The cybersecurity skills gap is widening. IT governance firm ISACA estimated a global shortage of 2 million security experts by 2019. Already, more than 40,000 IT security jobs are left unstaffed in the U.S. every year, even as companies look for ways to increase compensation, improve benefits and bring in new hires, explained Cyberseek.

Part of the problem? Even with universities and private training firms increasing the variety and volume of offered security courses, the market simply can’t keep up with continuing data breaches and evolving malware. More potential hires are looking to build out their resume with cyber experience — but how do companies ensure new recruits have the abilities to match their application accolades?

Testing, Certification and More

Certification programs now exist for a host of cybersecurity skills, but extending an offer to new hires based on classroom skills alone is a risky bet: Associations Now chronicled that 37 percent of companies surveyed said less than one-quarter of all applicants were actually qualified to take on organizational security roles.

To both address the cybersecurity skills gap and help companies identify the best candidates, ISACA developed a new toolset — known as the CSX Training Platform — that challenges prospective security pros with complex scenarios and live incidents to manage.

Of most interest to corporate HR departments and IT admins who need to onboard new staff is the platform’s two-hour assessment tool, which includes “a real firewall, a real DMZ, a real web server, a real database server, whatever the configuration happens to be,” Frank Schettini, ISACA chief innovation officer, told Associations Now.

As a result, HR and IT are able to quickly and easily determine a potential candidate’s ability to handle cybersecurity issues in real time, with a tool that effectively mimics actual attacks or outages. In addition, the platform is accessible anywhere and from any device, allowing managers to easily asses new hires, monitor training progress, and even enable experience staff to log in and improve their cybersecurity skills.


Long-Term Strategy for the Skills Gap

While ISACA’s new testing tool helps identify ideal cybersecurity candidates, it can’t magically create new security experts to reduce the skills gap at large.

Addressing that challenge requires a two-pronged effort: Many post-secondary schools are now adopting security-focused IT tracks that give students critical training in real-world security management, and the development of advanced AI and automation tools are bolstering corporate ranks, allowing current security experts to embrace specificity in their roles. While it’s unlikely that cybersecurity cyborgs will ever take the place of human experts, why should companies waste time and effort on straightforward functions such as data collection, aggregation and reporting?

The cybersecurity skills gap isn’t going away — right now, companies and post-secondary institutions are playing catch up to fill vacant positions and address the increasing risk of network breaches. ISACA’s new tool is a critical stopgap: A way for HR teams to ensure that new security hires can both talk the talk and walk the walk when it comes to defending corporate IT interests.

More from

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Why Operational Technology Security Cannot Be Avoided

Operational technology (OT) includes any hardware and software that directly monitors and controls industrial equipment and all its assets, processes and events to detect or initiate a change. Yet despite occupying a critical role in a large number of essential industries, OT security is also uniquely vulnerable to attack. From power grids to nuclear plants, attacks on OT systems have caused devastating work interruptions and physical damage in industries across the globe. In fact, cyberattacks with OT targets have substantially…