Why the Cybersecurity Skills Gap Continues to Widen
“In today’s COVID-19 reality, to rectify the continued cyber skills shortage, organizations are being encouraged to realign their focus to candidates with aptitude, attitude and broad experience.” Steve Durbin, Managing Director, ISF
With employees preparing for long-term remote work that is likely to stretch into 2021 (and possibly beyond), cyber-threats are a growing concern. That means cybersecurity is increasingly valuable to businesses looking to stay afloat during uncertain times.
And yet the cybersecurity skills gap remains, with important positions unfilled.
The reasons for this skills gap, along with all those open positions, are numerous, but a recent survey conducted by Enterprise Strategy Group (ESG) and the Information Systems Security Association (ISSA) finds that many cybersecurity workers feel constrained by a lack of career development and training offered to them.
At the same time, security pros believe that organizations lack strategic planning when it comes to cybersecurity. The result is that enterprises that need highly-skilled and motivated employees to ensure the business is secure are not taking the right steps to nurture the talent needed to make that happen.
“The data uncovered in this research year-over-year also demonstrates that there are multiple issues contributing to the problem of ‘a cybersecurity skills gap,’ including that businesses don’t understand the role of information security, there is no clear and agreed upon career map within our profession, and cybersecurity professionals are under constant stress of attempting to improve collaboration efforts with IT,” Jon Oltsik, senior principal analyst and fellow with ESG, wrote in the report titled The Life and Times of Cybersecurity Professionals 2020.
Cybersecurity Skills by the Numbers
The survey is based on interviews with 327 cybersecurity professionals and ISSA members, with the majority working in North America and others representing Europe, Asia, and parts of Central and South America.
Of those surveyed, seven out of 10 report that their organization has been affected by the worldwide cybersecurity skills shortage. What’s more, around 45 percent believe that skills shortage has gotten worse over the past year, while 48 percent believe it has stayed about the same. Only 7 percent believe there’s been an improvement.
One reason for this muddied view of cybersecurity is that about 68 percent of those surveyed don’t believe they have a well-defined career path. When asked, about 52 percent of participants think that hands-on skills count the most, while 44 percent believe that hands-on experience (combined with certifications) are equally important.
Steve Durbin, managing director of the not-for-profit Information Security Forum, believes that one of the major issues with this skills gap is a disconnect between human resources and the security teams. Simply put, HR doesn’t quite realize which cybersecurity skills are important, and the demands that protecting the enterprise from threats (both internal and external) have on cybersecurity professionals.
“This hinders the organization’s ability to identify relevant talent and provide adequate support for the professional development of the security workforce,” Durbin told Dice. “To bridge the divide, the information security function needs to adopt a series of well-established HR concepts. Workforce planning, the adoption of competency frameworks, along with a well-structured workforce management program, also known as talent management, are fundamental to the future success of attraction and retention strategies.”
COVID-19 Adds to the Security Headache
The ESG and ISSA study was conducted in late 2019 and early 2020, which means the survey’s results likely missed the effects that COVID-19 is having on the cybersecurity profession. The pandemic has unleashed more stress on security pros trying to ensure workers and data stay safe outside the confines of the traditional corporate IT network.
Even before COVID-19 hit, however, the skills gap was getting wider, and open positions more numerous.
A November 2019 report by the International Information System Security Certification Consortium, (ISC)², found that, while there were approximately 2.8 million security professionals working worldwide at the time, another 4 million trained professionals are still needed to close the cybersecurity skills gap. That’s an increase of 145 percent.
Durbin believes that, in the world of COVID-19, enterprises and organizations need to rethink their approach to how they recruit and hire cybersecurity professionals. He recommends businesses develop champion or ambassadorial programs to reinforce the value of a career in information security, as well as consider new methods to encourage the recruitment of competencies and skills that are under-represented in the organization.
“In today’s COVID-19 reality, to rectify the continued cyber skills shortage, organizations are being encouraged to realign their focus to candidates with aptitude, attitude and broad experience,” Durbin said. “Redefining candidate requirements will enable organizations to expand their group of potential candidates, helping to build tomorrow’s security workforce in a cost-effective and timely manner.”
He added: “To build a sustainable security workforce, organizations should adapt to market demands by seeking candidates with diverse competencies and skill sets coupled with providing competitive benefits and structured career development. For some these changes are already underway but for the majority, the approach is still new and untried.”