How cyber pros can stay on top of their game

Although demand for information-security professionals continues to grow across all sectors, there is added pressure to ensure that government InfoSec specialists have the requisite skills and experience to do the job right.

“It makes sense that organizations would want the most experienced person for the job, and as they sort through hundreds of resumes, they need ways to quickly sort the wheat from the chaff,” explained Casey Ellis, CEO and founder of Bugcrowd, a crowdsourced testing platform for enterprise security. Although as Ellis points out, with an estimated one million unfilled information security positions, “this is a very limiting approach, not only to finding talent in the short term, but for the future labor pool.”

And that extreme demand for talent complicates issues when it comes to InfoSec hiring in government. “Cybersecurity is a burgeoning field with a need for specialists in numerous areas,”  said Richard Spires, CEO of Learning Tree International and a former CIO at the Department of Homeland Security and the Internal Revenue Service. As an example, Spires points out that the National Institute of Standards and Technology, for example, defines seven categories in the National Cyber Security Workforce Framework and, within those categories, 32 specialty areas in which descriptions of knowledge, skills and abilities are provided.

“Given the war for talent, skilled cyber security professionals with real-world government experience are also highly sought after in the private sector.” Spires said. 

Cynthia James, general manager of KGSS, the exclusive provider of Kaspersky Lab’s real-time cyberthreat intelligence to the U.S. government, argued this lack of IT information security talent and experience and thinly stretched resources may be making it even more difficult for would-be rising stars to exert their true potential. According to the Kaspersky Lab 2016 Corporate IT Security Risks survey, most businesses [large and small, spanning various industries] do not have the full-time security expertise to properly handle a cyberattack on their own.

“As the U.S. government shares many of the same challenges businesses face, it’s important to note that only 15 percent of the employees in an IT department of a large company are dedicated to security, which means only 39 specialists in a typical team of 220 experts are managing all aspects of the infrastructure,” James said.

It’s not as though the government is unaware of the demand, if not the battle for qualified InfoSec professionals, according to Andy Vallila, leader for Americas sales and marketing for One Identity, the security business under Quest Software. “In federal government, cybersecurity workforce recruitment has been top of mind,” he said. “Yet, as threats remain on the rise, the workforce thins.”

To that end, NIST’s Commission on Enhancing National Cybersecurity in December 2016 recommended to not only improve recruitment of cyber professionals in federal government, but to successfully recruit the cream of the crop. “The most successful security professionals continually broadened their skillsets to evolve and adapt to the latest trends like cloud and mobile,” Vallila pointed out. InfoSec professionals must expand their horizons, “instead of assuming that the skills that got them the job 10 years ago are the skills that will keep the job today.”

Industry insiders said government cybersecurity staff need not only the acumen and the skillset to understand the overarching cybersecurity threats that an agency may face, but also an understanding of the particular threats targeting the public sector.

“It’s absolutely critical for InfoSec pros in government to understand that they are unique targets compared to their private sector colleagues,” said Richard Henderson, global security strategist at endpoint security and data risk management company Absolute. “Hacker groups funded by unfriendly countries have likely already scanned and probed the public-facing parts of [government] networks. Intelligence agencies from abroad … may already have spent time determining what sorts of interesting data you keep and how it could be used.”

Getting the right certifications

But when it comes to certifications -- that string of hard-earned acronyms after an InfoSec professional’s name -- Henderson said it is critical to be selective. “It’s important to remember that not all certifications are created equal,” Henderson says. “It’s almost always better to focus on courses and certifications that teach you real-world technical skills.”

Based on his experience in the public and private sectors, Spires said he believes the best qualified InfoSec professionals are the ones who take three steps:

• Develop an individual development plan, with a five-year objective that takes into account the framework and specialty area requirements.
• Obtain appropriate certifications, many of which are offered by organizations including (ISC)2, ISACA, EC-Council, Cloud Security Alliance and CompTIA
• Build a strong professional network outside of your own agency.

“Work to get involved in some level of interagency work and also get involved in professional organizations that are relevant to your particular specialty in cybersecurity,” Spires added. “You can start by getting involved with the organizations that offer the professional certifications you pursue.”

KGSS’ James recommends that committed InfoSec professionals seek “continuous education to improve their skills and experience in order to better manage the ever-evolving cyberthreat landscape.” In specific, she suggests that professionals regularly attend cybersecurity conferences with training workshops to learn and share information with other InfoSec professionals. They should also consider security certifications to advance their careers, such as the Global Information Assurance Certification, which is highly recognized by government and military leaders, Certified Information Systems Security Professional, Systems Security Certified Practitioner, EC-Council Certified Security Analyst training and CompTIA Security+ certification.

Another option is provided by the Department of Homeland Security, which offers cyber professionals a number of courses to advance their careers (as well as more basic courses for all government workers).  And according to Vallila, “there are also innumerable events both in the DC area and around the country where you can learn from other cyber experts and network to stay close to the latest advances in cybersecurity.”