Hacking The Skills Shortage Report - McAfee

REPORTThe continued skills shortage creates tangible risks toorganizations, and companies say they have alreadyincurred damages as a result of this workforce gap.Respondents say their organizations, unable to maintainadequate cybersecurity staff, have been targeted byhackers who suspect a shortage of cybersecurity skillsat their organization. One in four respondents say theirorganizations have lost proprietary data as a result oftheir cybersecurity skills gap.Has a shortage of cybersecurity skills had a negative effecton your organization?We can’t maintain an adequate staffof cybersecurity professionals17%35%22%We are a target for hackers asthey know our cybersecurity isnot strong enoughWe’ve lost proprietary data throughcyberattacks25%33%We’ve suffered reputational damageWe’ve had a reduced ability to createnew IP for products and services7Diversify the Cybersecurity WorkforceExpanding the cybersecurity workforce could be facilitated by pursuing opportunitiesto create a larger, more diverse talent pool.In North America, a dearth of women and minorities in the cybersecurity industrymirrors trends in academia, according to a survey of academic institutions thatprovide degrees in computer science and engineering or information security.⁹ In thisstudy, only 2.6% of doctoral graduates of these programs in 2014 were non-Asianminorities, a decrease from 3% in 2013. Women comprise only 17 to 18% of doctoralgraduates in computer science, engineering, and information security. This mirrorsindustry trends, as an (ISC)² study of 14,000 professionals in cybersecurity revealedonly 11% were women.¹⁰ Anecdotal evidence from our interviews suggests that whilerelevant technical programs are slowly adding more women, black and Hispanicstudents remain in short supply.Four Dimensions of AnalysisWe studied four dimensions of the problem that affectthe cybersecurity workforce pipeline in Australia, France,Germany, Israel, Japan, Mexico, the UK, and the US.Figure 5. Impact of cybersecurity workforce shortage.Cybersecurity SpendingMany students in higher level technical degree programsin the United States are from outside the country. Asmany as 68% of US computer science students pursuingmaster’s degrees come from outside the United States.¹¹While the proportion of foreign students in highereducation is largest in the US, other countries could alsobenefit from this pool of foreign talent through flexibleimmigration and visa policies.The size and growth of cybersecurity spendingcorrelates with the size and growth of the cybersecurityworkforce and reveals how countries or companiesprioritize cybersecurity. The United States governmentand the financial services industry, as big cybersecurityspenders, are uniquely positioned to pioneerrecruitment and development practices for others toemulate. Similarly, the US and Israel, as large exportersof cybersecurity products and services, have establishedHacking the Skills Shortage

REPORTexpertise and thus have a head start on improvingtheir workforce.Global cybersecurity spendingMarket reports estimate total annual global cybersecurityspending ranged from 75 billion to more than 100billion in 2015 and project annual spending increasesbetween 7.4% and 16% over the next five years.¹²The banking industry has been particularly activein increasing cybersecurity spending, reflecting itsprominence as a target—banks are three times morelikely to be targeted than non-financial institutions.¹³Five banks alone spend more than 1.5 billion oncybersecurity.¹⁴ According to Bank of America’s CEO,cybersecurity is the company’s only business unit withno budget limit.¹⁵ Finance consumes more cybersecurityproducts and services than any other private sectorindustry, and thus could help drive best practices fortraining and hiring cybersecurity talent. Unsurprisingly,countries and industry sectors that spend moreon cybersecurity are better placed to deal with theworkforce problem.UnitedKingdomFranceAustralia Est. 1.3Btotal spendingin 2014 Est. 3.04Bcybersecuritymarket in 2013 5% of total economicoutput in Israel is in ICTtechnologies Market to growto 4.75B in 2018 Cybersecurity exportsare 6B Japan’s cybersecuritymarket is estimated togrow by 19% in 2016 Japanese cybersecuritymarket should reach 2.7Bin 2016 Est. 40B total spendingin 2014 Est. total cybersecuritymarket in 2014 was 2,996,000 12B on cybersecurityin FY 14Figure 6. Global cybersecurity spending.¹⁶Hacking the Skills ShortageJapanIsraelMexico Around 4% of IT spending8GermanyUnitedStates Est. 3.71B cybersecuritymarket in 2013 Est. 590M cybersecuritymarket revenue in 2012 Market to grow to 5.8Bin 2018 Cybersecurity marketprojected to grow to 1.6Bin 2019

