Bridging the Cybersecurity Skills Gap: 3 Big Steps

There is a dangerous dearth of qualified Information Security talent in industry today. In the face of mounting threats and an unprecedented number of data breaches, organizations and governments simply aren't coping. Cybercrime is growing rapidly as sophisticated, targeted attacks flood in from diverse sources.

The exploitation of vulnerabilities has a very real economic toll that's often underestimated. Economic growth is restricted and job losses are common. For example, a study by the Center for Strategic and International Studies put the loss to business from cybercrime between $375 billion and $575 billion in 2013 alone. And yet, the industry is singularly unprepared to meet the challenge:

Clearly it's vital that something be done to redress the balance and make a career in cybersecurity more desirable. Here are three suggestions:

Clearly define job titles
Finding the right security expertise to enforce internal policies is not easy and the waters are muddied by a lack of standardized career definitions. Job titles differ from country to country and even from organization to organization. This makes it hard for employers to find the right talent, but it's also off-putting for graduating students who want to step onto the first rung of a career ladder.

Standardized job titles would help create a framework where skills sets and expectations can be clearly delineated. It would make it easier for prospective employees to target the skills and experience they really need. Common definitions would also boost the international flow of talent and foster cooperation between peers.

Build a career framework
The Information Systems Security Association (ISSA) has identified a career framework definition in the shape of the Cybersecurity Career Lifecycle (CSCL), but it can't be achieved in isolation. The industry must participate and help shape this framework to deliver clear career ladders for incomers to climb.

It’s important to note that this framework doesn’t necessarily map a direct path to a job as a CISO. There are a variety of rewarding careers in security, and an executive position will not be desirable or suitable for everyone. However, setting out clear career maps with room for growth and advancement in different directions is key to attracting more talent into the cybersecurity sphere. It's a fast-paced, challenging industry and there's no reason it shouldn't attract a more diverse talent base. But they need to be able to see a way in.

It's also important for organizations to be able to shop around for the skills they need and hire with confidence, which is also a strong argument for the establishment of accepted standards for assessments of security professionals to determine career levels and skills. Accreditation in specific areas needn't be confined to security specialists, either. Opening up security training for employees in other departments working with these systems on a daily basis also makes a great deal of sense.

Integrate InfoSec knowledge with IT infrastructure
Throwing money at security software is not the answer. To be effective, information security must be properly integrated with your infrastructure and configured correctly. So, to get a real return on investment you need people with security expertise to leverage that software and extract real value from it.

Think of it this way: a shortfall in knowledge and skills could actually be the greatest vulnerability in your organization.

Establishing clear pathways into the industry, standardizing jobs, and assessing skills requires industry-wide consensus and earnest collaboration. The stakes are high. No one is predicting a decline in cyber-attacks. The problem is only going to grow. It's time we worked together to solve it.

[Read about How The Skills Shortage Is Killing Defense in Depth]