Announcing the Marriage of Technical and Traditional Security Skills
RSA recently published the SBIC report entitled ‘Getting Ahead of Advanced Threats’. One of the recommendations from the report is about finding the right people with the right skills to become Cyber Security Analysts. Dave Martin, CSO for the EMC suggests “ Cyber Risk intelligence requires a skill set combining abilities to understand threats, the business environment and security controls in order to determine the risks to the business and what controls would mitigate this risk.” This is a pretty tall order for most organizations. They may have many individuals whose skills match one of these areas, but rarely all of them.
Attacks are multi-dimensional and therefore you need to have people in your organization that can recognize these attacks and put mitigating strategies in place. So, what exactly are the skills required to be a ‘Cyber Security Analyst’? Well, here are a few ideas to get you started.
It’s time to think of military tactics. Traditional military experience of sabotage, espionage and theft can all be really invaluable experience particularly when they are applied to protecting business targets such as hardware, software, intellectual property, PII and financial data to name a few. The Cyber Security Analyst needs to marry technical cyber security intelligence with traditional military intelligence (e.g. strategy and tactics) to determine a holistic approach to cyber protection. Yet, the IT security industry doesn’t typically look to recruit from the military and focuses more on traditional IT security technical experience.
Analytical skills are also crucial to this role to understand multiple sources of data and recommend defensive and pro-active measure to thwart potential malicious activity. ‘Big Picture’ thinking is something that cannot be taught and has to come with experience. Communication and writing skills, collaborative skills and facilitating information sharing are the basic foundations of the role.
The individual also needs to be an excellent relationships person as they will have to work with all areas of a business and also with peers outside the organization to exchange ideas on best practices, etc.
Furthermore, there are no off the shelf training courses on Cyber Analytics although there are organizations who will tailor courses on individual requirements if you have dollars to spend. Also, take note that just-in-time training here might be just-too-late.
Few organization will have this right on day one, but creating virtual teams to deliver the Cyber Intelligence function will demonstrate the need for this function and home in on the skills that will be required in the future. Also, temporarily buy-in some skills by getting contractors to be a part of the Cyber Analysis initiative and make sure you learn from them. In addition subscribe to threat intelligence services offered by many organizations including RSA.
It is clear that IT security skills are a shortage globally and we will require thousands more skilled professionals in this area in the next few years. But whether you buy-in these skills or develop them in-house, Cyber Security Analysts should be an essential part of your plan for achieving effective security.