REPORTEducation and TrainingTraditional academic institutions are the primary sourceof initial education and training for cybersecurityprofessionals, but non-traditional methods may be abetter way to acquire and grow cybersecurity skills.Incorporating practical learning into academic programswould better prepare cybersecurity professionals for thereal world.To assess available educational capital, we created aranking using the following metrics: overall spending onhigher education, Science, Technology, Engineering andMathematics (STEM) programs, technical cybersecuritycurricula in higher education, performance ininternationally recognized capture the flag exercises, andour survey data.The US and UK rank highest in current investmentin cybersecurity education and are best situated toinstitute educational reforms. Mexico, France, and Japanrank lowest in cybersecurity education, with low levelsof government investment in education and a lack ofSTEM graduates. Countries with higher scores are bettersituated to institute reforms to improve the quality ofcybersecurity education and training.Global education rankingsUnitedKingdomTop TierUnitedStatesTop TierFranceLow TierHacking the Skills ShortageJapanMid TierIsraelMid TierMexicoLow TierAustraliaMid TierCTF exercises have yetto take off in Mexico,only three Mexicanteams were awardedpoints in internationalCTF competitions in2015The United States has manycybersecurity programs intop universities (6), strongperformances in CTFcompetitions; and the secondhighest rate of governmentexpenditure on educationOut of the countriesstudied, France has thehighest proportion ofPhDs in STEM fields(48%), but does not offermany university-levelcybersecurity programsThe UK has strongofferings in STEM education; about 4% of totaltertiary students in the UKare enrolled in CSprogramsFigure 7. Education ranking by country.¹⁷9GermanyMid TierOf the countries studied,Israel has the highest rateof governmentexpenditure on educationas percentage of totalgovernment expenditure(19%)Germany has averagegovernment spendingrates on education, butSTEM degrees are popularat the university levelOut of the countries studied,Japan has the lowest ratesof government expenditureon education, althoughJapanese teams performwell in CTF competitionsTop Australia universitiesoffer more cybersecurityprograms than any othercountry in our study

REPORTAround four in 10 respondents listed a bachelor’s degreeas the minimum credential for entry-level positions intheir organizations, with significant variation amongcountries. Of the countries studied, France and Germanywere more likely to require a master’s degree; 38% and32% of respondents, respectively, in these countries cite amaster’s degree as their minimum credential.54321A Bachelor’s degree is the minimum credentialfor entry-level positions0United IsraelMexicoFranceGermanyJapanGraduateFigure 9. Cybersecurity education at top aliaUnitedKingdomJapanIsraelFranceGermanyFigure 8. Minimum cybersecurity credentials.While a bachelor’s degree is typically considerednecessary to enter this field, cybersecurity-specificofferings in higher education are rare. Cybersecurityas an academic discipline or program of study is ofteninaccessible to students. Only 7% of top universities inthe countries we researched offer an undergraduatemajor or minors in cybersecurity. As for graduate work,about a third of top universities offer a master’s degreein some cybersecurity field.¹⁸10Technical cybersecurity programs at universitiesHacking the Skills ShortageDespite our respondents’ typical insistence ona bachelor’s degree as a baseline credential forcybersecurity work, only 23% of respondents sayeducation programs are preparing students to enterthe industry. A bachelor’s degree in a technical fieldis ranked third by survey respondents among mosteffective ways to acquire cybersecurity skills, behindhands-on experience and professional certifications.This contradiction indicates that a degree is more ofa signal of general competence than an indicator ofdirectly relevant cybersecurity skills. In the UK and Japanin particular, respondents are more likely to downgradethe value of traditional education programs for attainingcybersecurity skills. More than three-fourths of surveyrespondents cited professional certifications as aneffective way to demonstrate skills, with respondentsin the UK, Australia, Mexico, and Israel finding thesecredentials most useful.

