How IT Departments Can Manage The Security Skills Shortage

A lack of skilled cybersecurity talent is putting organizations at risk. Which skills are in highest demand, and how can IT managers secure the right people to protect their information?

If youre struggling to hire employees for your cybersecurity team, youre not alone. A security skill shortage is leaving businesses across industries vulnerable to attacks.
As cyberthreats become more complex and dangerous, IT departments are challenged to find employees with the skill sets to discover vulnerabilities and employ sophisticated protective technologies to address them.
The talent shortage affects businesses in several ways; the greatest being the additional risk they must assume. However, without the right skills on board, many organizations are unaware of how vulnerable they are.
Frankly, without the qualified staff to adequately valuate information assets of a business and develop a reasonable sense of their cyber value at risk, many businesses dont know what they dont know, explains David Shearer, CEO of (ISC)².
As organizations fiercely compete to hire top security practitioners, its important to be aware of how big the problem is, which skills they need, and how they can compensate for a lack of talent to stay secure.
The Problem Is Severe
Experts agree: the lack of talent is a major problem across the economy.
There is a severe security skill shortage in businesses, says Owanate Bestman, information security contract consultant at Barclay Simpson. We see the general economic slowdown hasnt affected job flow at all within security.
The shortfall is widespread but some industries are more affected than others, he says. Financial services companies, for example, have advanced systems to protect sensitive data, but their tools are not fully utilized because employees lack the expertise.
In a
2015 Global Information Security Workforce Study
, (ISC)²s Center for Cyber Safety and Education predicts there will be a shortfall of 1.5 million professionals worldwide by 2020 if the shortfall is not addressed. Less than 6% of the studys 13,930 respondents are under the age of 30, which paints a bleak picture for the future of the industry.
(ISC)²s Shearer points out that undetected breaches can be attributed to lack of security staff. Poor incident response time and difficulty in recovery can ensue, he says.
Organizations are primarily lacking staff with technical expertise, explains Lee Kushner, president of LJ Kushner and Associates. Businesses can buy tools and technologies and services, but its harder to find people who can manage them.
We have gaps in really hard technical skills, says Kushner, who has 20 years of experience recruiting InfoSec professionals. We need people who would deal with advanced incident response, security operations, security analytics, and be able to understand and correct data that is useful to the organization.
Technical-minded employees are harder to find than those with high-level security knowledge. Many companies already have leaders who can speak in broader terms about security but lack the detailed knowledge of how solutions work and ability to advise and guide the business.
Cloud security skills are in especially high demand, says Bestman. Businesses should be on the hunt for security pros who have previously worked with cloud and can engage with business and IT departments to establish risk and manage processes.
However, before they can mature their cybersecurity strategies, companies must first establish strong service management capabilities.
Too often, we assume the basics are in place when theyre not, says Shearer. For example, too many organizations still wrestle with automated patch management for servers, desktops, and mobile devices. You have to get the basics working really well and build off of those successes.
So how are businesses handling the skill shortage?
I dont think theyre coping at all with it, says Kushner, noting that technical positions remain unfilled for long periods of time. This often creates retention problems as existing security staff must compensate for the shortfall, which results in longer work hours and heightened stress.
In order to secure top talent, businesses need to improve their hiring strategies. This starts with posting a strong and effective job description.
A lot of times when people are building job descriptions, theyre not thinking about how the prospective candidates are viewing the opportunity, Kushner explains. When job descriptions arent written well, theyre written in ways where the assumption is the targeted candidate is either not working or dissatisfied.
Compensation is a key factor. Oftentimes companies dont meet expectations when they try to recruit outside talent. Either the job description makes candidates feel underqualified, or compensation doesnt match the level of expertise they hope to gain.
Certifications can be helpful to ensure candidates are qualified, but the best ones vary depending on the role, says Bestman.
Some certifications have stood the test of time; for example, the CISSP and CISM are all highly respected and viewed as staples to mid- and senior-level positions. Specific certifications include the CISA for audit skills and Tigerscheme for penetration testing.
Shearer recommends looking for employees with security experience, which is a strong indicator of their abilities.
Have they thrown their hat in the ring for the tough assignments? This lets you know the degree to which their resolve has been tested, he says. Attitude is also very important. People with the attitude that they can learn or do just about anything frequently do just that.
This allows businesses to dive into specific skills, depending on what they need; for example, a pen tester, infrastructure security architect, cloud security lead, or secure software developer.
Working Around The Gap
If your business is still hunting for talent or cant afford to hire a technical security expert, there are steps you can take to improve your security strategy.
Organizations need a comprehensive cybersecurity plan that includes policies, governance, and operation excellence for cyber, information, software, and infrastructure security, says Shearer.
Given the amount of best practice frameworks available, he recommends businesses adopt and operationalize an existing framework instead of developing their own. Options include IT Service Management (ITSM), COBIT for a complementary governance framework, and the National Institute of Standards and Technology (NIST) Risk Management Framework.
Automated patch management also helps, he says. While its helpful to aggregate logs and use tools like security information event management (SIEM) technologies, this is only useful if there is sufficient staff to act on their findings.
Bestman advocates educating employees on best security practices.
Implementing a good security awareness program within an organization is crucial, he emphasizes. This educates all users, whether theyre in business or IT, to ensure security is everyones responsibility and not just the CISOs.
Organizations hoping to compensate for a talent shortage or small security budget may appoint a security awareness officer to educate key stakeholders and everyday users. This wont prevent every breach, but it creates a culture of awareness and emphasizes how security is everyones responsibility.
Related Content:
Security Staff Shortages Incur Higher Breach Recovery Costs
Cybersecurity Skills Shortage Puts Organizations At Risk, Study Shows
5 Failsafe Techniques For Interviewing Security Candidates
The Cybersecurity Talent You Seek May Be In-House

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
How IT Departments Can Manage The Security Skills Shortage