What cybersecurity leaders say we can do now to advance the cybersecurity workforce
It鈥檚 a dream scenario for any senior cybersecurity leader: given $100 million tomorrow, what would you do?聽
Air Force Major General Christopher Weggeman didn鈥檛 hesitate.
Asked how he鈥檇 spend a sudden surge of new funds, the Air Force鈥檚 cyber commander told the Billington Cybersecurity Conference in Washington, D.C. last week that his request would be clear and direct: new talent and new training.
鈥淭he thing I need the most in terms of capacity is trained, ready manpower,鈥澛燱eggeman said. 鈥淚 need a persistent training environment 鈥� And I think this is really, really important because it鈥檚 said [that] the most critical element in cybersecurity operations isn鈥檛 silicon or copper 鈥� it鈥檚 carbon. It鈥檚 manpower.鈥�
But just as clearly as Weggeman targeted cyber talent as his main need, so too did many other Billington attendees point to the glaring deficiencies in cybersecurity talent and then clear paths forward to fixing them.
Admiral Michael Rogers, commander of US Cyber Command, offered up a major idea around helping build a more robust cybersecurity workforce: training that doesn鈥檛 take limited talent away from the mission for six months or more at a time.
Rogers called out new training capabilities among three game-changers he鈥檚 looking for to advance the government鈥檚 cybersecurity mission.
鈥淲hat are the capabilities that industry can help us with that will help us ensure an adaptive, learning workforce over time?鈥� he asked.
In the private sector, industry experts agreed that developing more talent will move more quickly when industry leaders work together.
鈥淲e saw the issue a long time ago, that the workforce shortage is going to be a challenge,鈥� said Diane Miller, Director, Global Cyber Education & Workforce Development Programs,聽Northrop Grumman Corporation.
Investing in academia, sponsoring youth cybersecurity competitions, and building broad job development programs are all admissions from cybersecurity firms that 鈥渨e are all in this situation together,鈥� Miller said. 鈥淭here is no point in all of us fishing from the same pond.鈥�
But making sure the pool of people coming into the industry is as diverse as the nation is, is something that also desperately needs work.
An industry bearing only slightly more than single-digit percentages of women and minorities is 鈥渂roken,鈥� said Bernard Skoch, national commissioner of the CyberPatriot National Youth Cyber Defensecompetition.
鈥淚 am disturbed about the gender representation in cybersecurity. If you allow young women in high school to say 鈥榌Cybersecurity is] a guy thing,鈥� you鈥檙e broken. If you allow underrepresented minorities to say, 鈥楾hat鈥檚 not for me,鈥� that鈥檚 broken,鈥� Skoch said. 鈥淭he specific skill sets are important. What鈥檚 far more important is attracting the right population.鈥�
The problem is partially one of numbers, Skoch and Miller agreed: you can鈥檛 leave more than 50 percent of the population out of the field and dream of having enough workers.
It鈥檚 also one of effectiveness, Miller said, where people from a wide array of backgrounds make for more clever and nuanced solutions to problems that teams from any one discipline may never consider.聽
鈥淐yber problems are really complex. You鈥檙e not going to fix them alone in your basement on your computer: being able to fix them in a team is important,鈥� Miller said. 鈥淎 diversity of backgrounds, experiences 鈥� need to all come together and work together to resolve those kinds of problems. We cannot leave anyone behind.鈥澛�
The fix? Get to students before they leave elementary school, Skoch said, eliminating barriers to entry from social pressure or personal perception later on.
Diverse backgrounds beyond technological chops are particularly important, said Gregory Touhill, the retired Air Force general and former Department of Homeland Security official recently named the nation鈥檚 first-ever chief information security officer (CISO).
What do top-flight cybersecurity players need? Touhill listed five 鈥渆xistential activities鈥� alongside technical excellence: Critical thinking, speaking foreign languages, talent in mathematics, communication skills, and training in logic and philosophy.
鈥淭he job you鈥檙e going to have five years from now hasn鈥檛 even been invented yet,鈥� Touhill said, 鈥淚t鈥檚 important for us to teach folks about the 鈥榳hy鈥� as it is to teach them about the 鈥榟ow.鈥欌�澛�
Another key part of helping close the nation鈥檚 talent gap: don鈥檛 forget your strengths.
Those in government and those that support the nation鈥檚 cyber defenders would be wise to remember their 鈥渟pecial gem,鈥� as Weggeman called it: the mission.
鈥淲e develop a workforce that is passionate about our mission and our mission is our customers. People who are interested in supporting global security challenges ... are attracted to business like ours,鈥� Northrop Grumman鈥檚 Miller said.
Leveraging those passions, Miller continued, means giving talented people opportunities for internal advancement such as research, rotations into different missions and the ability to compete, if anonymously, in global competitions.
Giving the nation鈥檚 best and brightest a path to bigger and better things within the mission of the federal government, then, remains a powerful tool toward closing the cybersecurity talent gap 鈥� and toward better cybersecurity for all.