REPORTHow well do you think education programs (universities or vocational)are preparing cybersecurity professionals for the industry?5%23%Fully preparing professionals28%Mostly preparing professionalsSomewhat preparing professionals44%Not preparing professionalsHacking the Cybersecurity WorkforceGaming can identify talent and cultivate cybersecurity skills. Computer games provideiterative learning examples and ways to develop skills at early levels. Some examples ofcybersecurity games for younger audiences include MySecureCyberspace, a game forfourth and fifth graders by Carnegie Mellon; CyberCIEGE; and Control-Alt-Hacks.¹⁹ The USDepartment of Defense is also stepping into this field and has produced CyberProtect,a game focused on resource management and countermeasure decision-making.²⁰Cybersecurity storylines are increasingly a feature in more mainstream games. Populargames such as Watch Dogs, Deus Ex, Bioshock, and Fallout include some hacking element.²¹Incorporating cybersecurity plot lines and features in gaming can help more peopleappreciate computer networks and understand their vulnerabilities.Figure 10. Education programs and skill development.National hacking competitions provide an effectivechannel to identify talent and develop cybersecurityskills. Over three in five survey respondents say nationalhacking competitions play a key role in developingcybersecurity talent. Overall, two in five respondentscite hacking competitions as among the most effectiveway to acquire skills, with Australia and Israel most likelyto agree. In Israel, 62% of respondents say that thesecompetitions are among the top five most effective waysto acquire cybersecurity skills.Do national hacking competitions (e.g. capture the flag competitions)help develop cybersecurity skills at your company?6%20%39%No, and theyshould not playa roleNo, butthey shouldYes, asmall role29%6%Yes, abig roleDon't know/no opinionFigure 11. Role of hacking competitions.11Hacking the Skills Shortage

REPORTEmployer DynamicsEmployers need more effective strategies and incentivesto recruit and retain top cybersecurity talent. Whilesalary is, unsurprisingly, the number one motivatingfactor in recruitment, the second, third, and fourth areopportunities for training, reputation of the employer’sIT department, and potential for advancement. Forretention, the reputation for innovativeness of thecompany replaces the reputation of the IT departmentas the fourth most important factor.What factors are important when recruiting and retainingcybersecurity professionals?Co-workersIn addition to on-the-job training, employers are lookingto invest in technology to improve cybersecurity.About nine out of 10 respondents say technologicaladvancements in cybersecurity could compensate for askills shortage. Given the long timeline to develop andtrain a robust workforce, technological improvementscould help compensate for the cybersecurity skills gapin organizations.The organizationbeing innovativeManagementBeing sponsoredto do additionalqualificationsReputation ofthe tial tobe promotedReputation ofthe IT departmentLevel oftraining igure 12. Recruiting and retaining cybersecurity professionals.12Companies need to be strategic in deciding what skills willbe needed to combat future cybersecurity threats andhow new technologies can offset workforce shortages.Recognizing that many new professionals lack necessaryskills and that even proficient workers will requirecontinuous skill development, employers are increasinglyproviding on-the-job training.²² A failure to support theirworkforce through training can lead people to leave foranother job. Almost half our survey respondents cite lackof training or sponsorship for qualifications as commonreasons for talent departing their company. Somecybersecurity qualifications and certifications requiretraining programs and tests that are often cost prohibitivefor employees to fund themselves.Hacking the Skills Shortage60%More than 60% of survey respondents work atorganizations that outsource at least some cybersecuritywork. Organizations in Israel and Australia are mostlikely to outsource cybersecurity, while those in the USand the UK are most likely to keep these capabilitiesin house. The primary capabilities outsourced arerisk assessment and mitigation, network monitoringand access management, and repair of compromisedsystems. These functions, in particular networkmonitoring and risk mitigation, are moving towards

REPORTautomation to facilitate a faster response to maliciousactivities and more efficient network defense.²³Organizations say they will likely expand their outsourcingof cybersecurity functions. About one in five respondentsbelieve that cybersecurity solutions will be able to meetall their organization’s needs in five years. In additionto cost and efficiencies, 41% of respondents believecompatibility with pre-existing systems will be importantwhen adopting new technologies. Additional factors thatorganizations use to assess the value of cybersecurityinnovations include acquisition and implementationcosts, management efficiency, and effectiveness atreducing cyberattacks. Efforts to enhance cybersecuritycapabilities with technological solutions will requireorganizations to hire and train a workforce that candeploy and run these technologies efficiently.Percentage of respondents whose company outsourcescybersecurity services80%70%60%Government PoliciesMany countries have prioritized cybersecurity and areenacting legislation and national strategies, establishingcoordinating bodies and cybersecurity agencies, and,in some cases, funding programs to cultivate a largercybersecurity workforce. The cybersecurity talent gaphas become a prominent political issue as heads ofstate in the US, UK, Israel, and Australia have all calledfor increased support for the cybersecurity workforcein the past year. Most countries we studied also havelegislation specific to enhancing cybersecurity education.Despite increased political engagement on cybersecurityworkforce issues, however, more must be done to buildthe cybersecurity talent pool. Slightly more than threequarters of survey respondents say their governmentsare not investing enough in building cybersecurity talent,and the same percentage said the laws and regulationsfor cybersecurity in their country are oFranceGermanyFigure 13. Outsourcing cybersecurity functions.13Imprecise job descriptions and lack of metricsto assess skills complicate the hiring process forcybersecurity jobs. There is often a mismatch betweenjob descriptions and actual duties, which createsunhappiness in the workforce.²⁴ Efforts to introducepredictability and transparency in the cybersecurityjob market include the NIST Cybersecurity WorkforceFramework in the United States,²⁵ but in most countriesjob descriptions are not yet standardized across thepublic and private sectors.Hacking the Skills ShortageJapanUnitedStatesUnitedKingdom

