Closing the Cyber Skills Gap - Panel Discussion Video

Up next, we have a panel on closing the cyber skills gap, and this panel will include Naomi Buckwalter, Davina Pruitt, and Matthew Rosenquist. So with over 20 years of experience in IT and security, Naomi is a cybersecurity career advisor and mentor for people all around the world. She's the founder and executive director of Cybersecurity Gatebreakers Foundation. A nonprofit dedicated to closing the demand gap in cyber. We also have Divina. Divina is the lead for academic engagement with NIST, the National Institute for Standards and Technology. She has spent the past 20 years conducting research on student and educator cyber awareness and developing programs to increase the cybersecurity workforce pipeline. Welcome, Divina. And lastly, Matthew will be moderating today's panel. Matthew is a former cybersecurity strategist for Intel Group with 30 years in various fields of security. Matthew's a member of multiple advisory boards and consults on best practices and emerging risks to academic, business, and government audiences across the globe. He's a member of multiple advisory boards to academic, business, and governments, and now I will transition the panel over to you, Matthew. Thank you so much.

Thank you, Theo, and welcome Naomi and Davina. You know, as this audience knows, right, one of our most pressing challenges for the digitally connected and transforming world that we live in is the fact that it can be undermined, right? And security is that barrier to protect our systems, data, privacy services and capabilities, but the threats far exceed the capacity of those professionals that guard against those attacks. And we are experiencing a momentous deficit with organizations being able to fulfill their needs from the available talent pool with mounting demands growing every single year. So the question for us today is how do we reverse the situation and do it sustainably? Sustainably to satisfy the human resources needs to make our evolving digital world more secure. So let's jump in. I want to throw the questions out there, and again, let's make this interactive. I'm, you know, so please both of you jump in with your insights and your recommendations as we progress through this discussion. And the first one really is for our audience, right? How big is this cybersecurity workforce gap that we talk about and hear about? And maybe even more importantly, how should we be interpreting that number, right? Which, you know, we hear it in the millions all the time, but how should we be interpreting that number from a risks or opportunities perspective? Davina, you want to take the first shot?

Sure, sure. So I'll jump right in. So what we try to— how we try to keep track of it is through Cyberseek.org data. And that is— it's a heat map that is done between CompTIA and Burning Glass. And NICE, actually, our office helps financially support that. And that number is— around 460,000 job openings. That was as of this morning when I, when I went and looked. So what, what that jobs heat map does is it scrubs all the different job boards and anything related to cybersecurity job opening. It tries to keep track of, of those, but more importantly, it's able to drill down then so that you can see within our NICE framework, which I'm sure we'll talk about a little a little bit later, within the 7 broad categories of cybersecurity, which of those categories is in highest demand at a particular point in time at a particular geographic location. So just the location itself will, will change. So we know that there is a high demand right now. When I looked at the data this morning, it's mainly in that operate and maintain, and then which is what people usually kind of think of when they think of cybersecurity. And then also in the security provision is another area. So building things securely from the onset. And in terms of sort of the reasons behind it, you know, we, we try to dig a little deeper in that to try to figure, figure out what's going on. We do understand that the, the general population or students, people that are already in the workforce, just the general public at large does not necessarily know of all the options that the different work roles and the multiple pathways. So they just assume that cybersecurity is either computer scientist or your you know, you're down in the basement with a hoodie on somebody else's, you know, couch hacking into something, and that you have to be very tech savvy. And so, um, not realizing that there are a wealth of other job opportunities that are also in high need around cybersecurity. So it's that demystifying cybersecurity is, is one of the key aspects that we find, as well as the pathways. So a lot of times people just think it's a 4-year degree in something. And while that is a fantastic option, we also know that there are 2-year programs, there are apprenticeship programs now, there are folks that, you know, transition over or upskill or reskill students out of high school with certification. So there's multiple pathways to get you there. As well.

And Naomi, what's your take on the, the size and how we should be looking at this problem?

