Cybersecurity expertise and experience are difficult to locate and retain in today's growing cybersecurity field. Fewer cybersecurity experts leads to high salaries, fewer candidate choices, and empty positions at organizations. At the same time, there are too many security tools that don't provide comprehensive solutions, leading to a condition called security overload.
Filling Cybersecurity Positions
ISACA recently issued its report, "State of Cybersecurity 2017," which surveys 633 information security professionals and shows that hiring qualified cybersecurity personnel quickly is still a difficult task. Filling open cybersecurity positions is difficult for 27% of the survey respondents. See the below graphic from the ISACA report.
The respondents were asked how long it takes to fill a cybersecurity position. Only 6% indicated that they cannot fill open positions. The remaining respondents reported that long-term vacancies are normal. Thirty percent of the respondents reported that open positions take at least three months to fill. Twenty-six percent stated that locating an appropriate candidate can take up to six months.
NSA, NASA and NIST Get Involved
Industry experts and federal agencies have repeatedly pushed for the implementation and standardization of the minimum essentials of Information Security, such as security-by-design, cyber-hygiene training, and layered defenses. They want Congress to take notice. The Cyber Shield Act is an idea for improving informed consumer decision making concerning electronic devices, and introduces meaningful dialog between industry and Congress in a manner that shifts the conversation to a productive partisanship.
The Institute for Critical Infrastructure technology (ICIT) published an analysis titled, "The Cyber Shield Act: Is the Legislative Community Finally Listening to Cybersecurity Experts?" The paper discusses how The Cyber Shield Act has the potential to transform critical infrastructure cyber resiliency. It also covers considerations for the creation of meaningful criteria for security ratings, and the value and importance of requiring security-by-design throughout the development lifecycle of devices.
Cisco Recommendations
A Cisco report, "Mitigating the Cybersecurity Skills Shortage" provides useful recommendations that I'll summarize now.
Create a cybersecurity strategy that is developed with the critical business units, then:
Produce a breach plan and advanced cybersecurity skills. You need an incident response plan that defines in advance what the anticipated threats are and the planned responses. Define accountability and responsibilities to avoid gaps and work overlaps. Create cross functional teams that include the expertise necessary to quickly respond to a data breach. Take advantage of cybersecurity courses from vendors, associations, government agencies, and certification groups to improve in-house skills (see my other blog on this topic, "IT Security: Training and Beyond").
Ensure that security issues are on the boardroom agenda. When a breach occurs, don't hide it. Take advantage of the incident. Present your findings, responses, and solutions to the board. This is the time to request a budget increase while the incident is still fresh in their minds.
Don't try to go it alone. Select partners (vendors, VARs, MSPs, service providers) that can augment your security staff, especially after a breach occurs. You need as many qualified personnel as possible. Outside experts may have greater visibility into the breaches because of their broader exposure to security incidents.
