In this ‘game of protection’ to balance defensive and offensive security techniques, now is the time for CISOs and business leaders to reach for a new cyber security manual – one that leverages gamification.
The implications of the Executive Order on America’s Cybersecurity Workforce and what it means for cyber workforce development going forward
The White House recently issued the Executive Order on America’s Cyber Security Workforce. This forward-looking executive order aims to close the cyber security skills gap and increase the number of cybersecurity professionals working in the field. This is a huge need for our critical infrastructure, national defense and modern economy. We are bound to see some changes across the industry with the passing of this bill. Although we don’t have a crystal ball to see the future, there are some implications we anticipate for the cybersecurity industry overall.
Improved Global Security from Nationally Recognized Standards
The executive order encourages widespread adoption of the cyber security workforce framework created by the National Initiative for Cyber Security Education (NICE). The use of the NICE framework will create some national standards in the industry and allow for more qualifying leverage. This will provide evaluation requirements used in contracts for IT and cyber security services.
Prioritizing Cyber Workforce Diversity
According to Cyber Security Ventures, there will be up to 3.5 million job openings by 2021 and currently, females represent less than 12% of the global cyber security workforce. This stat is crazy! To keep pace with sophisticated adversaries and develop technology that supports human cyber operator decision making, diversity of thinking and skill and approach should be a hyper-focus for the security industry. Women are well suited for, and extremely talented at, technical fields such as information security, security engineering, and AI engineering; however, recruiting and retaining women in these fields is not where it needs to be. There is a long-standing stereotype that cybersecurity is too technical for women and that’s not the case. There are many critical skills that women bring to the table including an incredible attention to detail, problem-solving, and communication skills that are as important in cyber work as the technical know-how. Groups like Cyber Patriot, Girls Who Code, and more recently Women’s Cyberjutsu are wonderful organizations that inspire young girls and women to pursue careers in cyber and technology.
The aptitude for cyber security lies not only in the technical fields, but can also be found in many unexpected disciplines. Some of the best cyber defenders started their career out doing something completely different. We need this type of diversity and people with different backgrounds to join the industry. We need to improve thinking and skill, both technical and critical thinking skills to combat today’s adversaries.
New Methods of Cyber Security Training
In developing the workforce, we need to be cognizant of the need for new methods of training that inspire the next-gen learner. The traditional ways of learning in a classroom have worked in the past, but there are a lot of statistics that show traditional classroom settings alone aren’t the most effective in terms of applied skill preparedness and learning retention. Studies on the effectiveness of traditional classroom settings show that students lose 40% of what they’ve learned after 20 minutes and between 50 – 80% of what they’ve learned after one day, and 90% of what they’ve learned after six days.
Gamified learning approaches are currently being adopted federal agencies, banks, oil and gas and other infrastructure organizations as well as academic institutions such as the University of Colorado, Divergence Academy, and Loudoun Public Schools. This form of active learning generally includes on-keyboard activities along with team collaboration and applying concepts to real-world scenarios, which has shown to improve retention to 75% compared to 5% through more passive learning methods like lectures with PowerPoints. Recently, a graduate student at the University of Colorado shared his experience after he played one of the cyber games in Project Ares, Circadence’s flagship learning platform. He mentioned that he liked the feeling the game created of a sense of impending danger from the robots and that made him think better and learn more as he worked to defeat them.
Pursuing ‘Cyber as a Sport’ to Capture Talent
We embrace the idea of “cyber as a sport” believing cyber security skill building can and should be fun, like sports. Cyber competitions are a great way to encourage skill-building plus they bring attention to the industry. These kinds of competitions should be happening from early school age (Girls Who Code), through high school (Cyber Patriot), and university (NCCDC), and then throughout the professional career. Competition categories can include individual and team-based events, software reverse engineering and exploitation, network operations, forensics, big data analysis, cyber analysis, cyber defense, cyber exploitation, secure programming, obfuscated coding and more.
Wicked6 Cyber Games, cyberBUFFS, SoCal Cyber Cup, and Paranoia Challenge are several examples of events where students can engage in healthy competition and skill-building among peers in an active, living lab setting. Circadence’s gamified training platform, Project Ares is used as the platform to deliver the competitive exercises though its immersive, gamified cyber range. Realistic scenarios challenge players in mission-specific virtual environments using real-world tools, network activity and a large library of authentic threat scenarios.