Well, when I heard the number from Divina just now, 460,000, I think I might have spilled my tea a little bit. I'm a little bit— the last I heard was 300,000, so thanks for inserting more paranoia for me. But I actually think it's worse than that, Divina. I think 460,000 is the number of full-time job openings in cybersecurity, but think about all the security that's not happening and the jobs that should should have it, right? So I think your engineers, your developers, anyone who currently has a role within a company that requires to do security activities, that's the question. Like, what's the real opening here? What's the real opportunity? 460,000. I'm a little bit depressed now, but no, I'm still smiling because I have a solution. I do. Now, what do we have to do to close the cybersecurity skills gap? And this is the reason why we're all here to listen to these solutions. The solution's right in front of us. We just have to do it, right? We have to have conversations with one another like we are now. We have to start believing that this is a problem that we can fix, because CISA is not going to come in and save us. Neither is the White House. Neither is NIST, even though we really like our NIST frameworks. Thank you so much, NIST. But they're not going to come in, give us $1 million each per company, and say, here you go. Here's your cybersecurity budget. Go ahead and hire new people. That's not going to happen. The people who are going to fix this problem are ourselves. No one's going to come in to save us. There's not going to be a savior coming in on a white horse. We need to have the conversations. We need to put in the effort. End the hard work into closing this gap. And what does that mean? We have to start seeing potential in people that actually have it. We have to identify people who have critical thinking skills, great emotional intelligence, people skills, the ability to learn, a history of learning, and we have to give them the opportunity and the chances in order for them to be excellent cybersecurity professionals in the future. Because the people who are entry-level people now are the veterans and the grizzled veterans that we need in the future, right? Because the gap really is in the mid-senior and senior range, but they're never— we're never going to fill that gap if we don't hire and train the next generation. And this is what I'm saying, no one's gonna come save us, we have to save ourselves. We have to hire and train the next generation by noticing the potential in others. Ask questions, have conversations, build a network, look at somebody and just take them, you know, I can train you. I'm gonna spend the next 6 to 8 weeks just giving you training and helping you level up. I'm gonna give you a chance, a junior level role in cybersecurity. Or, or you can do this, take somebody who's currently in your company who is interested in security and say, I'm gonna take whatever you have, developer, engineer, finance person, and I'm going to train you in security activities, or I'm going to send you to training, right? We're going to take you as you are and give you the security training that you need, the mentorship, and the resources. Because really, it just takes the right student in the right environment with the right teacher, and magic can happen.

I think you're absolutely right. And, you know, the number that you quoted, Divina, off of Cyberseek.org, which is a great site— everybody needs to go out there because not only does it show kind of that heat map, it also shows progression of jobs and some other things— It's US-focused, if I recall, and the latest data out of a presentation from ISC² just the other day actually showed a worldwide number over 2 million. I think it was 2.7 million, something like that, with over a million in the US, but they caveated that and said they weren't all specifically titled cybersecurity. It was positions that had that, you know, 50 or 60% expectation or role that contributed to cybersecurity. So it goes back to what Naomi said. It may be that engineer, it may be that architect, But now their role and the expectations of security has risen so much that it is important for them to have those skills and be able to lead in that space. So I think the challenge is big for everybody. And, you know, I hear from all the organizations in every sector that they can't fill the jobs. And it might be a perception issue, right, that they are only looking for that brilliant cybersecurity professional with the cape flowing in the wind, leaping the tall buildings, and not looking at the other people that have the baseline skills that maybe they can uplevel to get them in to fill this role. And, you know, Naomi, you brought up that great point. You know, we need to be able to expand the lens of who could fill these roles and pursue them. Devina, what do you think in that space? Is that something we need to do, or do we need to take it a different direction and simply drive academia, right, to train that next generation of security professionals? And when they graduate, they get the cape that's always flowing in the wind. I mean, what are your thoughts here, Devina?

So we consider cybersecurity not to be a monolithic entity in and of itself. It's not like you are a cyber security or something. That's not a real, a real word. It overlays on top of engineering, computer science, criminal justice, business, you know, law, the multiple, multiple gamuts. And there are options for technical as well as non-technical. Technical, and then there are, are a wide variety. So our NICE framework for cybersecurity workforce categorizes the 7 sort of categories or broad buckets, and then there are the 52 work roles. And even those work roles, one person, if you're in a small business or if you're in large business, you might have just one work role, one or two. But if you're in a small business, you might have 6 or 7 work roles that you have to include. So we really try to showcase how the convergence of all of these different technologies and disciplines and industry sectors are all coming together, and cybersecurity needs to be a component within all of those pieces. So doesn't matter where, what particular industry or what other area you have a love for, there is something to do with cybersecurity that could fit. And then for academia as well as in industry and other, other sectors, it's everybody understanding that cybersecurity needs to be included. Or components of that included within the content.

