On the face of it, this is deeply paradoxical. It’s well-paid, it is in high demand among large companies and the people who do it for a living are increasingly seen as high-status wizards with special powers.
But something, somewhere has gone awry and no matter how hard companies and governments across the globe look, there never seems to be enough cybersecurity professionals arriving on the job market to meet demand. Ideas for addressing the skills shortage abound but there is no denying the pervading sense of gloom.
In truth, the cybersecurity skills gap is far from new and has quietly built up over decades. Many of its causes are well documented but the most important reasons can still be a challenge that tends to get caught up in a web of vested interests and narrow perspectives.
Image problem
It starts with the image of what a cybersecurity professional is, and does. In popular imagination, it’s one part rebellious – such Neo in The Matrix or the recent Mr Robot television series – and another part dull, programming desk job. Not surprisingly, many prospective cybersecurity candidates aren’t inclined to recognise themselves in either of these extremes.
It is also seen as a predominantly male profession (despite there being not a shred of evidence that men are better at cybersecurity than women), requiring either a degree in computing or a long-term fascination with computers and hacking techniques.
Expanding the cybersecurity workforce demands an overhaul of this perception. In reality, the budding cybersecurity professional in the hyper-connected age could be anyone with the right technical and analytical skills. This includes graduates with STEM degrees but also, increasingly, any graduate with the ability to think creatively, enter the mindset of an attacker, and resolve nuanced problems quickly.
The obvious engine for doing this is to invest in cybersecurity education at school and university level to expand both the number and type of candidates. In the UK, there are signs that this is already happening with the government recently expanding its cybersecurity funding by £1.9bn ($2.4bn) over five years, with an emphasis on a variety of educational programmes at different levels.
Priming education with money is important but not enough on its own. Other important dimensions include how candidates are discovered and recruited and making sure that the system as a whole - from tertiary education to business training programmes - produces the right range of technical knowledge to satisfy a sector whose skillsets are constantly broadening.
This means expanding apprenticeships where cybersecurity under-graduates can gain the hands-on skills that might have taken years to develop through old hierarchies, as well as re-training existing employees. Adopting either measure could boost workforce numbers quite rapidly.
Organisations also need to look at the way they hire people. Pulling candidates from universities or rivals is the conventional option but industry hackathons and challenges are an alternative now being tried by government to discover people who might otherwise slip through the net.
In addition, many organisations are starting to create joint roles, such as DevSecOps, where the business combines skills to incubate a more joined up approach to security that does not hamper innovation and ability. People who show an interest in innovation will do well in today’s fast paced businesses. Organisations can keep the more technically savvy employees engaged with interesting challenges such as internal hackathons and bug bounty programmes.
Communication overhaul
Arguably, the biggest overhaul of all is what is meant by the term ‘cybersecurity skills’ itself. Traditionally, this has been purely technical, a subset of the same computing knowledge used in other areas of IT but applied to securing it. There is a growing body of opinion that this needs to be combined with the sort of social skills that now seem to define successful companies.
If we accept that cybersecurity has become strategic, the employees doing the job need to understand their corporate business goals, compliance and regulatory mandates (such as Payment Card Industry Data Security Standard) and not simply the technical and security demands it creates. There is no simple way to achieve this but recruiting cybersecurity staff from other parts of the business, including people who have worked in other commercial areas, would be a positive step. Cybersecurity pros should be able to not only understand cybersecurity problems but be able explain them to other people in the business with a non-technical outlook. This implies a future where cybersecurity professionals aren’t simply greater in number but more central to the nature of business itself.
Managed security
All of these prescriptions have the disadvantage of taking time. Investment, education, and recruitment are being improved over time but their fruits could take years to become apparent. The challenge for enterprises and governments alike is that they cannot wait this long.
For this reason, many organisations will need to consider using the existing cybersecurity workforce in the most efficient way possible through additional security services. These aren’t a panacea, but make it possible to access enough of the right type of skills from specialist companies in a way that scales.
Vulnerabilities will continue to be identified and IT professionals will be called into action to ensure environments remain secure. Having a solid security-in-depth strategy, coupled with the right tools and people that understand how to respond, will put an organisation into a position to minimise exposure and risk.
That is why many organisations are looking to managed security services to take this ‘burden’ away from them: investing a proportion (and in some instances, all) of the security or IT budget on external service providers that have a strong pedigree in threat intelligence, security research, content creation and vulnerability management to ensure you can remain one step ahead of even the most advanced targeted threats. From a security analysts’ perspective, working within an MSSP is often extremely attractive as they collect and analyse lots of interesting data that internal SOCs don’t get visibility of – getting to investigate the big threat actors and discovering the latest attack concepts.
The strength of an external partner is that they employ people who see the network’s security objectively, in the same way a hacker might. With no internal politics to worry about and no political investment in past decisions, strengths and weaknesses are more likely to stand out.
However complex today’s cybersecurity challenges seem, by next year or the year after they will have grown more treacherous still. Coping with this requires organisations to fight the cybersecurity skills shortage on every front. It is no longer someone else’s – or tomorrow’s – problem.
The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.