With 'Massive' Cybersecurity Labor Shortage, Will Corporations Compete with Local Governments? (cnn.com) 83
it's high time for companies to start adding cybersecurity professionals to their teams, reports CNN. "The only hitch: There's a massive, longstanding labor shortage in the cybersecurity industry."
"It's a talent war," said Bryan Orme, principal at GuidePoint Security. "There's a shortage of supply and increased demand."
Experts have been tracking the cybersecurity labor shortage for at least a decade — and now, a new surge in companies looking to hire following recent attacks could exacerbate the problem. The stakes are only growing, as technology evolves and bad actors become more advanced. In the United States, there are around 879,000 cybersecurity professionals in the workforce and an unfilled need for another 359,000 workers, according to a 2020 survey by (ISC)2, an international nonprofit that offers cybersecurity training and certification programs. Globally, the gap is even larger at nearly 3.12 million unfilled positions, the group says... The U.S. Bureau of Labor Statistics projects "information security analyst" will be the 10th fastest growing occupation over the next decade, with an employment growth rate of 31% compared to the 4% average growth rate for all occupations.
If demand for cybersecurity professionals in the private sector increases dramatically, some experts say talented workers could leave the government for more lucrative corporate jobs — a risk that is especially acute for smaller, local government agencies that manage critical infrastructure in their communities but have limited budgets. "Think of the criticality of what your local government does: water purification, waste treatment, traffic management, communications for law enforcement, public safety, emergency management," said Mike Hamilton, chief information security officer at Critical Insight. "But Amazon is out there waving around bags of cash to protect their retail operation." Hamilton — who was the former chief information security officer for Seattle, Washington, from 2006 to 2013 — added that local governments "cannot attract and retain these people when the competition for them is so high, which is why we've got to make lots of them."
The article notes educational training/up-skilling programs working to address the shortage, including GuidePoint, which helps train veterans leaving the military for cybersecurity careers. CNN also notes U.S. President Joe Biden's $2 trillion American Jobs Plan included $20 billion for state, local and tribal governments to update and improve cybersecurity controls for their energy systems.
"Still, experts say more needs to be done, suggesting a broad rethinking of education systems from elementary school through higher education to include more cybersecurity training."
Experts have been tracking the cybersecurity labor shortage for at least a decade — and now, a new surge in companies looking to hire following recent attacks could exacerbate the problem. The stakes are only growing, as technology evolves and bad actors become more advanced. In the United States, there are around 879,000 cybersecurity professionals in the workforce and an unfilled need for another 359,000 workers, according to a 2020 survey by (ISC)2, an international nonprofit that offers cybersecurity training and certification programs. Globally, the gap is even larger at nearly 3.12 million unfilled positions, the group says... The U.S. Bureau of Labor Statistics projects "information security analyst" will be the 10th fastest growing occupation over the next decade, with an employment growth rate of 31% compared to the 4% average growth rate for all occupations.
If demand for cybersecurity professionals in the private sector increases dramatically, some experts say talented workers could leave the government for more lucrative corporate jobs — a risk that is especially acute for smaller, local government agencies that manage critical infrastructure in their communities but have limited budgets. "Think of the criticality of what your local government does: water purification, waste treatment, traffic management, communications for law enforcement, public safety, emergency management," said Mike Hamilton, chief information security officer at Critical Insight. "But Amazon is out there waving around bags of cash to protect their retail operation." Hamilton — who was the former chief information security officer for Seattle, Washington, from 2006 to 2013 — added that local governments "cannot attract and retain these people when the competition for them is so high, which is why we've got to make lots of them."
The article notes educational training/up-skilling programs working to address the shortage, including GuidePoint, which helps train veterans leaving the military for cybersecurity careers. CNN also notes U.S. President Joe Biden's $2 trillion American Jobs Plan included $20 billion for state, local and tribal governments to update and improve cybersecurity controls for their energy systems.
"Still, experts say more needs to be done, suggesting a broad rethinking of education systems from elementary school through higher education to include more cybersecurity training."
Quality [programming] education. (Score:4, Funny)
We need some training camps and certification mills to meet the increasing demand. Hey it works for doctors and lawyers.
