2014 is now being dubbed ‘the year of the breach’ and it is not difficult to see why. Last year sensitive data was being leaked at Google, Apple and most recently at Sony, to name but a few leading tech giants. Security weaknesses have been marked down to a number of key areas such as misconfiguration issues, third party providers, lack of network diversity and most worrying of all, lack of qualified security talent.
The cyber security skills gap is perhaps the underlying issues behind the ‘the year of the breach’ having a knock-on effect on industry and the economy. Cyber security skills are a global priority but, with a lack of consistency in accepted career definitions, organisations are experiencing difficulties in attracting new talent and progressing existing professionals. To offset the skills deficit, talent from the ‘gaming’ industry are being brought into the security sphere and their skills adapted for this arena.
Now in 2015, the information security industry has an opportunity to re-define itself and build on the negative global coverage it observed last year to attract new talent. Investment, employment branding and clearly defined career paths are essential if organisations are to reduce the deficit in the skills gap and avoid seeing their own brand in the papers due to the latest leak.
The Internet Systems Security Association (ISSA) identified the need for an internationally accepted framework that would define the cyber security career for individuals in the profession. To attract new entrants and so that pros can advance in their career, ISSA have developed the Cybersecurity Career Lifecycle (CSCL). This pro-active approach to industry development could go a long way to help fill the estimated 300,000 to 1,000,000, and rising, currently vacant global cyber security positions.
