Putting a dent in the cybersecurity workforce gap.

Voiceover: You're listening to the CyberWire network, powered by N2K. [ Music ]

Dave Bittner: In our ongoing "Solution Spotlight" series, today N2K President Simone Petrella returns with a conversation with ISC2 CEO Clar Rosso, about putting a dent in the cybersecurity workforce gap. Here's their conversation.

Simone Petrella: I am so excited to be joined today by Clar Rosso, and you've spearheaded some pretty amazing initiatives in your tenure since joining. Just to level set for everyone listening, those initiatives, one of which is the entry-level Certified in Cybersecurity certification, and it has had over 110,000 people express interest in joining the cybersecurity industry in just three months. I will also state for the record, we actually put out a challenge to our own team if they wanted to take the Certified in Cybersecurity. We are helping them get that and encouraging them to take it. So, we've created some of our own incentives to do that. But the workforce gap is why. But Clar, I'm excited to talk to you today about some things that you all are doing to help tackle that, especially around diversity initiatives as well. Before we dive into all of that, one of the first things I noticed about you is that you have a long history with associations, but of accountants.

Clar Rosso: Yep. Yep.

Simone Petrella: So, I would love to hear a little bit about your background, but then also your perspective on the similarities and maybe differences that you've noticed in the field since joining cybersecurity.

Clar Rosso: Thank you Simone. Thanks. It's great to be here, great to be talking to you. Thanks for having me, and it's fascinating, actually, that I come from working for decades from the accounting and finance profession, because I actually think my experiences there are not dissimilar to what we're doing here.

Simone Petrella: Yeah.

Clar Rosso: And there's a lot to be learned both ways in that relationship. So, accounting and finance has an underlying need to have a deep knowledge and understanding of risk management. And if you think about what cybersecurity, it's nothing but risk management. So, the overlap there was a super pleasant surprise for me.

Simone Petrella: Yeah.

Clar Rosso: When I joined the organization, and then personally I think that, plus the fact that in my career I had had so many opportunities as a business leader to be involved as a sponsor and then at different times very hands-on in the execution of tech projects. So that sort of, and I always, like, my whole career was really interested in talking to network security people. Although they didn't call themselves network security. They were just the IT guys, and they were guys.

Simone Petrella: Yeah.

Clar Rosso: And they were all about the network. And they'd draw the pictures on the wall and they'd explain what firewalls were to me. And this was, like, early days for me. And it left a lasting impression that is serving me well today. But when I think about the profession, there's a couple areas that some of what I learned when working with accountants is actually serving me really well here with cybersecurity. So, one is just thinking about the professionals. And in accounting, we had a workforce gap. Nothing on the scale like we have in cybersecurity, but that challenged us about a decade or so ago to really think how do we think differently about who we hire, and how can we challenge or traditional beliefs, that we need to have technical accounting skills, and really think about what are the core competencies that make someone a good accountant. Well, guess what? They're problem solvers, and analytical thinkers, and critical thinkers. They have a commitment to lifelong learning. We need them, we may not have historically needed them to, but now, today, we need them to be good communicators. They need to, in writing and in verbal communications, they need to be great. And gosh, that sounds really similar to what we need in cybersecurity. So I think that was a, that is a pleasant area of overlap that we can leverage. The other thing is we're here today at SECURE DC for ISC2. We just had a speaker downstairs and the room started talking about the disparity of standards in cybersecurity. And that really struck a chord with me, because, you know, ISC2, we're 35 years old in 2024. This is a new profession. We haven't been around for 150 years. So, we're early days and we are seeing a tidal wave of regulation coming to the profession, and professionals are overwhelmed because they want to be in compliance with regulation but they also need to do the work of cyber defense. And you can't really do both most of the time, so there are tradeoffs. So, we really have some opportunity to talk about setting doable standards in cybersecurity, and really harmonizing, and it has to be global because the work of cybersecurity professionals is global. And I think because the accounting profession has been around for decades, this will be my last accounting analogy, but they learned from that, but it took them 125 years to figure it out. We can do it much earlier. We can now start having the conversation about how do we harmonize. How do we harmonize across the globe, how do we harmonize within agencies in the US. And that can create a real important opportunity to strengthen the security posture of our whole ecosystem.

