Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/27/2016
08:38 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cybersecurity Skills Shortage Puts Organizations At Risk, Study Shows

The oft-discussed and lamented cybersecurity skills gap isn't just a hiring issue, it's putting your organization at risk, Intel Security-CSIS study finds.

A report published today by Intel Security in partnership with the Center for Strategic and International Studies (CSIS) confirms the perceived cybersecurity skills shortage and the real risk that poses for organizations. 

The study, which surveyed eight countries -- Australia, France, Germany, Israel, Japan, Mexico, the United Kingdom (UK), and the United States (US) -- found that respondents overwhelmingly reported that a cybersecurity skills shortage does exist in their organizations (82%). 

What’s disconcerting about this study, says Candace Worley, vice president and general manager for enterprise endpoint security at Intel, is that respondents reported that “the lack of enough cybersecurity staff is contributing to security risk in their organization.” This should be a concern for all of us, she warns. 

Seventy-one percent of respondents said that this shortage in cybersecurity skills does direct and measurable damage: 25% lost proprietary data through cyberattacks, 33% say they are a target for hackers because of weak cybersecurity defenses, and 22% say they’ve suffered reputation damage due to the workforce shortage. 

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

While governments have begun to take an increased interest in cybersecurity -- the US President’s Budget for fiscal year 2017 proposes $19 billion in Federal resources for cybersecurity -- 76% of respondents still feel that their governments aren’t investing enough in building cybersecurity talent.    

The study revealed that part of the skills shortage can be pinned on the gap between available cybersecurity education and the minimum credentials required for entry-level positions. Four in 10 respondents said that a bachelor’s degree would be required from job applicants seeking an entry-level cybersecurity position, and 38% of respondents from France and 32% from Germany said they’d require a master’s degree as their minimum credential. The researchers of this study found that only 7% of top universities in the countries researched offer undergraduate studies (major or minor) in cybersecurity. 

And while considered a requirement to apply, a bachelor’s degree in a technical field isn’t viewed as effective for acquiring cybersecurity skills as hands-on experience (such as internships or hack-a-thons) or professional certifications. 

Worley says that it’s important to drive excitement about cybersecurity in high school students, but that even if that education began today, “at best, those folks would be coming out of college in one to two, to three years. We’re going to have a talent shortage in the next three years and we need to make sure that it’s not a systemic issue.” 

In order to prevent that, Worley says closing the security skills gap is a challenge for all invested parties.

“This is putting pressure on government and organizations and companies that have security practices and vendors in this field to come together and address this as a community,” she says. In the interim, organizations should asses their risk tolerance and automate and outsource what they can to take the pressure off in-house teams, she says.

This buys some time to tackle the bigger, more complex projects, she says, like intrusion detection, secure software development, and attack mitigation, which were listed as the scarcest cybersecurity skills in the report

While building the cybersecurity workforce is not an easy challenge, Worley says, “We’re at a point now where we as a community, we win as an industry if we solve it.”

Related Content:

Emily Johnson is the digital content editor for InformationWeek. Prior to this role, Emily worked within UBM America's technology group as an associate editor on their content marketing team. Emily started her career at UBM in 2011 and spent four and a half years in content ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
mmccul
50%
50%
mmccul,
User Rank: Apprentice
7/27/2016 | 8:01:33 PM
Point missed in article
As a professional who has interviewed candidates for jobs in information security at multiple levels, I feel qualified to comment on the issues of finding good candidates.  There are multiple low level positions with very minimal requirements, but these positions (such as members of a SOC) are often ignored by these surveys, even though they often require extremely minimal background and provide a solid foundation in the field.  To say that such positions do not exist is to play the ostrich game.

The real problem I see is lack of training of management of what a professional in the field needs to be effective.  I often get unreasonable requests for job responsibilities from the manager; demands for skills not required as well as ignoring critical skills that the manager does not themselves posses and does not realize how crucial they are.  

A great way to improve the information security status of an organization would be to improve the low and mid-level management of such teams.  It would also help if organizations stopped focusing on the wrong problem.  A defensive expert is not a penetration tester, nor are they useful on my team.  As one coworker of mine phrased it, a pen tester knows one trick really well and they keep applying it across lots of applications, lots of systems until it works.  A defensive expert has to address every application, every threat, every system to ensure that the risks are identified, mitigated and addressed:  they have to have something in every column.  

 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9079
PUBLISHED: 2020-08-11
FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product.
CVE-2020-16275
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
CVE-2020-16276
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVE-2020-16277
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVE-2020-16278
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.