Re: (Score:2)
I mean it would work to an extent. Lower quality at a tradeoff of having legal and medical help more available might be a worthy tradeoff, so long as you still measure that the resulting doctors and lawyers meet measurable standards of competency.
Re: (Score:2)
I have a couple of certifications and could hold more if I wanted to. The thing with the cybersecurity certifications are that they're basically bullshit. They test knowledge in an age where knowledge is ten seconds on Google away. One of the ones I hold literally tests if you correctly memorized its definitions of terms, despite the fact that there are very few terms in cybersecurity that actually have a globally accepted definition and everyone makes up their own variation. (yes, an ontology in cybersecur
Re: (Score:2)
Re:Quality [programming] education. (Score:4, Insightful)
Still waiting... (Score:3, Funny)
... for anyone in charge to actually give a shit about security, and not just PR.
And I'll still be waiting patiently when you come back groveling for my help.
Re:Still waiting... (Score:5, Insightful)
... for anyone in charge to actually give a shit about security, and not just PR.
Show me the manager or bureaucrat who was promoted for implementing good security.
If you do it right, it goes unnoticed but still costs money. So why bother?
Re: (Score:2)
BINGO! Security only gets negative attention, when security ask for resources and/or delay schedules to implement proper security, and of course when things get hacked.
That said, it is sometimes hard to blame businesses, as they cater to their customers' wishes, who often don't give a flying rat's ass about security. I worked with some people in automotive where the manufacturer tried selling advanced security option to their customers, $3K extra for an advanced security package for an internet connected $1
Re: (Score:2)
Insurance and government regulation are both excellent drivers for this sort of thing - as you say, the market itself doesn't really care about "security".
The problem, oddly enough, is the lack of crime. The amount of crime relevant to a specific technological preventative measure must exceed some threshold before it becomes part of the fabric or framework to pay for the prevention.
That threshold is different for each to trigger: insurance usually notices first, as it hits their bottom line over a broader a
Are they good jobs? (Score:5, Insightful)
Do you pay well?
Is there required overtime?
Is there required on-call?
Do you have unreasonable business demands that make it impossible to do maintenance and upgrades?
Do you even have a security budget?
Re: (Score:1)
Re: (Score:3, Insightful)
The more relevant question when it comes to cybersecurity:
Within my position do I hold the ability to tell anyone, even the CEO, "No, we can't do that" with a reasonable explanation, and be supported?
If the answer to that is anything other than "Absolutely." then I say good luck to you. You are not ready.
Go find another gullible moron who will pretend to be "in charge" of security.
Re: (Score:2)
If the answer to that is anything other than "Absolutely." then I say good luck to you.
Oh, no question that they'll say "absolutely".
Try it, however...
Re: (Score:3)
Re: (Score:2)
they allowed anyone to ssh into the cloud instances they setup. He told me not to restrict them because he wanted the developers to work from anywhere.
If I understand you correctly, this is such an utter confusion of a setup that you deserve to get hacked.
Re: (Score:2)
they allowed anyone to ssh into the cloud instances they setup. He told me not to restrict them because he wanted the developers to work from anywhere.
If I understand you correctly, this is such an utter confusion of a setup that you deserve to get hacked.
Uh, "deserve", is rather harsh when it sounds like you are preaching in the Choir Director's face.
Developer data? I'd still slap ssh behind MFA VPN with certs. Cheap layer(s) of insurance.
Like the fucking planet isn't troll-polling for ssh across the web at 10GHz, source routes brought to you by Billboard's Top 100 POP Hits of the Week with Ransey Ransom...
Re: (Score:3)
Were you the one mining bitcoins? Forgive me for asking but something makes me think you might be the villain in this story.
Re:Are they good jobs? (Score:4, Interesting)
The mindset where a security person just says "No, we can't do that" -- even "with a reasonable explanation" -- and thinks that is the end of a discussion is one reason we are in such a mess. Pencil-pushers do not get to dictate like that, especially to the CEO. The whole idea of security is to manage risk, which means informing people of the relevant trade-offs related to security risks.