Simone Petrella: Yeah, I mean, it always has struck me, being in the cybersecurity industry for as long as I've been in there, we are an industry of professionals, but we haven't professionalized.

Clar Rosso: Yes.

Simone Petrella: And what I think you're describing is this concept of, like, professionalization, you know?

Clar Rosso: Yeah.

Simone Petrella: And the standards are part of it, but --

Clar Rosso: Yes. So we, like, kind of look at the, I don't know, I get a little confused about the number of the legs on the stool. But we have the certification piece, right? That has exam, education, experience, and ethics. I'm going to come back to ethics. We need the standardization and the standards that we're holding people to, but then I think the other thing, and this is actually one of our work projects for 2024, is we need a standardized code of professional conduct, or ethics in the profession. So, we've been starting to talk to government stakeholders, the other certifying bodies, about let's put together that framework for what does a code of professional conduct looks like. What are the standards we all need to be held to. And then a profession where in certain parts of the world it's more lucrative to go work for the bad actors than it is to work for businesses and government, it's really important that we take that step and focus on that professionalization.

Simone Petrella: I would think it's also pretty helpful for, like, recruiting other people to even progress in the field. Because I know one area that a lot of cybersecurity leaders are really nervous about right now are, you know, the recent SEC charges against SolarWinds and then who's taking that personally and kind of, you know, what happened with Uber. So, there is some accountability that's coming into the profession.

Clar Rosso: And we need to create clarity about what's okay and what's not okay. I think the other thing that we need to be looking at is I was actually really surprised. I feel a little naive about this, but I was really surprised to learn because ever since I've been in an executive role in an organization, I have been covered by the D&O insurance of that organization. So, work I do on behalf of the organization is covered by the insurance. CISOs aren't always included in that. And that was actually pretty stunning to me, that they're not. And so I think that we can do something as a 600,000-plus professional organization to talk to businesses, talk to the insurance companies, and talk about, wait a second, we need to have the same protections for our cyber leaders as you are giving to other leaders in the organizations. Now, that doesn't absolve anybody if they participate in criminal activity, but yeah --

Simone Petrella: But it wouldn't do that for any other executive, either. So, switching back to kind of the meat of the topic, ISC2 is known for putting out its annual cybersecurity workforce study, and the most recent came out in early November of 2023. Would you mind sharing some key takeaways or themes that you saw from this most recent study?

Clar Rosso: Okay, as usual, it's a good news, bad news scenario, which is really ultimately good news. So, the workforce grew. It grew 8.7% to 5.5 million professionals. We count fractional people in cybersecurity as part of the workforce. And, because it is really illustrative of what the cybersecurity workforce looks like. So anybody who spends more than 25% of their time on cyber roles, we include as part of the workforce. So 5.5 million, we grew the supply. Always good news. We pat ourselves on the back. But at the same time, the demand grew even more. So our unfilled roles in cybersecurity now globally are around 4 million, which is huge. It was about a 12 point something percent increase year over year. And while that's worrisome, I actually, like, think it's positive, too, because what that tells me, because this is demand for unfilled roles, is that organizations are prioritizing cyber professionals on their team, which is they understand the value of cybersecurity professionals in the workforce. So that was kind of the top level. It's about the same all over the globe. APAC has the highest gap. It's well over 2 million unfilled roles, which, again, you could turn that to say they have the greatest awareness of the value of cybersecurity within the business. But some of the other things that came out that I thought were interesting, maybe not surprising, but, like, uniformly interesting is 75% of all the respondents said threat landscape's the worst they've seen in the past five years. This year we dug into the difference between people and skills. And so not just do you have a gap in your workforce, but do you have a skills gap? And perhaps it has really shown a spotlight on the fact that we need to be paying more attention to the skills gap. Because 92% of organizations are saying they have skills gaps in one or more areas, and a significant number of professionals are saying if we could address the skills gap in our organization, it would lessen the impact of the workforce gap. So I think that really points to thinking about what are the skills we need? How do we take the time? And that's the hard part, right? You're a cyber professional. You know this. That's the hard part. How do we take the time to develop the skills that we deem essential to our organization, so that we can really address our security posture.

