The CyberSecurity Skillsgap we all hear

Z0sickx

Might not be the perfect section for this discussion but i've been reading for a very long time about the "skills gap" we have in Cyber and everyone always talks about the shortage and how getting more woman into STEM fields, modifying our college programs, influencing children while they're young. But what specific technical skills do we need and/or what soft skills need to be brought in as well. I've done some initial research into this and have gotten some information about specific technologies i.e Cloud, Big Data, Data scientist, etc..but trying to dig deeper into specifics that people interested could do to help themselves ease into the field or what the field desperately needs to fill in general

Looking to see what you guys know and help a paper i'm trying to write

Thanks!

LionelTeo

Giac Security Expert #199 and 9 years of experience in blue team/SOC environment here. You might be surprised to hear this - no technical skill is actually needed for getting entry career in Cyber Security. Here is why I said so, cause I personally had worked and trained many new graduates without any experience into cybersecurity to be able to handle incident response and actually work on various malware in incidents. One of the analysts I had trained successfully even had a background of bachelor in mathematics, but could even deobfuscate various malscripts to a great extent and even show professional with many years of experience on how it was done. I am not the first person who would think this way, as another person named Rik Ferguson had mentioned the same thing in an article link found here: https://www.zdnet.com/article/there-isnt-a-cybersecurity-skills-gap-rik-ferguson/

Of course, some of you reading this may think, then why is there even a perception of a Cyber "skill gaps" here after what I had mentioned. The reason is actually quite simple, most firms are seeking Cyber Security professionals with various type of technical skillsets that can fit into their operations, but there is not enough cybersecurity environment that can build out that kind of skillsets from applicants. However, most firms are overlooking the fundamental aspect that it is actually quality of character traits that enable the analyst to reach this sought after skillset. Therefore, the answer lies in actually knowing the kind of character traits that can make a great analyst, and not the technical skills.

Using malware analysis as an example, you can send an analyst to SANS reverse-engineering malware course and even had him to obtain the GREM certificate. However, does that mean that the analyst is now able to reverse malware? Unfortunately, the answer is no if the character traits do not exist. Contrary, someone with that necessary character traits is able to become a great reverse engineer even without needing to attend the course (the course could, however, help to reinforce certain concepts). 

Cyber Security is actually all about solving problems in various situations, which is why problem-solving is a critical trait. You can have a security course that teaches one thing about malware, and the attacker is going to get more creative and came up with better ways to invalidate the current techniques used. Therefore, a good analysts is one who would find multiple ways to work with the malware, either by finding new techniques or make modifications to existing techniques. The same concept actually applies to penetration testing with the whole try the harder thing like OSCP, it is all about trying different ways to break in an organization through various experimentation and creative thought process. 

The second character trait is actually knowing the right approach to ask questions. As no single cybersecurity professional is able to handle any situations on their own, which is why it is necessary for a security professional to know how to reach out to each other for help when required. The best infosec teams is a team which is capable of covering each other weakness, through working together via discussions. It is also essential for the team members to know how to ask when they are struggling, especially junior members should be reaching out to senior members of the team during critical or unsure situations. 

So how can an interviewer work out on identifying candidates with these two traits? Elon Musk pretty much got the problem-solving phase covered. It is regarding asking about a candidate the most difficult problem in his career and listening to how deep the candidate can go into. You can reach up in details here: https://www.msn.com/en-ca/money/topstories/elon-musk-asks-this-simple-interview-question-to-tell-when-an-applicant-is-lying/ar-AAAvckd

The second traits sort of come from one of Steve Jobs quotes, “It doesn't make sense to hire smart people and tell them what to do; we hire smart people so they can tell us what to do.” Being able to work with each other is actually about approaching each other with the right questions to bring up a discussion. You can actually learn a lot on someone character based on how they asked questions instead of what kind of answers the provided. A good scenario leading the candidate to answer "what sort of questions are being asked during his engagement with clients/team members". By listening carefully to how the candidates asked their questions, it can greatly help the interviewer to identify this trait.

Once a candidate with these two traits had been identified, a great onboarding training phase will bring out the skillset from these candidates. I personally prepared my training program around giving various type of scenarios and have them spend a week digging through. It can be a linux commands to parse raw logs, malscripts, maldocs, malpdfs or actual logs from past incidents. The idea here is to actually have them to work on it mostly independently until they reach the gold standard of the work required. This is how I get fresh graduates to integrate with the team.