Cybersecurity workers shortage in USA

[paxmao]

Recent news in various outlets are pointing out to companies in the US that have been victims of ransomware and other attacks not being able to get the help they need to get back on-line. Particularly, hacks that infect software companies that then spread the threats to other companies (as the recent Solarwinds which affected a number of major software providers). In my view, the equivalent to this is to be outnumbered by an enemy army - loosing a war because you do not have enough qualified soldiers.

https://searchsecurity.techtarget.com/news/252494362/10-of-the-biggest-cyber-attacks

Europe & USA are not taking this seriously enough and are not regulating strongly enough the requirements. You may argue that these are private companies, but the fact is that they have an effect on the system creating a "call effect" to further attacks and creating caos in the economy.

[1714934424]

1714934424

[1714934424]

1714934424

[1714934424]

1714934424

[1714934424]

1714934424

[1714934424]

1714934424

[NeuroticFish]

Europe & USA are not taking this seriously enough

I think that's - by large - also caused by "inertia" and lack of knowledge. Too many big institutions don't understand computers, they would still prefer to work with papers and don't understand why this had to change and now they can also show that they were right.

On the same page, many of these institutions will think that paying some proper networking and security engineers is an overkill/unnecessary expense (and it usually is, until *that* happens to *them*).
The users are also careless at best, combining work e-mails with personal, send out "funny clips" to co-workers and so on.

The operating system also, instead of helping users understand file extensions so the user doesn't just "run" any random file, whether it's a worksheet, a movie or an exe, it hides the extension to people stay in oblivion.


Interestingly nowadays there are Linux distros that are as user friendly as Windows for the basic user and they could be used safer. But somebody should know about this when the acquisitions are made. Acquisitions also made by people with no knowledge in IT.

[Hydrogen]

Years ago, governments of the world began offering cash bounties for zero day (undocumented) exploits. A hacker that spent 6 months reverse engineering code might be paid $200,000 for a previously unknown windows exploit. The vulnerability would never be officially reported or patched. Leaving everyone vulnerable. Over the course of many years, nations stockpiled many such exploits as weapons. In something resembling a cyberspace version of the nuclear arms race.

Some of these zero day weapons leaked or were stolen by rogue actors. Eventually finding their way into the hands of the public. Some of the CIA's hacking tools were claimed to be leaked under wikileaks vault7 release. Long story short, there is a big market for undocumented zero day exploits which are unknown and have not been patched. Being patched up to date isn't enough to achieve true opsec (operational security). And hasn't been for a very long time. Its a bitter pill to swallow but as far as I know there aren't any real options or alternatives. Aside from perhaps using hardened OS/software. Which isn't something I know a whole lot about.

[NotATether]

First of all, you're not going to be hired as a security researcher in any US or EU company without a certification, and there's at least 10 of them, each company having it's own requirements on which certification is necessary, and then the test itself is freaking expensive e.g. Security+ exam costs $340 - this is to take it not just to get the certificate. And this all contributes to people's reluctance to go down that career path because of the huge down payment needed when they haven't even secured a job yet.

And the learning material for the test is even more expensive. On Pluralsight you can pay about $200 and get access to training material for all that for a whole year, better than all the books and material bundles that go around for several hundred $$$, but you still have the issue of paying to take the test itself.

[fiulpro]

Being the world's most extraordinary countries they are the target of literally everyone. Therefore these countries have to make sure that they are able to not only protect their country from cyber attacks but at the same time set an example for others.

First of all, you're not going to be hired as a security researcher in any US or EU company without a certification, and there's at least 10 of them, each company having it's own requirements on which certification is necessary, and then the test itself is freaking expensive e.g. Security+ exam costs $340 - this is to take it not just to get the certificate. And this all contributes to people's reluctance to go down that career path because of the huge down payment needed when they haven't even secured a job yet.

And the learning material for the test is even more expensive. On Pluralsight you can pay about $200 and get access to training material for all that for a whole year, better than all the books and material bundles that go around for several hundred $$$, but you still have the issue of paying to take the test itself.

