A lack of skilled resources is not the only factor behind the cybersecurity workforce shortage. So much thought and effort has been poured into this topic, and yet the reality on the ground is only getting worse.
In order to better understand the skills gap, Check Point recently surveyed 450 IT professionals across the world, asking them questions about their challenges in managing their organisations’ security.
The results were startling. We found that 77 percent of all respondents were concerned with their security teams’ capabilities to deal with current and future cybersecurity challenges. When asked for the reasons for these concerns, 67 percent expressed that their teams lack the cybersecurity knowledge and expertise required to handle the current level of cyber-attacks.
In Africa, the skills crisis is continent-wide. The security industry here is thriving – Check Point alone has more than doubled its workforce over the last three years. But as the market grows so the demand for scarce cybersecurity skills increases.
Indeed, 67% of cybersecurity professionals in the Middle East and Africa feel they don’t have the skills to combat the increasing sophistication of cyber-attacks. I can’t shake the sense that there’s a major element of this situation that isn’t being addressed, an element equally critical as repairing the talent pipeline.
Is it a people problem?
The cybersecurity industry is booming with new technologies and products. These products or solutions vary from technologies that assess an organisation’s risk and vulnerability levels, to tools that monitor and analyse a current attack surface and report back when it is under attack, and countless other products that remediate, confront or prevent attacks as fast as possible.
From the vast amount of meetings with our customers around the globe, we’ve noticed that CISOs (Chief Information and Security Officers) tend to manage around ten to fifteen completely separate solutions for their security. Given the sheer number of technologies that each professional needs to handle, it doesn’t come as a surprise that our survey found that 64 percent of the respondents’ teams expressed difficulty in managing their security workload.
Trying to manage an overload of non-integrated, disparate point products is tying teams up in knots, requiring talent and experience beyond what is currently available in the workforce.
Consolidating to cut complexity
As part of our survey, we asked IT professionals about their experiences using multiple point security solutions versus using a consolidated solution from a single vendor. Survey results revealed that a consolidated security approach leads to significantly lower staffing challenges.
Only 38 percent of respondents in the point solution group felt like they had enough resources to manage their workloads, while more than half of the consolidated security strategy group felt prepared. Even more remarkably, 61 percent of the point security solution group identified their staff’s lack of security expertise as the main culprit. Meanwhile, nearly two-thirds of the consolidated group felt like their staff had the expertise to manage their security solutions.
On the surface, a point solution strategy has some appeal – by mixing and matching your favourite products from different vendors, you can employ a diverse, versatile security strategy. Dig deeper however, and the data tells a different story: any benefit from this solution diversity is overshadowed by the increased cost of solution complexity.
Manage complex threats with simple products
We, the cybersecurity industry, need to recalibrate our efforts away from complexity toward simplicity. Educational programmes and initiatives to provide highly trained individuals are welcome and needed. Check Point conducts a number of solution-specific training sessions and seminars in Africa and has also launched an intern programme to transform young IT individuals with potential into seasoned security professionals.
But I think we also need to take a long hard look at ourselves and examine the ease of implementation and use of technologies that we are delivering to the market. Make no mistake: today’s era of cyber-attacks is on a completely different scale. These attacks, referred to as Gen V, require sophisticated, innovative products that react fast and prevent, or block attacks as soon as they happen.
However, this increase in sophistication cannot be at the expense of simplicity and efficiency.
We need to place a much stronger focus on consolidating our solutions to deliver consistent and unified management, so that learning curves are minimised. We must simplify our products, so that high-level analysis of their output by senior engineering talent is not necessary.
When our industry provides simpler, more consolidated solutions, we will also have come closer to reducing the cybersecurity skills gap.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version