Simone Petrella: And in some cases, take the time to identify which skills are required for the roles that we need. There's kind of an inventory analysis that has to happen before you even take the time to mitigate it by giving people training.

Clar Rosso: Yes.

Simone Petrella: Or, you know, whatever you're going to do to develop them. Are you finding also, just in this unique economic environment, the market's doing okay but companies are behaving like, you know, costs are kind of constrained. And so the first things that often get cut are development budgets. I'm just curious if you're seeing that, too.

Clar Rosso: So, yes, which then makes me say we're hearing two different things, right? We're hearing two different things. So we actually did research early in 2023 where the C-suite said we understand the value of cybersecurity professionals. We know that our risk is worse during times of economic instability. Last people we'd ever cut from our teams are cybersecurity professionals. So we were cautiously optimistic, but what we found is that 47% of cyber professionals in the past year have dealt with cutbacks to their team, either in the form of layoffs, budget cuts, or hiring or promotion freezes. Seventy-one percent agree that the risk of malicious insider, and this was some of the interesting stuff that we found in this report, too, are far greater during these times of economic pressure. And it's actually, like, a stable time versus times like now. It's like the threat of malicious insiders are three times worse than they are during normal times. In fact, we had more than 50% of the respondents say that they had either first or second-hand exposure to a malicious insider event in the past year, and that over 40% are saying they've actually been approached to be the malicious insider. And that, I think the cybersecurity profession knows and understands the risk of malicious insiders. I think there's a lot of education we can do in the business community of helping them understand the risks that they're creating to their organization when indiscriminate cuts are made to teams.

Simone Petrella: What is ISC2 doing when it comes to educating at the executive level? Is that something you all are getting involved with now as that mission is expanding?

Clar Rosso: It is. So we're looking at it from two angles. So our first angle is to work with cyber professionals themselves and help them think about what they do in terms of how a business runs itself. So, talking about cyber in terms of how is it supporting the organization's strategic priorities, or what risks may be presented to the organization's strategic priorities based on what they do or don't do related to cybersecurity. So, we're working on that. We've started to run cyber leader workshops this fall, and we're going to start to ramp that up into next year. So that's one way we're tackling it. We are also tackling it with business leaders through more generalized outreach of how we talk to the media, how we talk to groups that represent business leaders, and boards of directors about what they need to know about cyber literacy. We actually endorsed a report by NightDragon and Diligence? NightDragon and Diligence. Sorry about that pause there, but that actually looked at the cyber literacy of public company boards of directors in the US, and it found that only 12% of directors have any level, any reasonable level of cyber literacy. So if they're, so board directors in the US are woefully unprepared to consider an organization's cyber risk, and that's in public companies. So just imagine what it is in private companies. And then the third thing we're doing is we are scanning the horizon on global regulation. We're trying to look at it through that lens as well, of what are the decisions that businesses are making. And I think one of the, what I think we see and hear governments talking about as being kind of business friendly. We're going to share best practices with you. We're going to suggest what frameworks you should be following. I'm not sure as business friendly as they make them out to be, because we're allowing businesses to kind of shoot themselves in the foot, so to speak, and make bad decisions that are putting them at risk if they're part of critical national infrastructure, and practically what's not, right? You're putting the whole nation at risk. So it's a really interesting situation. And I think there is a ton of work to do. We were just in a room where somebody said, you know, the business leaders in my sector, they're really smart. They make thoughtful decisions, but, and then he said, but time and time again, they're not prioritizing the cybersecurity risks within their businesses. So I have to ask, are they really making thoughtful decisions? Do they really understand what they're deciding on?

