Serving the country without wearing the uniform

The pinnacle of “serving the country” is putting on the uniform of one of the military services or   through government employment. However, we need to create new ways to serve the country that address our national cybersecurity needs.

After multiple, massive data breaches and an unprecedented election cycle that included accusations of foreign tampering, it's clear that we must push hard for cybersecurity change.

We are in the midst of a global transition to a digital economy. To compete effectively, companies, government agencies and researchers must continuously correlate, analyze and make decisions based on massive amounts of information collected from highly distributed data sources. That leaves decision makers increasingly reliant on an extended digital infrastructure made up of an explosion of new end-point devices, including the growing internet of things, the transfer of traditional network resources to the cloud, free-ranging edge devices, software-defined perimeters and a hyper-connected network of networks that increasingly includes critical infrastructure.

As traditionally isolated information sources are being woven together into a complex ecosystem of remote and often temporary networked environments, they are becoming increasingly difficult to defend. A recent Tripwire survey found that only 17 percent of security professionals believe the government is able to protect itself from cyberattacks. Respondents also had little confidence in the government’s current cybersecurity strategy, with 80 percent saying they were more concerned about digital security in 2017 than they were last year.

More threats, fewer workers

Given the convergence of changes impacting and threatening our digital infrastructure, this is a terrible time for a global cybersecurity talent gap.

It is estimated that there are currently about a million more cybersecurity job opportunities across all industries than there are viable candidates, and that gap is expected to grow significantly over the next few years if nothing is done. In the meantime, growing network complexity has created a field day for cybercriminals. Any data that can be collected can also be stolen, ransomed or corrupted. Because the volume of data continues to grow, and the location of this data is increasingly distributed, the potential attack surface continues to expand. And as devices, data and networks, including critical infrastructure, become increasingly connected, new opportunities for cyberattacks have the potential to cause significant economic and social disruption.

Our country’s economic competitiveness, national security and general well-being are highly dependent on the cybersecurity of the government, critical infrastructures and private institutions.  So we need to make it easy and rewarding for workers to move freely among jobs in the government, critical infrastructure and private institutions (e.g., companies, national labs, universities). By accumulating experiences, developing professional networks and building “muscle memory” of public-private collaboration along the way, this workforce, a “cybersecurity service” if you will, would have an enduring societal influence. Encouraging cybersecurity professionals to move between private and public institutions would not only increase their level of expertise but also provide additional opportunities for personal growth.

The challenge isn’t just a general lack of workers with cybersecurity training. The cyberadversaries we must defend against are often highly skilled and seasoned experts, with a wide range of tools and techniques available to them, designed to bypass basic security devices and novice security technicians.

We need experienced security professionals, combined with seasoned experts, who can build and maintain an effective security strategy. True cybersecurity is as much art as it is science, and standing against today’s advanced cyberthreats requires expert security professionals who know how to engineer secure environments and detect and respond to sophisticated attacks.

To address the challenge, we must employ a more strategic and comprehensive plan to create a world-class talent pool across all sectors, public and private by:

Increasing the speed at which we develop basic expertise: There are a number of efforts already underway to increase the quantity of college-educated computer security professionals. That must continue, if not accelerate. At the same time, the security industry must accelerate the development of advanced certification and training programs to expand and hone the skills learned in college or on the job across a variety of technologies. These first two layers of learning -- education and training -- will produce more entry-level cybersecurity workers.

Creating an environment where we develop world-class expertise: Education and training can only go so far. We also must develop the inherent expertise, experience, contacts and “gut instinct” that only come by working in challenging and diverse assignments. There is no substitute for diversity and overcoming challenges. Cross-sector exposure can be one the most effective ways to develop that expertise. We must develop a progressive apprenticeship and mentoring model that moves aspirants with entry-level experience into positions where they will face national-level challenges in business, national security and research.

Developing such an education-, training- and experience-based strategy will allow us to establish and maintain the critical foundation of seasoned security expertise necessary to defend our country’s cyberspace, regardless of whether those cybersecurity professionals choose to remain in public service, return to the private sector or continue to do both.  

One problem that has limited the movement of private-sector innovators into high-end government cyber organizations, such as the National Security Agency, has been the time it takes to obtain the necessary security clearances. To address that time lag, the country could create a cybersecurity service program where an aspirant could work at the “secret” level in a high-end research institution while a higher-level security clearance is being obtained. Such a pipeline creates experience and expands personal networks, is consistent with how the military services diversify and clear personnel and helps smooth out public-private compensation unevenness across a multi-year period.

The reality is that this new digital world is here to stay. Which is why, in addition to developing cybersecurity graduates, we also need to create a generation of informed, cyber-aware and action-qualified experts to keep the nation safe in cyberspace.

A broad and deep workforce of cybersecurity professionals, from novices to experts, armed with high-end cybersecurity skills and experiences, is essential for meeting both our current and future needs. While we will continue to need people to wear the uniform of the armed forces, it’s also possible to serve the country -- protecting our critical infrastructures and digital resources -- by creating and nurturing a national cybersecurity service.