(ISC)² Blog

(ISC)² Provides Insight to Congressional Subcommittee on Diversification in the Cybersecurity Workforce

On May 21, (ISC)² COO Wesley Simpson was invited to join a panel of experts for testimony in front of the U.S. House of Representatives Committee on Homeland Security. The hearing, titled “Growing and Diversifying the Cyber Talent Pipeline” was a forum for committee members to ask witnesses for their observations and input on methods for growing the U.S. cybersecurity workforce and also for encouraging more minorities to join the profession. Mr. Simpson was joined on the panel by three other witnesses representing Grambling State University, The National Cybersecurity Institute at Excelsior College and McAfee. (ISC)² was approached by the... Read more →

Investing in the Next Generation of Cybersecurity Leaders

by Dr. Mansur Hasib, CISSP, PMP, CPHIMS Program Chair, Cybersecurity Technology, The Graduate School, University of Maryland University College In order for any discipline to advance and grow, each generation of established thought leaders must mentor and invest in the next generation. The new generation can infuse new ideas, varied approaches, and innovative new ways to explain and present material. This is exactly what happened in a dramatic way at the 2019 Secure Summit DC hosted by (ISC)² . John McCumber and Susan Lausch of (ISC)² invited me to organize a contingent of 30 graduate cybersecurity students and recent graduates... Read more →

U.S. Presidential Order Aims to Bolster Federal Cybersecurity

An Executive Order signed by United States President Donald Trump aims to grow the government’s cybersecurity capability, improve integration of the cybersecurity workforce between federal departments, and strengthen the skills of individual cybersecurity practitioners. The order, titled Executive Order on America’s Cybersecurity Workforce and signed by the president on May 2, creates measures to help federal agencies retrain workers interested in cybersecurity and requires agencies to adopt the National Initiative for Cybersecurity Education (NICE) Framework in government contracts. It includes an incentive component, creating an annual competition with cash rewards of at least $25,000 “to identify, challenge, and reward the... Read more →

Female Cybersecurity Workers Are Younger and Looking to Lead

The cybersecurity profession remains primarily a man’s world. But for how long? (ISC)² research reveals women are making fast gains in the industry, and as a group, they are setting their sights on leadership roles. Overall, female representation in the cybersecurity workforce has increased to about one quarter (24%), more than double the 11% estimate from 2016, according to (ISC)2’s Women in Cybersecurity report. The report is based on findings in the (ISC)² Cybersecurity Workforce Study 2018, and it uses different research methodology from the earlier study. For instance, it includes women who spend at least 25% of their work... Read more →

New Cybersecurity Reports Point to Increased Need for Retraining and Vulnerability Management

By now you’re well aware of the widely-reported (ISC)² research that shows there is a global cybersecurity shortage of 2.93 million professionals. Identifying, recruiting and training skilled talent to adequately secure organizational data assets obviously remains a top priority in our industry. Well, over the past few weeks, both Tripwire and IBM have published reports that focus on different layers of the problem and add to the conversation. In its Cybersecurity Skills Gap Survey 2019, Tripwire found that 80% of IT security professionals believe it’s becoming more difficult to find skilled cybersecurity professionals. Not a surprising figure. The interesting wrinkle... Read more →

Forget the Next Big Thing; What You Need Is A Skilled Staff

One of the most prestigious voices in the IT industry recently made an interesting proclamation: “The next big thing is dead.” So starts CompTIA’s IT Outlook 2019, which finds the next big thing is no longer about some new jaw-dropping technology advancement but rather a combination of various technologies, people and processes. If you’re expecting to be bowled over by a new technology trend any time soon, think again. Producing the desired business outcomes now means getting your human resources to expertly fuse together already-available technology building blocks and tools. And that’s what will fuel IT market growth of about... Read more →

CISSP Is Hot, Hot, Hot, Says CNBC

If you already have or are pursuing your CISSP from (ISC)², make sure you have your oven mitts at the ready. That’s because, as reported by CNBC, the new Upwork Skills Index includes the Certified Information Systems Security Professional as one of the 20 hottest job “skills” in the entire U.S. labor market. You read that right. Not just in security. Not just in IT. The entire labor market. Upwork is a platform for freelancers, so they keep a close eye on the types of skills employers are looking for and update their list quarterly to provide real-time validation of... Read more →

Cybersecurity Pros Are Not Feeling the Love… Again

Stop us if you heard this one before: Cybersecurity professionals are responsible for protecting their organization’s users and data from the dangers of cyber threats, but they feel underappreciated. Two-thirds (67%) believe “IT security is viewed either as merely reactive to business needs or a cost rather than an asset to the organization,” says a survey of cybersecurity professionals and CISOs by Thycotic, a privileged access management (PAM) vendor. The survey found that a majority of cybersecurity professionals in the United Kingdom and Germany say executives and co-workers see them as more of a burden than a business benefit –... Read more →

What Does Our Partnership with CyberUSA Mean?

By John McCumber, Director of Cybersecurity Advocacy, (ISC)² After a lot of planning and coordination, we were excited to announce our new partnership with CyberUSA earlier this week. What is CyberUSA, you may ask? Governed by its members, the nonprofit was established to enhance information sharing between states and improve cyber resilience at all levels of participation: local, regional, and national. It is focused on the common mission of enabling innovation, education, workforce development, enhanced cyber readiness and resilience within our state and local communities, and connects them at the national level. What does all that mean? The key takeaway... Read more →

Cert Magazine Salary Survey Says: CCSP is the Next Big Thing

For the fourth year in a row, Certification Magazine named the Certified Cloud Security Professional (CCSP®) as the “Next Big Thing.” The magazine conducted their annual salary survey and found that the CCSP was the top choice for professionals to pursue in 2019. Ranking #2 in the list – for the third year in the row – is the CISSP certification. You can read the full article, “Certification leads to improved performance, increased earning power” here or in the January issue of Certification Magazine. This issue focuses on detailed results and findings from the annual salary survey. Read more →

Cybersecurity Workforce Study: What Cybersecurity Certifications Are You Pursuing This Year?

