One third of ANZ business looking to hire infosec skills

Thirty-three percent of businesses in Australia and New Zealand are looking to hire information security-specific skills, according to a new report from the Computing Technology Industry Association (CompTIA).

In total, more than three-quarters of survey respondents indicated that their organisations were looking to improve security skills. A mix of methods were reported, including offering security training for current employees (37 percent); hiring people with security-specific skills (33 percent); and offering security certification for current employees (28 percent).

Furthermore, 20 percent are exploring the use of third parties and outsourcing security while 14 percent are looking to expand their use of third parties.

According to AustCyber’s Australia’s Cyber Security Sector Competitiveness Plan 2018, a shortfall in Australia’s cybersecurity workforce may already be costing our trans-Tasman neighbours more than $400 million in lost revenue and wages. The Australian infosec sector is already short around 2,300 workers, with an additional 17,600 cybersecurity professionals needed by 2026.

The volume and variety of cyberattacks is one of the primary factors contributing to the security skills shortage. Today’s technology stack contains a diverse set of components, and any of these can be vulnerable. A breach in any one element could disrupt operations, leak data, or create access to other parts of the system.

A range of skills is therefore needed to secure modern infrastructure, respond to incoming threats, and ensure proper operations.

“Given the current skills gap, the importance of offering security training and certification will be more important than ever in equipping the future workforce,” CompTIA ANZ Channel Community executive council member and Datto, Inc.’s APAC director of sales, James Bergl, said. “It will also inspire loyalty by showing employees a willingness to invest in their career development, which ultimately benefits the business long-term.

“For channel businesses, the skills gap may lead to an increase in outsourced security as ANZ businesses are left with few other options. Heavy competition from competing channel businesses will mean that a strong sense of loyalty will be required for the channel to retain its talent.”

While skills growth is the most direct way to improve the effectiveness of a security team, there are other steps organisations can take to give a security team the best chance of success.

“From a cultural perspective, understanding that IT is now a strategic activity drives a new mindset and behaviour. Likewise, new attitudes and practices must emerge as security becomes a separate operational function, and quickly integrating a new mentality throughout an organisation will help security efforts move forward,” Bergl said.

“The most critical aspect of modern security for an organisation to grasp is that the objective is no longer to build the ideal defence. Implementation and maintenance of a secure perimeter is still a necessary task, but it is no longer sufficient.

“Cloud computing and mobile devices have introduced workflow and data storage techniques that require new models, and the incessant nature of attacks makes total prevention an unreasonable goal. As such, companies need more proactive methods to ensure a strong security posture including retaining and upskilling their security workforce.”