And Naomi, what do you, what do you think here?

Well, I think Davina's brilliant, and I wish to subscribe to her newsletter. But yeah, everything that you said, absolutely true. We have to start recognizing the talent that exists elsewhere, and it doesn't mean just the, the computer science students, but really anyone who has access to academia. So we are talking about the professors and their mentors and their networks and their conferences and everything else, and start influencing from both directions, from the hiring manager side, from the education side, from anyone who really wants to make a difference. Because we just have to start understanding this is a problem. It's not just data, but it is affecting real people's lives. Think about all those situations out there where the grocery stores have closed. Now the gasoline pipelines are closed, right? And the— what else out there? You can name a whole bunch. It's not just data, but it's affecting real people's lives. And I don't want to have a future one day where I wake up, I don't know if my water is clean. I don't know if my electricity is going to come down the little pipe, right? I want to be able to trust the things that I use every day. I don't want to be hacked in my everyday life. And that's what we're constantly seeing because everything is being connected. We live in a more interconnected world. So if we don't stop the tide now, we're going to live in a future that just is crazy. And I don't want that. I also want to retire. I want to sit on the beach and get fat. So I would love to be able to pass the torch to the next generation. We're never going to do that if they don't exist. So there you go.

I like that plan. And you bring up a good, good point because I'm big into root cause analysis, right? Because if we don't solve the root cause, we'll just end up back in this cycle. So to both of you, how do you think we got to this point? What were the mistakes that were made that led us to this deficit that's growing? Have we identified that so that we can start tackling that root cause as well?

I'm going to borrow a reason, if it's all right to be anologist. I apologize. I get so eager about this topic. Honestly, Matthew, I think it's because we think cybersecurity is harder than it is. Like, early in the days, maybe 10, 20 years ago, maybe that was true. You had to have a lot of engineering knowledge, a lot of networking experience, a lot of coding knowledge, right? So we came from this place where cybersecurity is difficult to learn, it's difficult to do. Now, I agree cybersecurity is difficult to do. However, I no longer agree that cybersecurity is difficult to learn. Why? Because there are control frameworks, protocols, white papers, research, open source projects. There's so many resources out there that are consumable by the general public, and a lot A lot of people are doing this. They're taking their time to build their home labs, write their blogs, go to web conferences, webinars, and they're even watching this today, going to YouTube, right? There's so much self-learning going on. We're not capitalizing on that. We're just assuming cybersecurity is more difficult than it is. I think now we have to start questioning, is it really that difficult? And if it is, why is it that difficult? Haven't we evolved as an industry where we no longer need 10 years of experience or help desk or anything else like that? Why can't we come in with potential and learn things? I'll tell you what, I hired an opera singer. Yes, I did. And she did not know what an IP address was. And this was 2 months after I hired her as an intern and paid her $20 an hour, no benefits, no PTO, super cheap but excellent because she has great people skills, great critical thinking, great learning ability. And I hired her. She passed her Security+ and entry-level certification in 2 months, and now she's rocking it out as a junior cybersecurity analyst. Very, very, very smart because I knew she had the potential. She showed a history of learning. She learned 3 languages on her own. She has a history of being able to teach someone. She taught foreign languages for children. Like, so these are the things that we have to look for. If you notice the potential in others, you start asking the question, how is somebody smart, rather than is this person smart, then you can actually see potential in others. And that is what I'm just trying to say. Go ahead, Dorita.