A valid point.
This is a big part of the probelm with the countries who are developed. But they are also the one's who can afford to lower the fee. Therefore it is not only important to address this issue but also make sure that they implement such things in every quarter. As you already know USMLE costs 1000's of dollars and therefore it doesn't just burden students but also they are less likely to discover talented people from humble background.

So I feel that :
1. They need to reduce the fee
2. Give better benefits
3. Provide seperate healthcare services at the time of the COVID specially.

..

Hopefully they will address this issue before it's too late.

[NotATether]

So I feel that :
1. They need to reduce the fee
~

This is never going to happen, the pricing for the exams is not controlled by the hiring company or country, it's set by organizations distributing the exam such as CompTIA. They're not going to lower prices simply because of a bunch of high-profile ransom attacks, because there's thousands of them happening every month.

[tabas]

Actually there are a lot of folks that are experts in cyber space but there's just lack of spread about this. It's one of the most promising industries that I've been seeing in the IT field but it seems that because of the newest technology emergence, there's just lack of exposure to it. The government has to step on it and encourage the younger ones to look at this career. AFAIK, in other countries like Israel, they've invested a lot on this and they're known to be one of the best countries in the cyber security space.

[Lorence.xD]

Actually there are a lot of folks that are experts in cyber space but there's just lack of spread about this. It's one of the most promising industries that I've been seeing in the IT field but it seems that because of the newest technology emergence, there's just lack of exposure to it. The government has to step on it and encourage the younger ones to look at this career. AFAIK, in other countries like Israel, they've invested a lot on this and they're known to be one of the best countries in the cyber security space.

Not to mention that most people who deal with cyber security is that some of them are freelancers or they are acquired by cyber security companies. Another problem is that hackers who get caught aren't converted into a cyber security because they want to get convicted more than usage. Israel is really good with their digital warfare, I think they sponsor a lot of schools there that has to do with cyberspace.

[jrrsparkles]

Recent news in various outlets are pointing out to companies in the US that have been victims of ransomware and other attacks not being able to get the help they need to get back on-line. Particularly, hacks that infect software companies that then spread the threats to other companies (as the recent Solarwinds which affected a number of major software providers). In my view, the equivalent to this is to be outnumbered by an enemy army - loosing a war because you do not have enough qualified soldiers.

https://searchsecurity.techtarget.com/news/252494362/10-of-the-biggest-cyber-attacks

Europe & USA are not taking this seriously enough and are not regulating strongly enough the requirements. You may argue that these are private companies, but the fact is that they have an effect on the system creating a "call effect" to further attacks and creating caos in the economy.

The numbers should be increased since we know that technology has evolved a lot on very quick times that means we also should increase the security by hiring people who are experts in it but the system has a barrier, nowadays lot of such experts learnt all these things by themselves so they don't have any certification of qualification to become a professional even though they are experts in it. I guess every big companies starts to acknowledge that and recruiting people based on the skills not based on their degree so it may take time to fulfill the required spots.

[Obito]

Maybe if there's less racism and forced diversity and culture of impunity in USA, I am pretty sure that we will be seeing a lot of changes in many sectors in the region, the continuous idiocracy and divide among races is what makes it bad that there's not a lot of new generation for each industry. Remember that the kid that got killed because of racism might've been a cyber security expert for all we know but no, racisim is rampant in the country which is pretty bad.

[magneto]

Same thing here in Australia.

I've seen LinkedIn ads here hiring for cybersecurity professionals and apparently people could get in with a Bachelor of Arts or a Bachelor of Media Communications. Makes absolutely no sense.

Is this even worthwhile if you are hiring unqualified people imo? Sure, on paper you may seem like an absolute gem of a firm for having 50 staff on hand for cybersecurity related matters, but when you realise that 45 of them had studied English literature and haven't the slightest clue what they're doing, it's a lot less impressive (especially when they're getting paid big time!).