Simone Petrella: Right. Well, there's that old adage now that every company is a tech company.

Clar Rosso: Yeah.

Simone Petrella: I mean, what company isn't? You know, you could be driving FedEx trucks and there are, those trucks are loaded with sensors. They know every single location they're at when they're happening. Like, you don't think that's connected to the internet? How are you not running a tech company?

Clar Rosso: Exactly, exactly.

Simone Petrella: Well, you know, full disclosure, we've been a partner of ISC2 for a long time, but one thing that is so exciting to me is it seems like your mission's really expanded over last few years and you're just taking on so much more. Everyone knows ISC2 is the CISSP.

Clar Rosso: We are CISSP.

Simone Petrella: And what you're describing is so much more as we think about that road to professionalization. Has that been, if I'm reading in between the lines here, has that been part of your charter? Have you been thinking about reshaping the organization?

Clar Rosso: Yeah, working with our board of directors, that is absolutely intentional. So, I would akin it to, you know, we're talking about professionalizing the sector and part of that is professionalizing the professional bodies. So we really, and our peers acted like training organizations to some degree. We push people to be certified and we certify people, and that has done that, the work of ISC2 and the other certification bodies, has done more to build the cybersecurity workforce than anything else across the globe. So that has great value and we're still totally committed to that. So that part I always want to be clear about. But the reality is our members, the cybersecurity profession, needs representation. They need people out there advocating with regulators, policymakers on what makes sense and what doesn't make sense. Because everyone goes generally to make policy with good intentions, but they don't really understand the impact of the decisions they're making unless somebody who has that expertise can come and let me explain to you why maybe reporting a cyber, every cyber incident within 24 hours of it happening actually doesn't make any sense at all, right? And so part of what we can do is we can help speak for the collective. We can give voice to the individuals in ways that they aren't going to be able to do for themselves. And so absolutely intentional on that advocacy front for the profession. The other thing that we've really expanded greatly and will continue to do into the future is once someone is certified, rather than just automatically saying, okay, earn your next certification, really focus on what are the areas of professional development that you need most, and how can we help you do that? So, you can imagine in the virtual halls of ISC2, we are talking a lot about third-party supply chain risks. We're talking about AI security and the safe and ethical use of AI. We're talking about OTIT, industrial controls, you name it. We're talking about all those things and talking about how do we help people effectively and rapidly make sense of what's going on so that they can do their jobs better and faster and easier.

Simone Petrella: Well, on that point, I know a part of that is also addressing diversity and inclusion. And that's a priority for ISC2 as well. How are you approaching those particular issues in the cybersecurity community, and what initiatives are in place now to promote diversity?

Clar Rosso: All right, well, so we kicked off a DEI initiative three years ago when I first joined. And we brought a group together globally to say, what is it? What's the landscape look like here and what do we need to do? And the data is super clear. People, we bring diverse individuals in and they don't stay. And it's the worst with women, right? We bring women in and they don't stay in cyber, and we need to change that and we need to understand what the root causes of that are. So our approach has been first and foremost that we're not going in alone on this. So there are so many wonderful nonprofits all across the globe that are focused on helping different kinds of diverse or underrepresented groups enter the cybersecurity profession. So, some of them are racially based, ethnically based, gender based, neurodiversity based, there's tons of organizations. So, we are partnering with them to understand what we can do to help people be successful. And one of the things that we've found out, and we held a global DEI summit in Washington, DC last summer to bring that group together and talk about what can we do that's most important. And where we landed was sort of a two-way path on employability. How do we, for individuals, beyond our Certified in Cybersecurity, how do we help provide them with the tools and the confidence they need to consider a job in cyber, to interview for a job, to create that resume, to successfully onboard in a job. And especially when you might be onboarding in an organization where you don't see a whole lot of people like you there. And then how do you help them just navigate the workplace in a way where they feel included and they belong and that it's somewhere where they want to stay? So a whole bunch of work starting in that area. And there's a lot going on there. We just want to amplify and scale that. And we now need to also address the employer side of the equation. And I bet you have stories you could tell me.

