How cybersecurity could revitalize the American Dream for a new generation

By Phil Quade

Recruiting more young people to join the emerging workforce will not only make the country’s institutions and organizations safer from hacks—it will fuel a vibrant 21st century economy.

I grew up in a Cold War household where it was comfortably assumed that you’d be better off than the generation before you. An attitude reinforced by enduring advice from parents and mentors, such as “success equals opportunity plus preparedness,” and “a problem well-stated is a problem half-solved.”

Later on, I learned there was wisdom even from difficult bosses, whose actions (or lack of them) still proved inspiring—“a journey of a thousand miles starts with one small step” and “be nice to those you meet on the way up because you will meet them on the way down.”

My elders’ assumptions, optimism and insight biased my perception of the future and vectored my career: with some planning, fortunate choices, resilience and some luck, opportunity awaited. But I’m concerned that optimism has faded for some generations that follow, and wrongly so. Too many early-career adults don’t see the path(s) available to climb the career ladder, so those already on the ladders need to help change that perception and reality. Certainly, we’re all accountable for our own actions and lives, but we can probably agree on the goodness of paying it forward and spotlighting a path that might not otherwise be visible.

A golden opportunity awaits

A golden opportunity presents itself: The business and government community has an opportunity—and need—to create and employ a large and diverse workforce, while simultaneously bolstering the integrity and privacy of the domain where our 21st century economy is most dependent: the cyber domain.

By all measures, the cybersecurity skills shortage is getting worse. One study found that 4.1 million more workers are needed on top of the current 2.8 million globally to close the gap. The problem has been growing for years, affecting governments and companies alike, resulting in unfilled positions, expensive recruiting cycles and painful security consequences.

A vibrant cybersecurity workforce fuels our nation’s innovation and growth, bolsters our critical infrastructures (for example, transportation, energy, health care, banking) and safeguards government services. And importantly, it re-invents and revitalizes the upward mobility aspect of the American Dream, serving as a combined economic and social engine.

With the right vision and strategy, we can simultaneously address the workforce skills gap and upward mobility problem, creating a large and vibrant cybersecurity workforce that revitalizes the link among capitalism, democracy and the middle class—the principles that make America strong. We have both the need for, and responsibility to, create it. But how?

The Strategy

With economic theory and social responsibility as inspiration, there are two key components of the new strategy—working the supply side and demand side simultaneously, and leveraging diversity. Let’s take a look at the diversity component first, since it’s an enabler of the economic side of equation.

  1. Redefine diversity: Not just the important ‘typical’ definition of diversity (for example, half of humans are women but they’re a small minority of computer scientists/engineers), but diversity of background. Some of the best cyber threat analysts I’ve worked with were not STEM-educated yet they made stunningly unique contributions to solving hard problems because they had backgrounds (life experiences, education) that the STEM-degreed people didn’t; they thought differently and that was invaluable. In addition to this practical benefit of being more effective in the cybersecurity arena, there’s an important society-oriented benefit of diversity that I’ll address later. With diversity as a means to increase the base pool of a much larger cybersecurity workforce, what can then be done, practically, specifically and relatively quickly, to produce results? That’s where the yin/yang approach of addressing both supply and demand comes in.
  2. Create an enduring personnel pipeline model: Create a Human Resources /Chief Technology Officer-driven program to grow capacity and expertise, specifically, a new kind of supply—a cybersecurity workforce of non-computer science-degreed people. Like the guild model of past centuries, recruit eager apprentices to join the cybersecurity trade, where apprentices achieve journeyman status through training and testing—and supervised, on-the-job experience. Journeymen achieve master craftsman status through time in the trade, hard work and peer recognition of skills. As a career cyber person and manager, I’ve seen this approach work; it’s an enduring model we need in our field to create a pipeline of mid- and expert-level cybersecurity operations people.
  3. Work the ‘demand side’ of the equation: Change the way we characterize the demand for those skills. Define specific jobs that leverage these cybersecurity apprentices. Write entry-level job descriptions that don’t require a computer science degree to compete for the position: Cyber Hygienist (keep systems patched); Security Operations Center Operator (monitor the cybersecurity watch floor for potential incidents); Cyber Incident First Responder (evaluate, mitigate, and triage urgent incidents); QA testing (test completed code for correct operation). Many such jobs can be capably filled with non-computer science degreed entry-level specialists, creating an entry-tier pay-band that smart ladder-climbers will jump on.
  4. Ruthlessly adopt automated techniques: In the early 1900s workers revolted against dangerous and demeaning factory environments, leading to a gradual workspace redesign to where machines and workflows complemented the work of humans, taking on repetitive and detailed work at high speeds, enabling people to do higher-order work. The same mindset needs to pervade the IT workspace—to better leverage highly-automated analytics to add value to the overall cybersecurity task at hand, rather than humans seemingly ‘serving’ the cybersecurity capabilities.
  5. Create an opportunity gateway for the generations that follow: An indirect but supremely important benefit to this strategy is the societal one: it not only addresses today’s business, critical infrastructure and government cyber needs, but it also serves as an opportunity gateway—a place where training and on-the-job-learned skills lead to advancement. Our young adults are looking for ways to enter, and rise within, the digital economy.

An opportunity-oriented cybersecurity workforce strategy is a means to create a desperately-needed, skilled, upwardly-mobile workforce. Not only will it fill an otherwise-widening skills gap in our digital economy, it will provide a welcome mat to those who previously couldn’t see a clear path to being part of the solution. The result will contribute greatly toward both stable and profitable democracies.

And let’s be clear that this is not a giveaway: The cybersecurity industry has a globally problematic skills gap that this approach helps close, both in quantity and diversity of thought (studies show that diverse teams are more effective).

Conclusion

Hard problems require optimism, creativity and self-supportive pieces to become enduring solutions. It’s why the American Dream and its partner capitalism—with both its genius and warts—works. We need a creative way to address the cybersecurity skills gap and simultaneously create a gateway to upward mobility for those who currently see more wart than genius. The approach:

  • Has its ‘head in the clouds and feet on the ground:’ It’s needed now, but importantly, it’s implementable, embracing the economic basics of aligning supply and demand and copies a career maturation approach—the guild model—that has served humankind well for centuries, ensuring an enduring supply of specialists.
  • Taps new talent pools: The enduring skills gap is not just a problem to solve, but a beacon of opportunity, to light a path for millions of highly competent people with diverse experiences who are looking for work. The time is now; we can’t rely, alone, on attempts to graduate more people with computer science degrees. Does this disincentivize STEM-degree aspirants? I don’t think so. There’s plenty of work to go around in cybersecurity that requires degreed computer scientists who need to understand and leverage the theories and practices learned with such degrees. It’s not that different than the medical profession model, where health care providers come with all sorts of educational and training credentials, with compensation to match. Businesses benefit by creating an enduring solution to the skills gap problem that also stratifies pay so that compensation aligns with skills.

With privacy at more risk than ever, disinformation a scourge that causes mistrust, excessive cost and too many inconveniences. It’s time to think outside the box. Cybersecurity needs to become like electricity in first-world nations—something one rarely has to think about; always available and adequate. The only way to achieve the goal of making cybersecurity something we can take for granted is by not taking for granted the value of diversity, the alignment of supply and demand, and the creation of upward mobility for those who aspire to it.

Find out more about Fortinet’s NSE Training Institute programs, including the Certification Program, Security Academy Program and Veterans Program, which provide critical cybersecurity training and education to help solve the cyber skills gap and prepare the cybersecurity workforce of tomorrow.

—

The content is paid for and supplied by advertiser. The Washington Post newsroom was not involved in the creation of this content.

Content From