The shortage of resources and expertise is quickly becoming a major cybersecurity concern, but the problem is not new. In 2015, Frost & Sullivan and ISC2 were already predicting a shortage of 1.5 million security professionals by 2020. This year the challenges are becoming even more apparent because they are getting worse. In its 2014 annual state of IT report, ESG found that 23 percent of respondents claimed their organizations had a problematic shortage of cybersecurity skills. In 2018, that number jumped to 51 percent. A recent Ponemon Research report found that in 2018, the talent gap has become the number one concern for chief information security officers (CISOs).
Efforts to Close the Skills Gap are Underway
On the bright side, initiatives are underway to improve this situation. Some efforts are being led by the U.S. Department of Commerce with programs like the National Initiative for Cybersecurity Education (NICE). This program, which operates under the NIST umbrella, has as its mission the promotion of cybersecurity education, training and workforce development. Cybersecurity vendors are starting to help too. CrowdStrike, for example, established the CrowdStrike Foundation and its Nextgen Scholarship Program to nurture and develop the next generation of talent and research in cybersecurity and artificial intelligence (AI). The program provides financial assistance to help deserving undergraduate and graduate students studying cybersecurity or AI. More and more universities are starting to offer specific cybersecurity programs sanctioned for bachelors and masters degrees rather than only offering a generalized computer science track. These developments signify an evolution from the time when only industry associations such as SANS or ISC2, or vendors provided cybersecurity certifications.
While these developments are steps in the right direction, higher education focused more specifically on cybersecurity is only in its nascent stages. The industry is not likely to realize the benefits immediately because it will be several years before new cybersecurity graduates have the knowledge and experience required to be well-versed security experts.
Organizations Must Revise Their Strategies
At a strategic level, organization are trying to solve the problem by outsourcing their needs and turning to MSSPs (Managed Security Services Providers) or MDR (Managed Detection and Response) to absorb part of the workload. At an operational level, automation and orchestration are being considered to streamline and scale security teams, so they can meet the increased security requirements.
Even given these resources, the cybersecurity talent shortage is still problematic and day-to-day security operations are probably the most seriously impacted. For example, the analyst firm Gartner found that “Many organizations lacked the skill sets to leverage the emerging security technologies they had purchased.” Situations like this can lead to gaps in an organization’s defenses — often, this is exacerbated by the fact that organizations may not be implementing the solutions they have to their fullest protection capabilities.
Alert Fatigue Can Be Serious
Alert fatigue, which also affects daily security operations, is aggravated by the talent gap and may be worth mentioning because failing to address alerts in a timely manner can have disastrous consequences. When there are not enough resources to handle all alerts — which can easily total hundreds to thousands in a day — choices must be made about which detections to investigate and which can be ignored. This means it could take longer for a security analyst to get to a critical alert, resulting in an uninvestigated detection leading to a major compromise, which was the case in the infamous Target breach.
Organizations also try to find ways to cope with the lack of talent by cutting down on processes. They might blindly re-image compromised systems, instead of investigating incidents in depth to remediate them. This might be a quick and easy fix for the security team, but this approach can be very disruptive for the business, causing long periods of employee downtime.
A logical conclusion seems to be that until enough experienced security professionals are available to meet the growing demand for cybersecurity expertise, organizations will have to turn to a variety of options to respond to the talent shortage issue.
A Solution That Addresses this Shortage
CrowdStrike® provides one of those options with CrowdStrike Falcon® Complete
, a solution specifically designed to close the security skills gap by providing the comprehensive protection and response organizations need to address this lack of resources. Falcon Complete provides leading protection technology plus a dedicated team of security professionals focused on managing and monitoring endpoint security and responding to threats.
Falcon Complete provides a mature endpoint security program at a speed, cost and level of efficacy that very few organizations can achieve on their own, especially in light of the cybersecurity talent shortage. By off-loading the burden of endpoint security to CrowdStrike, organizations can reach the highest level of maturity for their endpoint security strategy, without having to spend countless months hiring, training, implementing and managing a comprehensive endpoint security program. Falcon Complete not only provides the people and technology needed to handle all aspects of endpoint security, it also provides peace of mind, knowing that the best security experts in their fields are watching your organization’s endpoints 24 hours a day and will take immediate action to remediate incidents whenever it’s needed.
Download the Falcon Complete white paper.
Get a free trial of Falcon Prevent, CrowdStrike’s unrivaled next-gen antivirus solution
The post When Cybersecurity Talent is Scarce appeared first on .
Article Link: https://www.crowdstrike.com/blog/when-cybersecurity-talent-is-scarce/