Yeah, so I come from a little different perspective in that it sounds like we did something wrong in not filling it in and I think the problem is, is that this is a new area that is just growing in leaps and bounds that it's hard to keep up with, and at the same time that we're making a lot of progress in terms of, um, general public understanding the opportunities that are out there, understanding possible pathways to get there, realizing that you can switch from one to the other, realizing you can be non-technical or technical. So all of those things play in, but you can't just snap your fingers and then all of a sudden, you know, it's— we have the magic or this silver bullet. It's going to take a while. So just as computer science, engineering, some of the other STEM disciplines have taken a while to fill those spots and are still lacking. So, you know, we don't want to, we don't want to make ourselves seem too bad because I think we're doing a pretty good job. We could do additional work and it's going to, with other futuristic technologies and new things coming down the pike, we're going to have to expand and include that piece as well. But give ourselves a little pat on the back. I think that when I look back at just 10 years from now, we have made huge strides into where we were. Think about it, 10 years ago, nobody was even thinking about it in the engineering space. We have to give ourselves a little bit of credit.

Perhaps that maybe was part of the root problem. If we go back those 10 years, cybersecurity really wasn't much of a thing, right? It was that bolt-on thing that you might do later on once the product, you know, you'll do a rev update or a patch or something, but it wasn't seen as something that you needed to be proactive. And the rapid increase of innovation and technology adoption created a huge value proposition that, well, the bad guys pursued, and we were behind the curve, I think, a little bit. So, you know, We are where we are now, right? And we want technology to flourish and we want people to benefit from this digital ecosystem that we're all a part of. It helps and enriches all of our lives, but there is still that gap. You see the roles out there, you know, we're talking about it at conferences and there is a challenge. From your two perspectives, what do you think are the big and important skills and career positions, right, that need to be looked at, are the highest priority moving forward? Are they the entry-level skills? Are they the leadership skills? Are they the technical skills, the behavioral and soft skills? What do you see as, as the biggest demand out there, the biggest need? All right, I'm going to pick on you then, Navina.

Yeah, for us, it all depends on what area in cybersecurity you're going into or want to progress through and also the geographic location that you're looking at. If you're in the Mid-Atlantic, it's going to be more the cyber defense competition. If you go up to New York, it's going to be more financial sector. So there's a lot of variables that you have to include. Now, that stated, and there's going to be even more when we have IoT and we have privacy, we have manufacturing, we have AI, and we have quantum, we have all of those efforts that are on our heels. So it's, it's not going to just poof go away. It's going to be a challenge and something that we have to work hard with. But in terms of skill sets, you do have one— you have a lot of the industry sector that is saying, as long as they have good analytical skills, they could be trained, because whatever they're coming out with, whatever widget or app or piece of software that they know today, it's going to be something else 2 weeks from now. So as long as they are willing to learn and be open-minded, and so you get into more of those— some people call it employability skills, some people call it soft skills. It's the generic, you know, teamwork, communication, writing skills, all of those things that are needed in not just cybersecurity but in all disciplines, but particularly in, in the STEM disciplines. So you have that group, but when you're breaking it off into what specific skill sets or what competencies are we looking for, for particular work roles, there are so many variables that you have to take into consideration. You really do. And it even depends on if it's from a, you know, it's how that work role is being defined by that particular company, if it's small or large. Someone with a, with a work role that has a job title associated with it in one company can be completely different than with another company, and what they look for is a, is a little different. So there's a lot of variables when you get into the very specifics of Do you want digital forensics? Are you talking about crypto? Or are you talking about keeping a network up or auditing or law or policy? So some of the basic skills are, I think, the same across the board.

All right, Naomi, where do you see the hotspots from a skills and a roles perspective moving forward?

But Davina took my answers, actually.

There's no repeating here.

Apparently it's reproducing comments. Uh, so yeah, the two things are critical thinking, analytics, the analytical skills that Jovina said, and then the ability to work as a team. So I honestly think that critical thinking is lacking in society these days. We really just parrot what we see on TV and social media. I think someone who can just think differently, think outside the box, uh, and just have a different way of thinking, thinking like a hacker, like these are the people that you want on your team. And then of course having the soft skills and the people skills, extremely important. So equally important for sure, the ability the ability to empathize because they've been there, right? These are the kinds of people that would be excellent helpers in cybersecurity for sure. But critical thinking, number one, which is why I'm a real big proponent of diversity of thoughts, which is very natural when you could just grab a whole bunch of people from different backgrounds. It doesn't matter what they look like or what they might identify as. If you get people who think differently, you're gonna have a diversity of thought. The ability to think outside the box comes out. You're gonna have more conversations that are not just one-track. Right? You're going to have different backgrounds, have different experiences, all the things that will help influence your decisions and conversations. And that's what I really think. So from a greater scheme of things, try to get people of different backgrounds because you're going to get some diversity of thought there. But that's not always the case. But really look and think about the people that you're hiring because everyone's a little different, everyone's an individual. Don't assume someone thinks a certain way just because they look a certain way, but hire them for their potential and their ability to think outside the box.