(ISC)²'s recent Cybersecurity Workforce Study asked what certifications professionals had plans to pursue in the coming year. Download the infographic: What Cybersecurity Certifications Are You Pursuing This Year? Read more →

Cybersecurity Engineer Is the Top Tech Job for 2019

In 2019, cybersecurity engineers will be the best-paid, most recruited tech professionals as organizations struggle to fill vacant cybersecurity positions. The average salary for the position is now $140,000, according to job-finding website Scout Exchange. While this is good news for cybersecurity professionals, it shows how much of a challenge organizations are facing to fill the position. The intensity and damage caused by cyber attacks continues to increase, and as cybercriminals continuously refine their methods, it gets harder and harder to find skilled candidates to build cybersecurity teams to fend off the threat. (ISC)2 estimates there is currently a cybersecurity... Read more →

(ISC)² Presents to NICE Working Group

Our own John McCumber, director of cybersecurity advocacy for North America, was provided a great opportunity this week to present the findings from our recent 2018 Cybersecurity Workforce Study to the National Initiative for Cybersecurity Education Working Group (NICEWG) at its monthly meeting. As you may well know – or can guess – this working group covers the NICE Framework published by the National Institute for Standards and Technology (NIST) and brings together a diverse group of public and private sector cybersecurity experts to discuss ways to advance cybersecurity education, training and workforce development. To be invited to present to... Read more →

So You Think You Can Cyber?

The 2018 Cybersecurity Workforce Study, recently released by (ISC)2, reveals that 63% of organizations currently don’t have enough cybersecurity staff. The number is hardly surprising considering the worldwide cybersecurity workforce shortage is nearly 3 million. Employers have an acute need to build their cyber teams with the requisite skills and experience. Their priorities in looking for candidates include: relevant work experience – 49% understanding of advanced cybersecurity concepts – 47% cybersecurity certifications – 43% extensive cybersecurity work experience – 40% strong non-technical/soft skills – 39% If you’re seeking employment in a cybersecurity role, keep these priorities in mind. They provide... Read more →

Infographic: Building a Resilient Cybersecurity Culture

Download the report or infographic Read more →

How to Strengthen Your Cybersecurity Culture Despite the Skills Shortage

Despite a shortage of 3 million cybersecurity professionals across the globe, a comfortable majority of those currently employed (68%) are happy in their jobs, according to (ISC)2’s newly published Cybersecurity Workforce Study. Their job satisfaction is related to the level of investment employers make in cybersecurity skills, technology and practices – all of which determines how cybersecurity professionals spend their time. The study is instructive to employers who are hampered by the skills shortage, but nevertheless need to improve their cybersecurity posture and culture. “By providing the right security resources, whether that means additional personnel, training or specialized cybersecurity solutions,... Read more →

Workforce Study Methodology and Defining the Gap

2,930,000 That is the size of the global cybersecurity workforce gap. The breakdown is around 498,000 in North America, 136,000 in Latin America, 142,000 in Europe, the Middle East and Africa, with the largest deficit coming in Asia Pacific at 2.14 million. But what does this big, scary number even mean? Where did it come from? First, this new Cybersecurity Workforce Study from (ISC)² has evolved from past studies to become a more accurate representation of the broader workforce. We surveyed nearly 1,500 professionals around the world who spend at least 25% of their time on cybersecurity activities, which includes... Read more →

Cybersecurity Skills Shortage Soars, Nearing 3 Million

You might want to sit down for this one: The shortage of cybersecurity professionals around the globe has never been more acute. New research by (ISC)2 places the estimate at just under 3 million – 2.93 million to be exact – with roughly 500,000 of those positions located in North America. According to (ISC)2’s Cybersecurity Workforce Study, the gap is having a serious real-world impact around the globe. Asia-Pacific, with its growing economies and new privacy regulations, is experiencing the biggest shortage – 2.14 million positions. The massive worldwide shortage not only places organizations affected by the shortage at higher... Read more →

LIVE FROM #ISC2Congress: Making Cybersecurity Cool to Close the Skills Gap

The cybersecurity workforce skills gap is hampering the nation’s ability to combat cyber threats that target our way of life, economy and national security interests, according to U.S. Rep. Cedric Richmond (D-LA), who serves on the House Committee on Homeland Security. Delivering the first keynote at the 2018 (ISC)2 Security Congress, taking place this week in New Orleans, the Congressman said more work is needed at the federal, state and local levels, as well as in the private sector, to address the problem of cybersecurity and the skills gap. “We need a robust cybersecurity workforce,” Richmond said, citing a government... Read more →

Why the CISO Matters

The chief information security officer role hasn’t always gotten the respect it deserves. Research over the years has shown companies often treat their CISO primarily as a scapegoat for security incidents. But that may be changing – at least it is in organizations with a strong cybersecurity culture. New research by (ISC)2 shows the overwhelming majority of companies that properly staff their cybersecurity teams employ a CISO. The Building a Resilient Cybersecurity Culture study revealed that 86% of organizations that consider themselves adequately staffed with cybersecurity talent have a CISO. This is a substantially higher percentage than the 49% of... Read more →