Cyberspaced: what to do when a skills gap becomes a chasm

At the end of March, the Depart­ment for Dig­i­tal, Cul­ture, Media and Sport warned that 39% of busi­ness­es had report­ed expe­ri­enc­ing cyber attacks or breach­es of data secu­ri­ty in the pre­ced­ing 12 months. In its Cyber Secu­ri­ty Breach­es Sur­vey 2022 report, it urged organ­i­sa­tions to strength­en their defences. 

Yet this is far eas­i­er said than done. The num­ber of unfilled cyber­se­cu­ri­ty jobs world­wide grew from 1 mil­lion to 3.5 mil­lion in the eight years to 2021, accord­ing to research by Cyber­se­cu­ri­ty Ven­tures – and this gap is unlike­ly to close any time soon.

In the UK, the cyber­se­cu­ri­ty work­force shrank by 65,000 last year, leav­ing a short­age of 33,000 peo­ple, says Clar Rosso, CEO of not-for-prof­it secu­ri­ty train­ing and cer­ti­fi­ca­tion body (ISC)².  

The con­se­quences for organ­i­sa­tions that have strug­gled to find suf­fi­cient­ly skilled cyber­se­cu­ri­ty pro­fes­sion­als, she notes, have been alarm­ing.

“What we find is that they are expe­ri­enc­ing mis­con­fig­ured sys­tems. They’re not spend­ing enough on risk assess­ment and man­age­ment. They’re slow to patch crit­i­cal sys­tems and they’re rush­ing deploy­ments of new tech,” Rosso says. “The Rus­sia-Ukraine con­flict and the height­ened cyber alerts; the zero-day vul­ner­a­bil­i­ty in the Log4j Java log­ging util­i­ty that emerged in Decem­ber; the recent breach at [ID man­age­ment spe­cial­ist] Okta – all these things are mak­ing the sit­u­a­tion even worse.”

Cer­tain roles are prov­ing par­tic­u­lar­ly hard to fill. The US Com­put­ing Tech­nol­o­gy Indus­try Asso­ci­a­tion (Comp­TIA) has high­light­ed spe­cialisms such as pen­e­tra­tion test­ing, audit­ing, risk man­age­ment, gov­er­nance, cryp­tog­ra­phy, social engi­neer­ing and the devel­op­ment of defence sys­tems that use arti­fi­cial intel­li­gence.

“In some cas­es, the rate of change in these fields is out­pac­ing the speed at which addi­tion­al cyber­se­cu­ri­ty pro­fes­sion­als can obtain train­ing, cer­ti­fi­ca­tion and suf­fi­cient expe­ri­ence,” reports CompTIA’s chief research offi­cer, Tim Her­bert. “Beyond the con­ven­tion­al tech­ni­cal or soft skills gaps, there may be per­cep­tion gaps where­by employ­ers try to hire a ‘uni­corn’ can­di­date to fit a very spe­cif­ic mould. There could be loca­tion gaps and there could be pay gaps, which tend to be espe­cial­ly chal­leng­ing for small and medi­um-sized busi­ness­es. And there could be con­fi­dence gaps among stu­dents or career-chang­ers.”

With all these con­sid­er­a­tions in mind, how can organ­i­sa­tions obtain the cyber­se­cu­ri­ty skills they so sore­ly need?

The first step is to define the key prob­lems they need to solve, says James Hadley, CEO of Immer­sive Labs and a for­mer cyber­se­cu­ri­ty train­er for the gov­ern­ment and com­pa­nies in the defence and finance sec­tors.

“Com­pa­nies need to mea­sure where they are with the issues they’re fac­ing and, based on that mea­sure­ment, iden­ti­fy their skills gaps,” he advis­es. “Such gaps could take the form of exist­ing employ­ees who don’t under­stand how their role per­tains to cyber­se­cu­ri­ty, say, but the bench­mark assess­ment could also prove hav­ing a deficit of secu­ri­ty ana­lysts, for exam­ple.”

