How Security Vendors Can Address the Cybersecurity Talent Shortage

Numerous reports show current unfilled cybersecurity jobs in the hundreds of thousands in the US alone, with with (ISC)² forecasting a shortfall of 1.8 million by 2020. As the dearth of cybersecurity skills continues, it is considered to be among the top cybersecurity risks for many organizations. 

Filling this gap is imperative, and it is too big for any one sector or organization to do alone. Cybersecurity vendors have a role to play and a responsibility for closing the cybersecurity skills gap that goes well beyond providing training on products and solutions.

The Pressure Is On
Security operations teams are feeling the crunch of this critical cybersecurity workforce shortage. They are overworked and understaffed, which can often result in either not adhering to best cybersecurity hygiene practices or careless errors in caring for network and security resources.

It's no wonder that, according to Ponemon's "2018 Cost of a Data Breach" report, 70% of data loss now occurs because of misconfigured cloud storage servers, databases, networks, and even firewalls. Today's data leaks caused by negligence now happen half as frequently as security attacks, with breaches due to such lapses having increased by well over 400% over the previous year.

Training All Audiences
While most efforts to address the talent shortage are centered on expanding technical skills to fill cybersecurity jobs, we need to be aware that the cybersecurity skills gap goes far beyond the job market for cybersecurity professionals. One of the biggest cyber-risks in today's workplace is a general lack of awareness of even the most basic attacks, such as phishing emails and other social engineering techniques. And that is due to a failure in understanding that cybersecurity is everyone's job, and organizations need training and education programs that address many different audiences.

What cybersecurity vendors are usually quite good at is creating training programs to equip customers and partners with the knowledge and skills required to operate their own products. This is certainly critical as cybersecurity solutions become more sophisticated. However, cybersecurity vendors that truly want to become trusted advisers for their customers need to adopt a training and education strategy with a much wider focus than their own products and solutions. A comprehensive strategy needs to include training and education programs designed for:

Fill the Gap
Formal programs are a necessary element to filling the skills gap, but a comprehensive training and education strategy must include strategic partnerships within government, academia, and NGOs. For cybersecurity vendors, this provides a means for their subject matter experts to share their knowledge and vision with thought leaders and the next generation of cybersecurity experts.

The world's organizations are facing a significant issue on the verge of a crisis. The cybersecurity skills gap is about much more than HR having a hard time filling open positions; it is a looming existential threat to the ongoing viability of those organizations. That's why it has become a priority for security operations.

Closing the skills gap involves educating not just those within the education system or the future work force but also current employees who may be unwittingly weakening the company's security posture. Cybersecurity vendors have a responsibility and a role to play in helping with education in all contexts, extending their ability to train and educate customers and partners to a wider audience for the sake of stronger cybersecurity at a societal level.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.