Without continued effort to increase the cybersecurity workforce, our critical infrastructure, national defense and modern economy will be jeopardized.
The publication of this Executive Order is an indication that government is ready to proactively address our very serious cybersecurity challenges and is looking to new ways of training and skill building to meet the demands of today’s workforce.
To keep organizations better protected in the wake of digital transformation, legislative progress like this is a significant stepping stone to alleviating the industry’s largest challenges.
How to Automate, Augment,
and Better Prepare
Policy makers are now prioritizing data security over talent, efficiency and controlling costs. As students growing up and being educated in the digital age, we are just starting to understand the importance of cyber security to individuals and their companies. Taking part in a Research Associate Internship on campus at Nichols College, our eyes have been opened to the vast number of threats we face on a daily basis.
Oracle conducted a study titled “Security in the Age of Artificial Intelligence,” where 341 C-Suite executives and 110 policy makers were asked of their plans to improve their company’s security in the next two years. The top answer from this sample was to train existing staff. Human error poses the greatest risk to these companies (Oracle). In order to mitigate this risk, it is imperative to understand the opportunity cost of training employees on the importance of cybersecurity. Prioritizing training would prevent small mistakes, potentially costing a company much more in the long run.
A Nichols College Associate Professor of Accounting and Finance, Bryant Richards, noticed a gap in cyber security education, wanting to bring cyber to campus in a big way, stating “As cyber risks have become ubiquitous throughout the industry, it is our responsibility to provide some degree of cyber literacy to our business students. We must train our accounting students to be data and technology professionals who understand accounting. The realistic and experiential nature of Project Ares matches how our students learn and provides a transformative learning experience.” Richards along with the two of us, helped Nichols partner with Circadence to complete a three-month pilot program of their gamified cybersecurity learning platform Project Ares.
What We Found: Circadence did a great job with Project Ares, with an appealing, gamified user interface that sucks you in and is easy to use. As a student with no technical experience in the cybersecurity field, Project Ares proved to be both engaging and challenging. It provided an abundance of resources through its Media Center and Mini Games. Users can obtain a base layer of knowledge, progressing into education on concepts like the Cyber Kill Chain and how hackers utilize it. The interactive Battle Rooms provide real-life, technical lab environments where users can spin up virtual machines, explore real-world tools, build their confidence, and hone their skills.
What We Learned: You do not have to be a professional hacker to steal someone else’s information or gain access to their computer. Understanding the code is no longer enough; this is much more than an individual problem. If your own device is compromised, the hacker can steal your personal information, and steal information from your employer and worse. This harsh reality surprised us when we first commenced our research. From clicking a wrong link in an email, to accidentally tapping an advertisement banner on your phone; these small errors can seem harmless but are really detrimental to your overall security.
The gamification of cybersecurity training has allowed those of us with no prior knowledge, a chance to get a leg up. With increased demand to train existing staff, new training approaches must be made for the next generation of cybersecurity specialists. Gamifying the process made it easily digestible, directly benefitting any potential company or individual.
The first step in becoming educated on cybersecurity is understanding that there are threats present in our everyday lives. In the words of the man who gave us our initial walkthrough of Project Ares, Brad Wolfenden compared cybersecurity to buying a gallon of milk, saying:
“I believe that part of the disconnect around cybersecurity best practices comes from the assumptions we make as consumers in general – that what we’re buying is designed and sold with our best interests, and security, in mind … The food you buy and eat is certified by the Food & Drug Administration to indicate it has been safely grown/ raised and suitable for human consumption. When making technology purchases, we cannot take these same conveniences for granted.”
It is everyone’s ‘job’ to maintain high ethical standards and awareness when operating on the Internet nowadays. It is no longer up to one person or pre-installed software to protect your personal information. The more we are educated on the basic underlying principles of cybersecurity, the safer we will all be.
Oracle. “SECURITY IN THE AGE OF AI .” Oracle, 2018, www.oracle.com/a/ocom/docs/data-security-report.pdf.
Wolfenden, Brad. “A Rising Tide Lifts All Boats: Celebrating National Cybersecurity Awareness Month.” Circadence, 30 Oct. 2018, www.circadence.com/national-cybersecurity-awareness-month/.