Security is not the endpoint. It is a requirement, but it is a cost center, not a profit center. There always needs to be a consideration of what the business's other goals are, and how to advance those goals while meeting the security requirements. If your perspective only extends to security questions, then just shut everything down, lock all the doors, light everything on fire, and go home. If you are willing to help discover "this is how we can solve our problems while managing security risks", then you are qualified to advise on security.
Re: (Score:2)
The mindset where a security person just says "No, we can't do that" -- even "with a reasonable explanation" -- and thinks that is the end of a discussion is one reason we are in such a mess. Pencil-pushers do not get to dictate like that, especially to the CEO. The whole idea of security is to manage risk, which means informing people of the relevant trade-offs related to security risks.
Couldn't agree more, and we are quite aligned here. I am afforded to work in some environments where the rules are bit more solidified in mandate rather than floating in mere recommendation or best practice. We usually view exceptions to the rule where you must fully mitigate any risk presented, usually with an alternative that does not reduce the security. I do understand not everyone is afforded that, and that is where many of the challenges lie in business today. Trying to shoehorn in good cybersecur
Re: (Score:2)
Yes, it sounds like you have your head on straight. If a security person says "you cannot do " and has a decent explanation -- listen to them. If they say "and here is a lower-risk way to do what you want" -- make sure they are both paid well and respected. That's a sign of someone who adds a lot of value to the company.
Re: (Score:2)
Meh. Slashdot's "plain old text" isn't. I meant to say "you cannot do <this very specific thing>".
Re: (Score:2)
I try to never "just say no". That rarely does anything but induce pushback and/or resentment. Whenever I can, I try to understand what the actual goal is, then give them an alternative that meets that goal in a more secure manner. I'd say it works about 80% of the time.
I use a car analogy constantly for security:
"Brakes are the antithesis of what a car is supposed to do. Cars go. Brakes prevent them from going.
This gets the idea across that security isn't just about preventing things, it's also about enabling - the car can go faster, further, etc. with brakes, because it helps with control - so properly-
Re: (Score:1)
Re: (Score:2)
Are you being hired as a scapegoat? (Score:2)
There's no shortage, just a retention problem. (Score:4, Interesting)
Or pay them more.
Re: (Score:3)
Pay more? Give them the same advice we give artists. Do it for the love.
Re: (Score:2)
Pay more? Give them the same advice we give artists. Do it for the love.
(CEO) "Dammit! We've been hacked!"
(Underpaid Security Underling) "Ahh...Can't you just feeel the love.."
Re: (Score:2)
(CEO) "Dammit! We've been hacked!"
(Underpaid Security Underling) "Ahh...Can't you just feeel the love.."
I will now be singing "Can You Feel the Love Tonight", "Whole Lotta Love", and "Love Stinks" during every security incident from now on.
Re: (Score:2)
Artists get a certain measure of immortality from their work. A good security professional doesn't get noticed [blogspot.com] because she prevents problems before they occur.
Re: (Score:2)
CEOs should do it for the love. As Jeff Bezos said [fortune.com]:
"I find my work meaningful and fun. I still tap dance into the office."
In fact, why pay CEOs at all?
Re: (Score:3)
Or pay them more.
Until they start paying good cybersecurity people >$125,000/yr this will continue to be a problem. Predictably, industry will probably do what it has always done and settle for incompetents, or maybe go load up H1B visas and pull people in from overseas who will work for far less. (This isn't an indictment of H1B visa folks or immigrants. It's just that highly qualified immigrants don't seem to demand what they're worth because it's still a step up.) I've run into so many absolute fucktards, as we all ha
Re: (Score:2)
reality (Score:2)
Re: (Score:3)
Yes, Wal-Mart would find two adjacent small towns and get them to compete with each other to offer the best tax incentives to put a store there. So the "winner" (more on this below) subsidizes the big-box store but not the small, local businesses, who can't compete and so they can't afford to stay in business.
But it doesn't end there. See, the city also granted the Wal-Mart store a deed re
Re: (Score:2)
Re:There's no shortage, just a retention problem. (Score:4, Insightful)
> Or pay them more.
