• Beginners’ cyber security courses for cyber security professionals?
• Cybersec teams take on the unqualified.
• Little on-the-job training provided as standard.

Cyber security surveys that question IT professionals can sometimes uncover facts and trends more by means of their omissions than inclusions.

For example, in the O’Reilly State of Cybersecurity 2024 results, only 20% of security teams are using AI to handle labour-intensive operations like log analysis. The age of revolutionising cybersecurity with machine learning algorithms has yet to dawn, it seems.

The O’Reilly paper at least comprises answers from a quorum of whom a quarter are active cybersecurity personnel. In that respect, the paper’s findings are at least based to some degree on the opinions of those whose daily bread-and-butter work is protecting the enterprise.

Beginners’ cyber security courses for cybersecurity professionals

Of the total of 1,322 respondents, around 1% not in cyber have some form of industry-accepted security accreditation such as CompTIA CySA+. Qualifications in cyber don’t tend to exist in other IT functions, such as development or systems administration, it seems.

At the same time, 41% of respondents emphasised integrating security into the development lifecycle. But without personnel who code or build networks having made their security bones, it’s difficult to imagine how proactive the approach might be to embedding good security practice into production applications.

There are some promising signs in terms of practice adoption, as 49.2% of respondents said their organisation had implemented some kind of zero-trust framework, although the paper doesn’t mention what proportion of enterprise applications are covered. But at least there’s a keenness in that respect to lift an organisation out of the low-hanging fruit category.

Key management, a cornerstone of zero-trust, was held to be ‘important’ by 38.9%, and 33% considered DevSecOps to be something that will help bolstering the defences of the cloud stack. These stats suggest that there may be a gap between thinking something actively useful, and actively implementing a solution.

As the accompanying article states, “When we’ve looked at the data, it’s at best a question of whether the glass is half empty or half full – more likely, the glass is three-quarters empty and we’re being asked to pretend that it’s half full.”

The personnel issue

No discussion of cyber security and the implications for its failure would be complete without an honourable mention given to the difficulty of hiring people with the necessary expertise. Only around half the survey’s respondents said that their organisation insists that new hires for the cyber security team have some kind of recognised security qualification.

That doesn’t necessarily mean that the ratio of qualified to non-qualified staff could be higher (the survey puts it at 2:3 qualified to unqualified), although in an ideal world, it would be. It’s more likely that given the scarcity of experienced, skilled staff, many organisations will hire bodies without a formal qualification, and, we’d hopo, go on to train the new intake.

Yet only 29.1% of those surveyed have been formally trained by their employer, with most relying on self-learning using books and videos to bring themselves up to speed. It’s a sorry state of affairs when new staff have to take beginners’ cyber security courses to get up to speed.  And among those on the payroll, 49% percent reported that their employer requires less than an hour a week statutory training, and only just less than a third of employers mandate an hour or more training each week for cybersecurity staff.

Budgets and faith

Even the lowly support technician is aware that if IT does its job well, the phone never rings.

While every piece of media on the subject of cyber security is prefaced with doom-laden phrases like ‘accelerating level of threat’ and ‘hackers are getting cleverer and more cunning’, it’s a tough call for a CISO to get an increased budget on the evidence of ‘nothing to see here.’

If the HR department sees unqualified staff being taken on as new starters, and the CEO isn’t having to make public statements about losing customers’ credit card details, fighting for training budget for cybersecurity staff looks like an uphill struggel. Wider training in internet hygiene for other personnel becomes a near impossibility.

Existing boardroom fights are big enough for issues like finance staff’s cybersecurity training – such as “Don’t Click The Links: 101” – to be relegated to an afterthought in many organisations.

The value placed on KPIs in the rest of the enterprise means that IT and cybersecurity are always on the back foot, and this – the need to appear to be proactive – likely explains why AI-based projects are all the rage in the cybersecurity industry. There’s at least a budget for anything with AI on the label.

As technologies, ‘AI’ log combers and anomaly detectors can be useful, but like every new shiny toy in the cyber security toolbox, the dangers remain that they either wave more red flags [email reqd.] than are necessary, and/or hallucinate (that is, go wrong) enough that they’re not trusted.

The magic bullet that marketers would like to convince us that AI tools represent are useful as long as they’re targeted at the budget review session. Aim the magic bullet at a determined, financially motivated hacking group and they’re less effective.

Education

Despite every business and organisation in 2024 requiring an internet presence, or, at least, an internet connection, most decision-makers outside the cyber security enclave exist in a state of ignorance.

That’s understandable: the differences between UDP and TCP/IP are as opaque to most as a month-end close is to anyone outside the finance department. But if the only educative activity of the IT function is the management-provided teach-yourself manual for cyber security staff, then there are two failings for the organisation’s employees:

The first is cyber security professionals who need to keep at the top of their game (and the majority are very keen to learn), and the second is the rest of the business’s workers who unknowingly put themselves and their employer in danger every time they open their laptops.

IT departments would benefit in many ways, including budget allocation, if they could spread the word that being on the internet at all is a dangerous game in 2024. Teaching beginners’ cyber security courses to the rest of the company may seem onerous for trained cyber pros, and doing so may sideline valuable staff in the short-term. But being a security expert gets a lot easier if threats are described and explained to everyone. That way, there are fewer rogue link clicks or re-use of personal Facebook passwords everywhere.

Once training the masses is taken care of, security experts can get back to configuring zero-trust framework platforms and answering survey questions.