from the manager; demands for skills not required as well as ignoring critical skills that the manager does not themselves posses and does not realize how crucial they are.  

A great way to improve the information security status of an organization would be to improve the low and mid-level management of such teams.  It would also help if organizations stopped focusing on the wrong problem.  A defensive expert is not a penetration tester, nor are they useful on my team.  As one coworker of mine phrased it, a pen tester knows one trick really well and they keep applying it across lots of applications, lots of systems until it works.  A defensive expert has to address every application, every threat, every system to ensure that the risks are identified, mitigated and addressed:  they have to have something in every column.  

 
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-35419
PUBLISHED: 2021-04-14
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
CVE-2021-28060
PUBLISHED: 2021-04-14
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.
CVE-2021-28825
PUBLISHED: 2021-04-14
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with l...
CVE-2021-28826
PUBLISHED: 2021-04-14
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker wi...
CVE-2021-28855
PUBLISHED: 2021-04-14
In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).