I hesitated before writing this article.
So many people have written so much about this “skills shortage” from so many different angles. It’s a complex situation with several different layers, and there have been many initiatives that have aimed to address it. So why write yet another column?
So much thought and effort has been poured into this topic, and yet the facts on the ground are only getting worse. For example, only ten percent of cyber-security professionals are women, a massive loss of unrealized potential and an untenable discrepancy. The shortfall over the next couple years is predicted to reach millions of unfilled openings.
In order to better understand this gap, Check Point Software Technologies recently surveyed 450 IT professionals across the world, asking them questions about their challenges in managing their organizations’ security.
The results were startling. We found that 77 percent of all respondents were concerned with their security teams’ capabilities to deal with current and future cyber security challenges. When asked for the reasons for these concerns, 67 percent expressed that their teams lack the cyber-security knowledge and expertise required to handle the current level of cyber-attacks.
This human capital vulnerability is affecting everyone from the largest multinational enterprises to small business and nonprofits. Small businesses in particular are vulnerable, as 86 percent of the thirty million small businesses in the United States do not have dedicated cyber-security staff. Cyber-criminals are well aware of this gap – it’s a big reason why 70 percent of their attempted attacks on small business succeed in accessing confidential company data.
I can’t shake the sense that there’s a major element of this situation that isn’t being addressed, an element equally critical as repairing the talent pipeline. We need to determine whether our industry’s existing, exceedingly complex products are truly helping teams do their jobs.
Is it a people problem?
The cyber-security industry is booming with new technologies and products.
These products or solutions vary from technologies that assess an organization’s risk and vulnerability levels, to tools that monitor and analyze a current attack surface and reports back when it is under attack, and countless other products that remediate, confront or prevent attacks as fast as possible.
From the vast amount of meetings with our customers around the globe, we’ve noticed that CISOs (Chief Information and Security Officers) tend to manage around ten to fifteen completely separate solutions for their security. Given the sheer number of technologies that each professional needs to handle, it doesn’t come as a surprise that our survey found that 64 percent of the respondents’ teams expressed difficulty in managing their security workload.
Trying to manage an overload of non-integrated, disparate point products is tying teams up in knots, requiring talent and experience beyond that which is currently available in the workforce. This product clutter is inefficient, counterproductive, and a significant contributing factor to the cyber-security professional talent gap.
Consolidating to cut complexity
As part of our survey, we asked IT professionals about their experiences using multiple point security solutions versus using a consolidated solution from a single vendor.
Is it better to pick and choose a variety of products, or is it better to stick to a singular, comprehensive, consolidated product from one vendor for simplicity’s sake? Survey results revealed that a consolidated security approach lead to significantly lower staffing challenges.
Only 38 percent of respondents in the point solution group felt like they had enough resources to manage their workloads, while over half of the consolidated security strategy group felt prepared.
Similarly, and even more remarkably, 61 percent of the ‘point security’ solution group identified their staff’s lack of security expertise as the main culprit. Meanwhile, nearly two-thirds of the ‘consolidated’ group felt like their staff had the expertise to manage their security solutions.
On the surface, a point solution strategy has some appeal – by mixing and matching your favorite products from different vendors, you can employ a diverse, versatile security strategy. Dig deeper however, and the data tells a different story: any benefit from this solution diversity is overshadowed by the increased cost of solution complexity.
Quantity is weighing teams down, causing a labor shortage, while quality is enabling teams to successfully secure their companies.
Managing complex threats with simple products
We, the cyber security industry, need to recalibrate our efforts away from complexity and toward simplicity.
Educational programs and initiatives to provide highly trained individuals are welcome and needed, but as someone from within the cybersecurity industry reflecting on the problem, I think we need to take a long hard look at ourselves and examine the ease of implementation and use of technologies that we are delivering to the market.
Make no mistake: today’s era of cyber-attacks is on a completely different scale. Modern attacks are highly complex and fast evolving, attacking multiple vectors – networks, virtual, cloud, remote office and mobile operations are all fair game. This generation of cyber-attacks, referred to as the fifth generation or Gen V, requires sophisticated, innovative products that react fast and prevent, or block attacks as soon as they happen.
However, this increase in sophistication cannot be at the expense of simplicity and efficiency.
We need to place a much stronger focus on consolidating our solutions to deliver consistent and unified management, so that learning curves are minimized. We must simplify our products, so that high-level analysis of their output by senior engineering talent is not necessary. We must make them meaningful at a business level, and we must invest in methods to automate many of the current manual and time-consuming cyber-security processes and tasks.
We need to “take the bull by the horns” and take an active role in making the products we offer a lot more accessible, intuitive and consolidated for non-specialist users.
Securing your organization against modern threats is complex… managing your security solutions shouldn’t be. And when our industry provides simpler, more consolidated solutions, we will also have gone a long way toward reducing the cyber security skills gap.
[su_box title=”About Gabi Reish” style=”noise” box_color=”#336588″][short_info id=’105307′ desc=”true” all=”false”][/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.