A good security specialist is largely self-taught and has the equivalent of an engineering PhD in training and experience. Many companies think the pay should be 1/4 that of somebody just out of a 2-year law school.
So they get hacked and make the news.
Insurance companies need to up their game, and it seems like they will soon.
Re: (Score:2)
> Or pay them more.
A good security specialist is largely self-taught and has the equivalent of an engineering PhD in training and experience. Many companies think the pay should be 1/4 that of somebody just out of a 2-year law school.
So they get hacked and make the news.
Agree with all of this.
Insurance companies need to up their game, and it seems like they will soon.
This however, is not the answer.
Old and busted ransomware hits a company and demands a ransom. New hotness is to steal your IP first, then encrypt all your local data for ransom, along with holding your IP hostage remotely. Insurance will pay once. Insurance is sure as hell not going to shell out for your monthly extortion.
Everything from implementing NIST-level security practices to adopting an insider threat program, and hiring competent personnel to manage it all, will still be
Re: (Score:2)
Everything from implementing NIST-level security practices to adopting an insider threat program, and hiring competent personnel to manage it all, will still be necessary. You won't even be able to justify the insurance premiums without it.
So, essentially, what they should have been doing all along.
*sigh*
Re: There's no shortage, just a retention problem. (Score:2)
Have you seen the GSA payscales?
Government salaries in the entire IT sector are totally disconnected from reality. Cybersecurity is even worse because it typically demands an even higher premium.
Re: (Score:2)
You will earn 2x - 3x in the private sector what you earn on the GS pay scale *AFTER* applying the locality pay increases. Government pay is way way way way way way out of wack with the reality of the current labour market.
Yes, you get some benefits. Are those benefits worth $100,000 / year to most people? No they are not.
Re: (Score:2)
This
I know of so many companies looking for security professionals - some of them desperately. And about half of my phone calls with headhunters I cut short by announcing my current salary as the "below this we don't need to continue this conversation" line.
It's amazing at what price companies think they can hire good people - in a seller's market! But when the price of raw materials goes up, they pay what the market asks because there they magically understand that if they don't pay the market price, they
70th Percentile (Score:5, Insightful)
I’ve known a few accomplished professionals in CyberSecurity over the years, and I honestly can’t see how someone in the 70th percentile in the (broader IT) field can possibly be more help than burden even with additional training.
I also fail to see how most organizations (despite their best intentions) will be able to properly address cyber security. Cost is a small part of the equation (well, not really, but let’s pretend). Having proper security means you have additional friction in doing your job, as well as a chain of dependencies that is often far too weak for the task. A truly “secure” system needs almost twice the labor to follow policies.
So, we end up with “best effort” solutions that simply are not. We end up with “that one” vendor that still doesn’t get it or simply prioritizes their own interests above the security of their customers.We end up with systems designed for humans.
Re:70th Percentile (Score:4, Insightful)
Re: (Score:3)
Re: (Score:2)
The magic “right amount of paranoia” is an ever-shifting line. The scary thing (to me at least) is that the rate of change today is huge, and the mitigation measures for advanced threats are extremely limited. Most companies are aware of security today, but implement too many half-measures ([2|M]FA, excessive focus on phishing or patching, etc). I would love to implement a proper document management system for my company, but it simply is not practical for us. (Meanwhile, our asterisk phone sys
Re: (Score:2)
A truly âoesecureâ system needs almost twice the labor to follow policies.
No, it doesn't.
I've built truly secure systems. I also design and implement security processes. It takes a lot of work to design and implement a secure system, and it comes with a few restrictions, but it takes 10% additional labor at most. It does take additional maintenance and administration, 20-50% more, less if you have capable, trained administrators.
What it does need is two things that most companies don't have:
a) an actual understanding of how their people work and what the real-world processes - yo
Re: (Score:2)
Interesting. I can comfortably see that being true for things like SAP/Oracle and their ilk, but when it gets down to things like samba, isolated networks, and all the processes needed for identity management and auditing it has always seemed much worse on the user side. Each piece of security only added 5-10% pain, but you quickly have 5-10 pieces impacting workflow resulting in much bigger productivity losses. This was for solutions that were solving fairly generic problems— nothing deeply related t
Re: (Score:2)
You are thinking "pieces". I am thinking entire systems.