[swiftbits]

First of all, you're not going to be hired as a security researcher in any US or EU company without a certification, and there's at least 10 of them, each company having it's own requirements on which certification is necessary, and then the test itself is freaking expensive e.g. Security+ exam costs $340 - this is to take it not just to get the certificate. And this all contributes to people's reluctance to go down that career path because of the huge down payment needed when they haven't even secured a job yet.

And the learning material for the test is even more expensive. On Pluralsight you can pay about $200 and get access to training material for all that for a whole year, better than all the books and material bundles that go around for several hundred $$$, but you still have the issue of paying to take the test itself.

This is right. I've seen cybersecurity workers sharing their journey. It was a long process and would take a lot of time and effort.
Certification is also needed; you have to be knowledgeable about the computer networking processes and programming.
I have a huge interest in this career and took some tests to get a certification, but it's not easy. Modules are too technical, and most of the terms are not easy to identify. A computer science graduate like me can't even process the contents of the books. Professionals with experience would comprehend it easier. This career is for the professionals and skillful. It might also be the reason for the workers' scarcity.

[Lucius]

In my view, the equivalent to this is to be outnumbered by an enemy army - loosing a war because you do not have enough qualified soldiers.

As for the US and its policies on the matter, I can only say that they pay more attention to the raw military force that they recruit very easily from poor and destroyed cities across the country. It is an army that is important to them, because they like to show their muscles, and some kind of war in the cyber world is fought by some geeks and nerds anyway. Therefore, it is not a question of whether or not they can produce enough staff for such jobs, but the key question is why it is not their priority.

Europe & USA are not taking this seriously enough and are not regulating strongly enough the requirements. You may argue that these are private companies, but the fact is that they have an effect on the system creating a "call effect" to further attacks and creating caos in the economy.

The EU is even more clumsy on this issue, but this is because some countries still rely too much on US assistance and set aside less than the minimum for such costs - so it is obvious that they do not consider such threats too serious, which is not surprising given that most EU member states do not even have a serious army that could respond to a threat. 

In the midst of the Russian aggression on Ukraine, a military analyst wrote that Russian military forces would have reached Berlin sooner than in 1945.

[tabas]

Actually there are a lot of folks that are experts in cyber space but there's just lack of spread about this. It's one of the most promising industries that I've been seeing in the IT field but it seems that because of the newest technology emergence, there's just lack of exposure to it. The government has to step on it and encourage the younger ones to look at this career. AFAIK, in other countries like Israel, they've invested a lot on this and they're known to be one of the best countries in the cyber security space.

Not to mention that most people who deal with cyber security is that some of them are freelancers or they are acquired by cyber security companies.

Yeah, there really are companies that want to outsource talents but not to completely hire them but I'm sure that there are good employers that sees the talent of those freelancers if they're going to take care of them.

Another problem is that hackers who get caught aren't converted into a cyber security because they want to get convicted more than usage. Israel is really good with their digital warfare, I think they sponsor a lot of schools there that has to do with cyberspace.

Maybe it's because that the violation and damage they've done cost a lot and that's why they don't want to hire them. But such talents are wasted if they've used it in a bad manner instead of looking for an opportunity that will cultivate that talent.

[pinggoki]

Amidst the age of technology where security is more important than ever. Could possibly be caused by the pandemic but then again coding and programming are among the jobs and crafts that an expert can partake even in the absence of office space. Outsourcing is also a possible move. Seems to me that companies are just becoming more complacent and is downplaying the ability of hackers and scammers to destroy their company's image that of course will catch up to them in the future.

Same thing here in Australia.

I've seen LinkedIn ads here hiring for cybersecurity professionals and apparently people could get in with a Bachelor of Arts or a Bachelor of Media Communications. Makes absolutely no sense.

Is this even worthwhile if you are hiring unqualified people imo? Sure, on paper you may seem like an absolute gem of a firm for having 50 staff on hand for cybersecurity related matters, but when you realise that 45 of them had studied English literature and haven't the slightest clue what they're doing, it's a lot less impressive (especially when they're getting paid big time!).