REPORTTo what extent do you agree with the following statement:“My government is not investing enough in cybersecurity skills”How strict are laws and regulations on cybersecurityin your country?IsraelMexicoJapan9%43%30%Too strictThe right levelThey could beslightly stricterAustraliaUnited StatesGermanyFranceUnited Kingdom15%3%They could bemuch stricterDon’t knowTotal020%Agree40%60%Neither agree nor disagree80%100%DisagreeFigure 16. Cybersecurity laws and regulations.Figure 14. Government investment in cybersecurity.Are cybersecurity laws and regulations effectivein your country?21%53%23%3%Current lawsare sufficientCurrent lawscould be improvedCurrent lawsneed significantimprovementDon’t knowFigure 15. Cybersecurity laws and regulations.14Hacking the Skills Shortage

REPORTRecommendationsClosing the gap in cybersecurity skills requires countriesto develop critical technical skills, cultivate a larger andmore diverse workforce, and reform education andtraining programs to include more hands-on learning.Our study revealed that Australia, France, GermanyIsrael, Japan, Mexico, UK, and the US face similarroadblocks to closing the skills gap, but each countryalso has distinct challenges. In light of our findings, wehave the following recommendations.Redefine Minimum Credentials for Entry-LevelCybersecurity Jobs: Accept Non-TraditionalSources of EducationSimply put, most educational institutions do not preparestudents for a career in cybersecurity. Our researchsuggests that cybersecurity education should start at anearly age, target a more diverse range of students, andprovide hands-on experiences and training.Most institutions of higher education do not offercybersecurity concentrations and do not guidegraduates to cybersecurity professions. Japan andGermany, in particular, have the fewest cybersecurityprograms at the university level.Our survey data suggests that employers should relaxdegree requirements for entry-level cybersecuritypositions and place greater stock in professionalcertifications and hands-on experience for evidence ofsuitable skills. Universities should seek greater relevancein this field by adding cybersecurity courses and workingwith industry and government to tailor curriculum.Programs should focus on hands-on learning in the form15Hacking the Skills Shortageof labs and classroom exercises to provide people withrobust and practical skills in this field.Early exposure to cybersecurity careers is crucial fordeveloping interest in the field. Some countries haveimplemented programs targeting students at the highschool level that could provide a model for others toemulate. In Israel, the Magshimim (“accomplishers”)program develops cybersecurity skills and identifiestalented high school students for recruitment by theIsrael military.²⁶ Programs like these not only raiseawareness of potential careers in cybersecurity,but identify promising recruits for cybersecurityprofessions. This is potential partnership opportunity forgovernments and the private sector: efforts to leverageprivate sector talent in training teachers, enhancingcurricula, and offering internships and trainingopportunities to talented high school and collegestudents would be mutually beneficial.Diversify the Cybersecurity FieldIncreasing the diversity of the cybersecurity workforcewill also expand the talent pool. According to a numberof studies and interviews with employers and educators,women and minorities are underrepresented in thisfield. Workforce enhancement efforts should aim tocreate a broader pool of cybersecurity talent.Many people with advanced degrees in fields relevantto cybersecurity, including computer and informationscience, have international backgrounds. Rigidimmigration policies shrink the pool of high-skilledworkers critical to the cybersecurity workforce. The USstands to benefit the most from this recommendation,

REPORTas it has more than double the uni

Connect With Us. REPORT 4 Hacking the Skills Shortage . the talent shortage in cybersecurity is somewhat or far worse than in other IT professions. 60% 70% 80% 90% 50% 40% 30% 20% 10% 0% Percentage of respondents who say there is a shortage of cybersecurity profession