April 24, 2017 By Douglas Bonderud 2 min read

The cybersecurity skills gap is widening. IT governance firm ISACA estimated a global shortage of 2 million security experts by 2019. Already, more than 40,000 IT security jobs are left unstaffed in the U.S. every year, even as companies look for ways to increase compensation, improve benefits and bring in new hires, explained Cyberseek.

Part of the problem? Even with universities and private training firms increasing the variety and volume of offered security courses, the market simply can’t keep up with continuing data breaches and evolving malware. More potential hires are looking to build out their resume with cyber experience — but how do companies ensure new recruits have the abilities to match their application accolades?

Testing, Certification and More

Certification programs now exist for a host of cybersecurity skills, but extending an offer to new hires based on classroom skills alone is a risky bet: Associations Now chronicled that 37 percent of companies surveyed said less than one-quarter of all applicants were actually qualified to take on organizational security roles.

To both address the cybersecurity skills gap and help companies identify the best candidates, ISACA developed a new toolset — known as the CSX Training Platform — that challenges prospective security pros with complex scenarios and live incidents to manage.

Of most interest to corporate HR departments and IT admins who need to onboard new staff is the platform’s two-hour assessment tool, which includes “a real firewall, a real DMZ, a real web server, a real database server, whatever the configuration happens to be,” Frank Schettini, ISACA chief innovation officer, told Associations Now.

As a result, HR and IT are able to quickly and easily determine a potential candidate’s ability to handle cybersecurity issues in real time, with a tool that effectively mimics actual attacks or outages. In addition, the platform is accessible anywhere and from any device, allowing managers to easily asses new hires, monitor training progress, and even enable experience staff to log in and improve their cybersecurity skills.

 

Long-Term Strategy for the Skills Gap

While ISACA’s new testing tool helps identify ideal cybersecurity candidates, it can’t magically create new security experts to reduce the skills gap at large.

Addressing that challenge requires a two-pronged effort: Many post-secondary schools are now adopting security-focused IT tracks that give students critical training in real-world security management, and the development of advanced AI and automation tools are bolstering corporate ranks, allowing current security experts to embrace specificity in their roles. While it’s unlikely that cybersecurity cyborgs will ever take the place of human experts, why should companies waste time and effort on straightforward functions such as data collection, aggregation and reporting?

The cybersecurity skills gap isn’t going away — right now, companies and post-secondary institutions are playing catch up to fill vacant positions and address the increasing risk of network breaches. ISACA’s new tool is a critical stopgap: A way for HR teams to ensure that new security hires can both talk the talk and walk the walk when it comes to defending corporate IT interests.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today