Simone Petrella: So many.

Clar Rosso: But we need to work with employers to say, what are those best practices? Let's work together, because your heads are all nodding when we talk about hiring differently. So, let's talk about that. How does that mean you changed your job descriptions? How does that mean you change, how do you change how you filter for who you interview, how might that even change how you interview and consider who's a qualified candidate for a job? And then from there, once we get people hired, what are the best onboarding practices? How do you create an inclusive environment where everybody's voice is heard? Because that little thing, and it's not a little thing, that is, one, it's a key to great problem solving in organizations that are dealing with dynamic challenges. But it's also one of the number one indicators of job satisfaction for cybersecurity professionals that make them want to stay at an organization, is when they feel like they're being listened to. And so we're going to work on the employer side with all those things. We're going to talk about pay equity with people. We're going to talk about their advancement practices and how to do it. And then we're going to start to spotlight the organizations that are doing it well. We don't have an actual name for it yet, but just imagine ISC2 Cybersecurity Employer of Choice --

Simone Petrella: Yeah.

Clar Rosso: -- and we already know that organizations, that in their job postings talk about their diversity, equity, inclusion programs are viewed more favorably than those organizations that don't have that. So, we think if we add this other level, those employers will be the employers that people are beating down their door for.

Simone Petrella: Everyone always wants to keep up with the person next to them. So that's a brilliant idea. I love it.

Clar Rosso: Yeah. I've got to tell you one more thing. I've got to tell you one more thing. We now actually have data that shows that organizations that have DEI programs in place have better security postures than those that do not.

Simone Petrella: Interesting.

Clar Rosso: So 19% of organizations that have DEI programs in place report that they have, they're at severe, moderate to severe risk. As opposed to 34% of organizations either have no DEI programs at all, nor any plans to have them ever in the future. So, I think that that's really interesting because people, some people when you talk about DEI, it's like they think they are being sent to the principal's office.

Simone Petrella: Right.

Clar Rosso: And it's like, this isn't about sending you to the principal's office, this is just about making you better, all of us better at what we do.

Simone Petrella: So what's your hypothesis on that? I have a couple I could come up with, but what's yours?

Clar Rosso: Well, I want to hear what yours are, too.

Simone Petrella: Mine would be that if you have a DEI program in place, that you've set a cultural expectation that you're looking for diversity of thought, experiences, and backgrounds. And so as a result, you are, if you're making the effort to kind of put the program in place, then you're doing a little more than just talking the talk. And so even if it's not entirely formalized, it's created a culture, or at least the start of a culture, where you could hire people who have different diversity of thought. And that makes, I believe that that actually ultimately reduces our risk in a security world.

Clar Rosso: Absolutely. I agree with you completely. Because I think what it does is it creates that, if you're already doing that, it's not just a checkbox activity. You are already thinking in ways that create, like, that sense of inclusion and belonging in the organization, which also hopefully means that you're also taking care of the people on your teams so that you're not burning them out and you're engaging in some of those best practices of job or project rotation. So, okay, we've all got to be 24/7 for periods of time, but we don't need to be 365 days a year. So, I think so. And I do think, I absolutely see a strong willingness across the profession to head in this direction. And this goes back to, we want to do it. Help us on how we do it.

Simone Petrella: Yeah.

Clar Rosso: We know there are resistors and there's really vocal resistors, but they are absolutely positively the minority in the profession, not the majority. Most people are very inclusive. I actually have been really impressed, you know, moving from working with a different profession before to coming to cybersecurity, at how much cyber professionals want to help bring along the next generation of cyber professionals. So, I think we're ripe for change here.

Dave Bittner: That's N2K president Simone Petrella with ISC2 CEO Clar Rosso. [ Music ]