It’s no secret that we’re currently faced with a global information security skills crisis, writes Simeon Tassev, MD and QSA of Galix Networking.
Given that the predicted increase in demand for information security professionals is exceeding the current rate of supply we should be expecting a shortage as large as 1,5-million within five years, according to the Global Information Security Workforce Study.
Skilled security personnel are already feeling the effects of the crunch, evidenced in longer reaction times and the fact that only 20% of respondents felt confident that a system or data compromise response could be carried out within a single day, numbers that have dropped from 33% in 2013. A recent Tripwire study discovered that roughly two-thirds of respondent organisations faced increased security risks due to the skills shortage, of these respondents, 69% have attempted to use technology solutions to fill the gap.
It’s important to remember that technology can only fulfil its potential when interfaced with humanity, so businesses need to look at smarter ways to beef up on protection by applying intelligent security solutions that are outsourced to and overseen by security professionals.
No shortage of cyber threats
The skills shortage is both a problem and a challenge for South African businesses, however it’s not a challenge that is uniquely local.
The main reason for such a global shortage is due to the length of time it takes to qualify as a security professional. With the various international certifications even the most generic (like the Certified Information Systems Security Professional (CISSP) certification) has a minimum requirement of four to five years of working experience, and this is applicable to other certifications like compliance as well. While it might take a long time for an individual to qualify, technology doesn’t wait.
As we’ve seen, every year new technologies and new threats appear, and security professionals can’t qualify quickly enough to keep up with evolving cyber threats. Furthermore, there’s no quick-fix for this situation as it is not possible to fast-track the process, as the knowledge and experience is critical – the certification requires five years of experience because it takes time for individuals to be exposed to the various aspects of security and technology to gain the necessary skills.
This is a dangerous situation for South African businesses as the International Data Corporation has pointed out that some 52% of data that should be protected, isn’t.
Furthermore, IDC predicts that by 2018, roughly two-thirds of corporate networks will have experienced an Internet of Things security breach, while the Network Barometer Report points out that in 2015, at least 60% of all network devices had at least one security vulnerability, of which 76% were identified being more than two years old. All of these stats and figures point to the fact that organisations simply aren’t doing enough to ensure network security.
Bridge the gap, intelligently
It’s clear that security should be the single largest end-user computing concern for digital businesses. Nevertheless what can organisations do, when there simply aren’t enough professionals with the right skills for hire? Are automated security solutions effective enough to fill the gap?
The reality is that while there are various tools and automated security solutions that will assist, all of those tools will be exactly that – a tool for somebody to use. Individuals in charge of monitoring and using security solutions will require the skills and knowledge to interpret the output delivered by such tools in order to be truly effective.
The most common way of working around a skills shortage is outsourcing. This approach is successful when the right combination of tools is in place in order to minimise the amount of time required for a specialist to be physically involved in the security system.
From an outsourcing perspective, instead of spending time sifting through logs, with the right tools, the specialist can turn to a summary report of all actions, or drill down and report on whatever is deemed necessary. This helps the specialist to maximise time, making it possible to provide the same functionality to many companies, not just one.
Technology is an ever-evolving entity – the pace of growing threats is simply too rapid to keep up with, causing the skills gap to widen even further.
Given that it’s a problem that has no quick fix, it would be prudent for businesses to look to solutions that incorporate artificial intelligence – not in the Hollywood sense of the word, but rather more of an automated system with built-in intelligence.
By utilising such automated systems with intelligence, it is possible to minimise the amount of input needed from a security specialist to such an extent that he would only need to intervene in the case of an exception or crisis. With the right tools in place, and the right information security specialist, it becomes possible to automate 90% to 95% and reduce the required input of that specialist to only 5% which should serve sufficiently to bridge the skills gap, allowing businesses to shield their digital assets effectively.