Start with what people actually do and how to express that in IT. Typically, if you design a security system you end up with much fewer pieces than if you tack on pieces one by one. But yes, it's not something your average IT department can do. I'm always happy when I find that a company actually has a systems or software architect, instead of just admins and coders. Most IT departments are essentially ships without a navigator. No surprise they come a
Re: (Score:2)
Can you help me with a more concrete example? How would you design a security system to address modern malware/ransomeware threats? I get “defense in depth,” and I understand how you can design a process that has a high level of inherent security but taking a common case of Word documents stored on a file server for editing by multiple people in the organization prior to being published as a pdf and emailed to a client you are pretty limited in what you can do.
I can see password protecting the
Re: (Score:2)
It depends too much on the specific case to go too much into detail.
But a few examples: If people need to work remotely, you can add a VPN concentrator to your network, then run AD authentication through it, then tack on 2FA for security, then remember that you need to secure the notebooks as well and add endpoint protection, then you need an MDM... and so on.
In a typical company, all these things arrive at different times, evaluated by different people and are added one after the other.
If instead you look
Re: (Score:2)
Thanks for the response. I agree completely on all your examples; simplification is the goal for sure, and not simplification for the benefit of IT but for the benefit of the organization. I think my concern is the parts that remain complex because the process is not consistently definable over time— non-repeated tasks especially.
And, you are right that far too often there is a failure to properly define a process that can be integrated into a cohesive solution.
Re: (Score:2)
I agree that not all complexity can be reduced. I also agree that ad-hoc processes have their place. But not everyone in the company needs to be able to ad-hoc do arbitrary things with arbitrary data.
And, you are right that far too often there is a failure to properly define a process that can be integrated into a cohesive solution.
Probably half the time I design a good solution where previous attempts failed the secret was simply to start by asking what it is they actually want. You know, they come to me saying they need help implementing an MDM, or building a SOC, or rolling out a non-root policy and instead of going with that I ask why
In management, scapegoats get golden parachutes (Score:3)
Re:In management, scapegoats get golden parachutes (Score:5, Insightful)
Security is mostly a human problem, not a technological one.. most attacks include a degree of social engineering. This means that any security that is effective curtails the ability of users to damage the system, which flipped on its side means effective security results in users having a more difficult time doing their jobs.
Thus you end up with a profession where, if things go right, the security people not only incur direct costs but make everyone else worse at their jobs, thus are a very real liability... if things go wrong, they get the blame. There is no winning, only luck and balancing it against the probability of annoying people. Not a great job to have or keep.
Re: (Score:2)
That's why most of them with as consultants. That way they can come in, say exactly what is wrong and make recommendations to fix it, and then inevitably the company doesn't implement them all so there is zero liability. When the inevitable hack happens they get paid to sort it out, not blamed.
Companies want people in house, but as you said it's a mug's game.
Re: (Score:2)
Security is mostly a human problem, not a technological one..
No, it isn't.
most attacks include a degree of social engineering.
No, they don't.
There is a human aspect and there are social engineering attacks. But security is largely a failure state and aside from shoddy quality and lowest-bidder attitudes, the main issue is that the non-failure states are ill defined. With a kernel-level RBAC/MAC system like SELinux, and a properly security designed application software, I can lock down a system so tightly that I can hand you the root password and you can't fuck it up, you can't even disturb the business processes runni
Re: (Score:2)
There's a bunch of sign-in systems on the market much more convenient and at the same time more secure than the tedious 2FA that is now being rolled out everywhere, for example.
Could you give an example or two? Are they hardware-based?
Re: (Score:2)
MobileIron has something built into their MDM calles Zero Trust, for example. That's a software solution. There are hardware tokens and smartcards, of course, but they largely didn't make it (one exception may be the Austrian e-card which you can use to digitally sign documents in a way that by law is equivalent to a physical signature.
nah, huge cybersecurity corporations will emerge (Score:2)
risky career (Score:1)
If there is a breach on your watch, does it ruin your career? Sometimes it's not even your fault, such as the org not spending on a needed resource. But, you may still get the blame.
