Finding Solutions: Nurturing a Cybersecurity Workforce for the Digital Age

Addressing the People Problem in Cybersecurity

Raising Security Awareness among Users

Cybersecurity Awareness Month, led by the Cybersecurity and Infrastructure Agency (CISA) and the National Cybersecurity Alliance, serves as a reminder that we all have a role to play in protecting our data. Recent cyberattacks have highlighted the fact that people remain the weakest link in security. Threat actors continue to exploit human nature through phishing emails, text messages, and phone calls to gain access to sensitive data. Organizations need to focus on raising security awareness among users to strengthen their defenses.

Support for Security Awareness Programs

The SANS 2023 Security Awareness Report highlights that while security awareness programs are improving, organizations still face challenges in program development. Lack of budget, limited training time for employees, and insufficient staffing and time for program management are common obstacles. Effective security awareness programs have strong leadership support, dedicated full-time employees, and promote a security culture that encourages incident reporting to mitigate risk.

User Training

The SANS report emphasizes that phishing, passwords/authentication, detection/reporting, and IT admin misconfiguration are the top human risks. Training should focus on these areas and go beyond annual computer-based training by incorporating continuous training to reinforce key concepts throughout the year. Involving security teams in the development of human-focused security training ensures the content remains relevant. Partnering with other departments such as communications and human resources, as well as third-party training consultants, can optimize program effectiveness.

Addressing the Lack of Cybersecurity Talent

In addition to raising security awareness among users, organizations need to address the shortage of cybersecurity talent. The current estimated gap in the US alone is 663,600 professionals. A combination of training and technology can help bridge this gap.

Cybersecurity Professionals Training

Cybersecurity is a continuous learning experience, and organizations should increase their commitment to cybersecurity training to maximize existing resources. Partnering with security technology vendors that offer various training formats, such as in-person, virtual, and self-service, provides flexibility to cater to different business models and security teams.

Security Automation

Security automation allows highly skilled human resources to work smarter, not harder. Research commissioned by ThreatQuotient reveals that security leaders view automation as a way to address high turnover rates and improve employee satisfaction. A balanced approach to automation involves automating repetitive, low-risk tasks to free up analysts for high-impact work. A data-driven approach ensures relevant actions for better security outcomes. Additionally, automation platforms with low-code/no-code interfaces make automation accessible to users with varying skill sets.

Additional New Technologies

New technologies, such as AI, are already contributing to cybersecurity efficiencies. Natural language processing can identify and extract threat data from unstructured text, reducing manual tasks for analysts. Machine learning techniques help make sense of large datasets, accelerating detection, investigation, and response. Closed-loop models with feedback enable AI-capable platforms to continuously learn and improve over time.

Editorial: Strengthening Cybersecurity in the Digital Age

The current state of cybersecurity highlights the urgent need for organizations to address the people problem through effective approaches and tools. It is evident that security awareness among users and a lack of cybersecurity talent pose significant challenges. However, by investing in security awareness programs, continuous user training, cybersecurity professional training, and technology automation, organizations can strengthen their defenses and work smarter against evolving threats.

Nurturing a strong security culture within organizations is essential. Leadership support, dedicated resources, and a culture that encourages incident reporting enable users to actively contribute to cybersecurity. Training programs should not be seen as a one-time event but rather a continuous effort to reinforce key concepts and stay up-to-date with emerging threats.

Closing the gap in cybersecurity talent requires a multi-faceted approach. Organizations should prioritize cybersecurity training for existing professionals, leveraging partnerships with technology vendors to access diverse training formats. Automation plays a crucial role in optimizing resources and enabling highly skilled professionals to focus on critical tasks. Embracing new technologies like AI can enhance cybersecurity capabilities and improve response times.

In the digital age, where cyber threats continue to evolve, organizations must proactively address the people problem by fostering a culture of security and investing in the development of cybersecurity talent. By doing so, they can level the playing field and force attackers to work harder to breach their defenses.

Advice: Protecting Your Organization

As cybersecurity remains a critical concern, organizations must prioritize the protection of their data and systems. Here are some actionable steps to enhance security:

1. Invest in Security Awareness Programs

Allocate adequate resources, including budget and staffing, to develop and implement effective security awareness programs. Leadership support, dedicated full-time employees, and a strong security culture that encourages incident reporting are crucial for success.

2. Implement Continuous User Training

Go beyond annual computer-based training and provide continuous security training for employees. Focus on addressing the top human risks, such as phishing, passwords/authentication, detection/reporting, and IT admin misconfiguration. Involve security teams in the development of training content and consider partnering with other departments and third-party training consultants to optimize resources.

3. Prioritize Cybersecurity Professional Training

Recognize the need for continuous learning and invest in cybersecurity professional training. Partner with security technology vendors that offer diverse training formats, such as in-person, virtual, and self-service, to cater to different skill sets and business models.

4. Embrace Security Automation

Leverage security automation to optimize the work of cybersecurity professionals. Automate repetitive, low-risk tasks to free up analysts for high-impact work. Embrace automation platforms with low-code/no-code interfaces to make automation accessible to users with varying skill sets.

5. Explore New Technologies

Stay abreast of emerging technologies, such as AI, and explore how they can enhance cybersecurity capabilities. Look for solutions that leverage natural language processing and machine learning to streamline threat identification and response processes.

By implementing these recommendations, organizations can strengthen their cybersecurity defenses, mitigate risks, and make it harder for threat actors to breach their systems. Cybersecurity is a continuous effort, and organizations must remain vigilant and adaptable in the face of evolving threats.

The fight against cyber threats requires a multi-pronged approach that involves both technology and people. It is through the collaboration and dedication of users and security practitioners that we can work smarter and force attackers into a defensive position. Let us not underestimate the power that each individual holds in protecting our digital lives.