And I agree with you. You know, I think that that level of creativity and that diversity there, I mean, ultimately we have to be as creative and crafty as the intelligent adversaries that we face, right? And if we're all looking in the same direction, thinking in the same frameworks and not outside of that, we become easy victims. But what you said probably shocked many of our listeners here. Because they, I would assume they would have thought, hey, the technical skills, they're the most important. This is a technical problem. So why aren't technical skills at the top of each of your lists?

Because anything can be learned. I just want to find someone who's great at learning and can like analyze things. That's almost a skill you can't learn. Think of like when you're a child, you love learning and then you got to school and everyone just teaches you how to learn a certain way. Right? Which is why I'm a huge fan of this new, new math thing that the kids can do. But they're, they're breaking down math in a different way that we didn't learn when we were growing up. You know, I'm 40 years old, uh, I learned only math a certain way and I can only do math a certain way. That's terrible. Think about the different ways you can do things, right? That's what the kids are learning these days. So think different backgrounds, think different majors, not just computer science or cybersecurity. Think differently. And that's what we need, not just It's the technical, it's the analytical.

Well, you both now have mentioned these words, right? Learning, training, upskilling. You both have been mentioning that so much. So how important then is that those education and training systems, those organizations out there and government playing, right? How important is their roles in providing all of that and making sure that we're able to close this gap? Davina, I'm pointing at you now.

Yeah, yeah. So, you know, if you're asking how the coordination, you know, I think that we need to really capitalize on that, the comparative advantages for both public and private sectors. So, you know, the private sector is really remarkable in its expertise and its ability to act quickly. And to protect its systems and so forth. In, in, in some cases, even technical advantage, at least in relation to monitoring and guarding its own networks. And the government, you know, has a different kind of expertise with legal authority and sometimes can be— can take decisive action. Sometimes, and but not so quickly. It takes a little bit longer. So that's kind of the downplay of it. But and also, you know, is able to compel the country or the, or the entity at large to, to kind of follow suit. So I think it's going to take the private sector and the public the government and the private sector amplifying each other's strengths and really holding each other accountable. It's— you have to have that kind of nice— how to keep things safe, but also make sure that it's usable. So it's that balance of the carrot and the stick, if you will. In terms of like education and training providers, I think, you know, there's ample room for lots of content. But as was brought up earlier, in today's society, a lot of it is just learning a lot of this stuff on your own. I mean, you can just Google and find webinars and online courses and, you know, Reddit and discourse.

And universities are developing programs, right? In-house and online and everything else. And so there is that public-private sector capability. We're 1 minute out here. So rapid fire, my question to each of you, and I'm going to start with you, Naomi, right? How does this audience, right? We've got a great audience listening here representing a range of different roles and different industries. Right. What is your most important piece of advice for these listeners, these leaders, when it comes to addressing the talent shortage? Give me your 1 or 2 things. You got 30 seconds. Hit me.

Hey, thanks for— thanks for hanging out with me today. I just want you to look for potential in others instead of asking how is somebody smart. Just be like, how is this person smart? And if they can learn, look for potential in others because everyone has potential. Everyone does. And just start seeing it in each other and magic will happen.

That's beautiful. Okay, Davina, same question to you. How does this audience take leadership? What do they do?

I think just understanding and being open-minded enough to understand that it's more than just a degree that you're looking for. You're looking for those skills and those competencies that they can, that they can show. And whether they, they got there through apprenticeship or out of high school with certifications or just learning on their own or through a community college. You have to, have to be more open in recognizing talent is out there. You just have to be willing and open-minded to take into consideration that talent.

Thank you. Thank you, Davina and Naomi, for your insights, your recommendations, and, and thanks to Right Hand Security for hosting this event and this specific topic. Theo, back to you.