This is a case of "They can be trained anyway, so an appropriate degree is optional" which is very laughable. If you'd hire someone capable and in line with the job offer employers wouldn't have to pay so much to train these people which I presume is already significant. Goes to show how competent people are not only needed in the government but of course in private sectors where we entrust most of our daily activities with.

[dothebeats]

Same thing here in Australia.

I've seen LinkedIn ads here hiring for cybersecurity professionals and apparently people could get in with a Bachelor of Arts or a Bachelor of Media Communications. Makes absolutely no sense.

Is this even worthwhile if you are hiring unqualified people imo? Sure, on paper you may seem like an absolute gem of a firm for having 50 staff on hand for cybersecurity related matters, but when you realise that 45 of them had studied English literature and haven't the slightest clue what they're doing, it's a lot less impressive (especially when they're getting paid big time!).

With the right industry-grade certifications, these same people can be hired as cybersecurity experts. Sure enough these people wouldn’t pass the certifications if they do not have the knowledge. Then again, you’re right, most firms hire people for the sake of having enough manpower to show off, but not actually up to the task due to lack of experience, knowledge, and skills. I don’t even get it why some firms continue to hire people with qualifications way below the industry stabdards. It’s a waste of money, and it will never work even on cybersecurity threats that are not that severe.

[Kittygalore]

Probably the reason could be that there's not a lot of smart people in USA, most people that have a really academics and technology inclinations are immigrants like Asians, European or even Africans. Look at what some of the dreams of kids in USA wants, I think the top 1 is to become a YouTuber which isn't bad but it doesn't contribute a lot to society. USA is a cultural melting pot of the world, I think that the shortage can easily be solved, it just takes a lot of time.

[NeuroticFish]

Probably the reason could be that there's not a lot of smart people in USA, most people that have a really academics and technology inclinations are immigrants like Asians, European or even Africans. Look at what some of the dreams of kids in USA wants, I think the top 1 is to become a YouTuber which isn't bad but it doesn't contribute a lot to society. USA is a cultural melting pot of the world, I think that the shortage can easily be solved, it just takes a lot of time.

I think that you've got it wrong. This "the top 1 is to become a YouTuber" can apply to many countries. Also the average quality of students may be declining in many countries (maybe also in US).
Still I doubt that all this can make the average look better or worse in US. And it's not related to the topic, since, if there would have been willingness to hire such experts, they could have been found, whether American or not, whether from inside the borders or not. Today that is by far not a problem.

[Lorence.xD]

~

Yeah, there really are companies that want to outsource talents but not to completely hire them but I'm sure that there are good employers that sees the talent of those freelancers if they're going to take care of them.

I don't think that they will stop doing outsourcing anytime soon, remember that it's of value to them that they don't pay this people like a regular workers. So that's an unlikely to happen anytime soon. I don't expect black heart businessmen suddenly doing the taboo for them.

~

Maybe it's because that the violation and damage they've done cost a lot and that's why they don't want to hire them. But such talents are wasted if they've used it in a bad manner instead of looking for an opportunity that will cultivate that talent.

But their skills should outweigh the attacks that they did and it's not like they can get this jobs, remember that some of them aren't even college graduates which is the requirement for some of the businesses to accept new employees.

[Kittygalore]

~

I think that you've got it wrong. This "the top 1 is to become a YouTuber" can apply to many countries. Also the average quality of students may be declining in many countries (maybe also in US).
Still I doubt that all this can make the average look better or worse in US. And it's not related to the topic, since, if there would have been willingness to hire such experts, they could have been found, whether American or not, whether from inside the borders or not. Today that is by far not a problem.

Yes it can apply to many countries but if you look at it, most countries look up to or have USA as their standard so what happens there is just basically copied by other countries. I don't think that it's not a problem, remember that immigrants are being a target of prejudiced towards this people because they think that they're taking every jobs out there. I still think that the next generation is much dumber because no form of critical thinking is being employed.