The most obvi­ous way to gain the nec­es­sary skills is recruit­ment, but the scale of the tal­ent short­age is such that organ­i­sa­tions may need to cast their net more wide­ly than they’re used to. 

The cyber­se­cu­ri­ty pro­fes­sion is noto­ri­ous­ly white and male, with new arrivals in the sec­tor gen­er­al­ly hav­ing a back­ground in IT. Encour­ag­ing appli­ca­tions from out­side this demo­graph­ic can give recruiters access to new pools of tal­ent.

“We tend to see women and peo­ple from eth­nic minori­ties take an aca­d­e­m­ic route into cyber­se­cu­ri­ty. So, if you nor­mal­ly wouldn’t look to uni­ver­si­ties when recruit­ing, seek out peo­ple tak­ing degree cours­es, because you tend to find a more diverse set of can­di­dates on these pro­grammes,” Rosso advis­es. 

Her organ­i­sa­tion con­duct­ed some research in this field last year. One of its con­clu­sions was that peo­ple with more diverse back­grounds are more like­ly to be attract­ed to an employ­er if they can see peo­ple who look like them already work­ing in the busi­ness. This is because “it leads them to believe they can be suc­cess­ful in your organ­i­sa­tion”.

Rossi also advo­cates look­ing beyond pure tech­ni­cal abil­i­ty. Accord­ing to (ISC)²’s 2021 Cyber­se­cu­ri­ty Work­force Study, the most impor­tant attrib­ut­es for cyber­se­cu­ri­ty pro­fes­sion­als to have are strong prob­lem-solv­ing and com­mu­ni­ca­tion skills, plus curios­i­ty and eager­ness to learn – all rat­ed as being at least as impor­tant as pro­fes­sion­al cer­ti­fi­ca­tions and expe­ri­ence.

“I recent­ly spoke with some hir­ing man­agers who told me that if they see some­one who pos­sess­es these skills, they won’t even wor­ry about any short­fall on the tech­ni­cal side. That’s because they can teach the right can­di­dates those skills in house or send them out for train­ing,” she says.

Train­ing up the peo­ple you already employ is the oth­er main way to mit­i­gate the cyber skills gap, of course. Indeed, 42% of employ­ers respond­ing to the (ISC)² sur­vey said that they con­sid­ered this tac­tic to have the great­est impact.

As with recruit­ment, there’s a strong case for iden­ti­fy­ing peo­ple with the right non-tech skills and then giv­ing them the IT knowl­edge they need. 

“We can help to close the skills gap if we work to increase the cyber lit­er­a­cy of employ­ees across the organ­i­sa­tion – peo­ple who aren’t specif­i­cal­ly work­ing in cyber roles but indi­vid­u­als in finance, the legal team and oth­er parts of the busi­ness,” Rosso sug­gests. “If we can increase everyone’s aware­ness, that will reduce the need for as many cyber­se­cu­ri­ty pro­fes­sion­als.”

Achiev­ing this will entail tai­lor­ing people’s train­ing care­ful­ly, Hadley stress­es.

“This is about ensur­ing that the right knowl­edge and skills are aimed at the right peo­ple in the right roles,” he says. “Non-tech­ni­cal employ­ees need some­thing that is mea­sur­ing what deci­sions they would make in a giv­en sit­u­a­tion and how much con­fi­dence they would have in doing so. It should help them to under­stand the risks bet­ter. For mem­bers of the board, I might want to run a half-day facil­i­tat­ing ses­sion around a sim­u­la­tion.”

All these strate­gies will be nec­es­sary, giv­en that the cyber­se­cu­ri­ty skills gap is wide­ly expect­ed to widen even fur­ther.

“Organ­i­sa­tions need to start talk­ing about the fact that this is a long game,” Rosso warns. “There isn’t going to be a mag­ic pill.”