So we should increase H1B limits? (Score:3)
Re: (Score:2)
China is ready to ship 1,000,000 cyber security professionals to "help" America to overcome this shortage of cybersecurity professionals. Just have to give them H1B visas, or better yet, let them work from home in China.
You tried to play the China card, but it is actually India that have the most H1B going to the US, and have millions more ready to go.
Obvious reasons being that:
English competency among general Chinese graduates is lower than the general Indian graduates.
Indian general manufacturing industry is way behind China, meaning IT is one of the few well paying fields in India, thus have a high proportion of graduates going into it.
Chinese top tier cities have living standards and wages getting quite close to US lev
if theres a shortage (Score:2)
whats the salary?
Pay people better and pay for their school (Score:2)
Who am I kidding, they'll bring in H1-Bs. And we'll let them because we're distracted with the Culture War.
and sadly (Score:2)
And sadly my company hiring for those jobs, but only for third shift - in office type duty.
Which after 25 years in the industry, isn't happening without a _strong_ financial incentive.
Maybe drop the background checks. (Score:2)
Re: (Score:2)
Stuff like that makes me think the U.S. never learned from incidents like deporting Qian Xuesen https://en.wikipedia.org/wiki/... [wikipedia.org]. We're so paranoid about fake security threats, we ignored real ones that would be created.
No (Score:2)
Just like the trucker shortage... (Score:2)
There was no trucker shortage when the job sucked less and paid well for what did suck.
Work sucks. That's why money or barter is offered to pay for it. Pay what the market will bear and the market will deliver.
Fail to pay that AND despise your workers as an expendable cost center and those who have a choice will catch on then run for greener pastures.
No. (Score:2)
They won't compete. Because governments (local, state and national) will buy "off the shelf" solutions from corporations. Even if those solutions end up losing massive amounts of data to foreign intelligence (I'm thinking of the OPM subcontractor hack [wikipedia.org]). Sure, they may get their knuckles rapped. But once everyone forgets, Congress will push the work right back out the door. And they'll do it all over again.
You can't fix this until you stop Congressional reps from having financial stakes in the subcontractor
No, they won't. (Score:2)
Which won't make them any more secure... (Score:1)
... but will shift liability.
Re: (Score:2)
Is this post for real?? (Score:2)
You already earn 2x-3x the salary working in the private sector in this area.
This post is living in an alternate reality if it pretends that's not the case already.
Cybersecurity is a shit gig (Score:1)
With the the idiot policies at the various levels of government (wherever you happen to live) it's an impossible job - that's if you want to do it with any level of professionalism or honesty.
If you just want to jump on the gravy train you can make a lot of money if you can pretend that every level of computing isn't already compromised one way or another.
Having dealt with a good bunch of cybersecurity vendors (and seeing them fail at one level or another) I am not confident that any of them are much more t
wrong focus (Score:2)
I work in cybersecurity, have done it most of my life.
Yes, there's a shortage of talent. That's a direct consequence of two things:
a) "IT as a service" - companies have begun looking at IT the way they look at cleaning or canteens - as a service some unit provides to other units. Yeah, soory. That's not what intelligent, passionate people work in, you know? The very people you want to have walk out of such set-ups, because even if you don't outsource it, you push it to the secondary level with less engageme
What? (Score:2)
Why does the author not know or understand that state and local US governments already pay the private sector for security ? They are also paying private industry for infrastructure.
When will we stop responding to the flawed premise of these articles? If the story was simply âoeWe need more trained IT security staffâ then it would be a valid point, but to paint it as a private industry vs government labor war, then they lost me as a reader.
Its like journalists literally cannot stop themselves from
1 out of 200 is a cybersecurity professional? (Score:2)
In the United States, there are around 879,000 cybersecurity professionals
So one out of ca 190 workers in USA is a cybersecurity professional? That sounds unrealistically high to me unless it includes "AD administrator" and "has the password to the company's firewall".