*Students R.J. LeBrun & Lorenzo Secola guest authored this blog post as part of their Research Associate Internship at Nichols College
You may have heard that the cybersecurity skills gap is widening, and that there is a massive shortage of cyber professionals today. In fact, Cybersecurity Ventures predicts that there will be up to 3.5 million job openings in the field by 2021. In spite of the growing need for people in cyber, women continue to be underrepresented in the field.
According to major findings from the 2017 Global Information Security Workforce Study:
- Women are globally underrepresented in the cybersecurity profession at 11%, much lower than the representation of women in the overall global workforce.
- Globally, men are 4 times more likely to hold C-suite and executive-level positions, and 9 times more likely to hold managerial positions than women.
- In 2016 women in cybersecurity earned less than men at every level.
It’s no surprise that women are the underdog across plenty of male-dominated industries. So why is it so important for women to close the gender gap in cyber?
We need diverse perspectives in cybersecurity
Firstly, cyber is an area that benefits greatly from utilizing people with diverse perspectives and histories to solve problems. As threat actors and black hat hackers often come from disparate backgrounds, the wider variety of people and experience that are defending our networks, the better the chances of success at protecting them.
Combat the stereotype that cyber is only for men
Secondly, as there are so many empty jobs in the field, it is ultimately detrimental for a factor like a gender to narrow the pool of people pursuing it. Unfortunately, the message is ingrained in women from a young age that tech and security are “masculine” professions, which results in a self-perpetuating cycle of unconscious bias against women in the field. These problems are difficult to fix because they are subtle and pervasive and often come back to issues in culture and education. In fact, an online survey, Beyond 11%, found that most women have ruled out cybersecurity as a potential job by the age of 15. This is unacceptable!
Everyone can learn cyber
Finally, there is a misconception that the cybersecurity industry is only for people with highly technical skills. Unfortunately, the “bad guy” hackers out there don’t require crazy technical skills to get to your personal information. Fortunately, being on the defensive lines don’t require them either. Cybersecurity is a highly trainable field and has a growing need for people in more positions than ever before, such as legal, marketing, and public policy – all of which women have proven to excel in. In fact, the communication skills, problem-solving and attention to detail skill sets needed to excel in cybersecurity are skills women possess and are really good at.
Introducing more women to cybersecurity
Programs and Events
Since many of these problems start for women from a young age and through somewhat unconscious societal and cultural constructs, it can feel like a daunting task to get women more involved in cyber. In order to combat these misconceptions, many programs and events have been put into place to provide young women with female role models in the cybersecurity field. Events such as the Women in Cybersecurity Seminar, Women in Cybersecurity Conference, and Cyber Day for Girls are just a small number of direct-action groups that companies like IBM have put in place to address the gender gap. Further cyber competitions like the Wicked6 Cyber Games, and organizations like the Women’s Society of Cyberjutsu and Girls Who Code are dedicated to introducing young women to cyber at that earlier age before they are told “it is not for them.”
Cybersecurity Mentorships and Internships
Mentorships and internships are another great way to introduce girls to other women in cybersecurity fields they may think are beyond their reach. Volunteers from tech companies have been going to summer camps specifically designed to encourage young girls to consider careers in STEM, such as the Tech Trek summer camp. Additionally, the Girl Scouts just introduced the first ever cybersecurity badge, which can be earned by completing curriculum and gamified learning around internet safety.
Persistent cyber career development
Another way we can support and retain women who choose cybersecurity roles is for companies have policies in place that ensure women do not miss out on opportunities to further their careers after having children. Things like flexible hours and the option to work from home can be key in maintaining a diverse and productive workforce. Hiring managers can also work to ensure equal employment opportunities when looking to hire for a new position. People from all backgrounds should feel welcome to apply for roles in this highly trainable and accessible field.
We need all hands-on deck now more than ever in cybersecurity, tech and STEM fields. Communicating to girls at a young age that technology isn’t just for their male counterparts, and that it can offer them a long and rewarding career, is essential in closing the gender and skills gap in cyber.
To learn more how to diversify the cybersecurity workforce from a strategic standpoint, read our other blog “Diversifying the Cybersecurity Workforce.” https://www.circadence.com/a-call-to-diversify-the-cybersecurity-workforce/
In an effort to address the cybersecurity skills gap and create a more resourceful and effective cybersecurity workforce, the US Senate has passed the Federal Rotational Cyber Workforce Program Act of 2019.