Is a cybersecurity skills gap putting your company at risk?

Most large companies have spent decades under-spending on information and cybersecurity, says David Foote, partner and chief analyst at the research and analysis firm Foote Partners. That fact, combined with the skills shortage for cybersecurity experts can create some real vulnerabilities for both large and small organizations.

In part one of a three-part interview, Foote described how the IT talent shortage can hamper digital transformation, and how smart companies are planning ahead and developing internal talent for future needs. In part two, he explained how the rise of the Internet of Things will create crippling shortages in some key areas, and what to do now to prepare for it. In part three, he takes a look at cybersecurity and how to handle the skills gap in that area.

The Enterprisers Project (TEP): You've predicted that there will be more high-profile security breaches. What should companies be doing now to try to avoid them?

Foote: Let's begin by being clear on the difference between information security and cybersecurity. Information security is about creating a perimeter around your network. But it's not unusual now to discover that if you're breached, intruders have been inside your system for two years. 

You can put all your effort into your perimeter but it will still be pretty porous. People are starting to realize that the bad guys seem to be almost at will going into systems, such as Russians hacking the Democratic National Committee. You cannot stop hackers and hacktivists. You can reduce intrusions, but you can't completely stop them. 

The question is not only how do you keep people from getting in, but once they're in, what did they take, what's the root cause of the intrusion, and how do we prevent it next time? For that, you need cybersecurity. One of the big differences between the two is that cybersecurity requires a different understanding of compliance with things like HIPAA and the Graham-Leach-Bliley Act, and SOX. You have to understand what assets you have – it's called valuation of asset inventory – see what it's worth and what would happen if it were stolen.

TEP: What are some of the factors that make companies especially vulnerable these days?

Foote: There have always been lots of information security people around, but companies weren't hiring them. If you were a CEO and someone came to you at budget time and said, "We can launch a new product and make $20 million in the next 18 months, but we'll need $10 million to produce the product," and the CISO came to you and said, "We need $10 million to protect the company," where would you choose to spend that $10 million? Most would spend it on the new product that will more than pay for itself. So for many years, quite a bit of the spending on security was just enough to comply with the law, and any discretionary funds were spent on a case-by-case basis. 

For many years, it was difficult to hire people in the security area and security investments were skeletal. It's amazing how lean security organizations were. Cybersecurity was really the domain of government and the energy industry. 

TEP: But that's changed in the past few years.

Foote: Yes. Now, of course, it's everywhere, and it's a concern of everyone. Now it's a board issue. You can lose your job, and as a board member, you can be personally sued, which is what happened with the Target breach. Now we know a security breach can take you down and it can mess with the price of your stock. All of a sudden, this is not something you entrust to a CIO or CISO, it's a board issue. It's related to shareholder value.

TEP: So suddenly, people are hiring?

Foote: Yes. But cybersecurity skills worldwide are in real scarcity because there hasn't been enough time to develop seasoned talent. The federal government announced last year that it planned to hire 6,500 cybersecurity professionals. My guess is they've come nowhere near that number.

Consulting firms get the first pick of everything, and large metropolitan regions monopolize the talent pool. And then a lot of large institutions are handicapped by the fact that they're so specialized, which makes it difficult to develop talent internally.

Surgeons graduate from medical school and wind up doing 12 to 14 surgeries a day, but you don't learn how to do that in medical school. You learn it by doing a lot of surgery over a long period of time. A lot of it is experience based. So the problem will take care of itself naturally over time but we have to be patient and wait for graduating cybersecurity people to do more threat assessments and get better at threat intelligence. Meanwhile, new solutions are emerging using machine learning. That will help as well.

TEP: That's great, but what should companies do in the meantime?

Foote: They need to come up with a viable cybersecurity strategy and build a great security team. That means rethinking everything you're doing. Continually assess where you are and where you need to be, and what talent you've got. Knowing where you need to be is usually the most difficult part of that.

Then form a crisis management team assigned to address the unexpected. Teams like that usually come together when there's a crisis, but you should assume crises will come at you on a regular basis. Look for proven business skills for your team. Many IT leaders say, "I have all the security nerds I want. I need people who can explain highly-technical, security-related matters to non-technical people because we're fighting over budget all the time."

TEP: Where do you find those kinds of people?

Foote: It's a big thing now, people are hiring biochemists and liberal arts majors for security jobs. They're recruiting in the most unlikely places because they're realizing they need a lot more than technology talent. These jobs require more pattern recognition skills. We've heard that companies are hiring liberal arts people because they have a broader background and better pattern recognition skills. They're less rules-based.

The other thing you need is communication skills. Some kind of PR person who can be a representative of information and cybersecurity to the enterprise, focusing on teachable topics. That's something security hasn't had but has desperately needed for years and years. You can set a security policy but you can't make people adhere to it if it's inconvenient. A lot of security breaches happen not because security is difficult or controversial, but because every dollar spent on security is a dollar not spent making money.