Solution Spotlight: White House releases cybersecurity workforce and education strategy
Simone Petrella: I am joined today by Camille Stewart Gloster, Deputy National Cyber Director at the White House. In her role, Camille leads technology, supply chain, data security, and cyber workforce and education efforts for the Office of the National Cyber Director, and led the team that recently released the National Cyber Workforce and Education Strategy last week. Camille, thank you so much for joining.
Camille Stewart Gloster: Thank you so much for having me, Simone. I'm excited to talk about the strategy.
Simone Petrella: Great, me too. It's certainly an area I love to talk about all the time. So I think we're going to have a great discussion here. You know, just to sort of set the stage before we really get into the meat of it. The strategy that just was released really is built around four pillars. And those are equipping every American with foundational cyber skills, transforming cyber education, enhancing the national cyber workforce, and strengthening the federal cyber workforce. That's a lot of ground that's covered across those pillars and in the strategy. And there's more tactical recommendations here than we've even seen before. What are the big takeaways that you want the industry to walk away with as they review this very hefty document?
Camille Stewart Gloster: It is a big document. A big, ambitious document that has a series of short-term, medium-term, and long-term objectives. What I want folks to take away from this is that the work builds on itself. We embarked on a journey in July of last year with the National Cyber Workforce Summit at the White House to engage our partners around what are the challenges? What are the opportunities? We recognize that one page in the National Cybersecurity Strategy wouldn't do the workforce enough justice, but what should we address, how should we address it? And if there's one thing I hope people have started to see from ONCD is that we really want to make sure that the work that we're doing is collaborative and considerate of all of the important perspectives that are represented across the digital ecosystem.
And so, we worked with 34 different agencies across the federal government and the Executive Office of the President. We worked with over 200 organizations and SMEs across cyber workforce and across cybersecurity and cyber in general. To really understand the confluence of challenges. Because there are many. Many folks kind of stop at the, well there's a workforce deficit, and there's so much more to it than that, right? If the National Cybersecurity Strategy is to work, that means we are moving towards an affirmative vision for the digital ecosystem. That means one that is resilient, defensible, and aligns to our values. And there's some shifts that we talk about in that. And if we achieve that, that means that we are going to have products that are secure by design. Which means we need a workforce that is capable of understanding security no matter where in the life cycle of a piece of technology they sit. We need people that are able to adapt to and address the challenges of today, but also address the challenge of tomorrow in an environment that we don't know what the technological landscape will be. So the strategy is technology agnostic but recognizes how things like AI, quantum, and other evolutions in technology will change the digital landscape and what we ask of folks.
And so, across those four pillars, we look at three imperatives. First, like, how do we get everybody to the table? Because we do have a deficit. So we need more people to be doing this work. But not just more people, more people of different backgrounds. And that benefits us because one of the strengths of our nation is the myriad of voices and perspectives that we have. So how do we get rural communities, veterans, people of color, and other underrepresented groups, as part of the cyber industry. It helps them reach the work. And it also helps us adapt to a changing environment. So let's get everybody to the table, so diversity.
The second is skills. We need a skills focused workforce. We need the ability to gain lifelong skills. And that starts with the foundational cyber skill for every American that you kind of talked about. Right now, you know, reading, writing, and arithmetic are what people picture as the foundational things that you need to operate in society. But quite frankly, we, there are some foundational cyber skills that should be part of it. And that is what we propose in the strategy. And so, you can build on top of that occupation specific skill. So if you're a nurse, you need the privacy skills to be able to protect the data of your patients. And then cyber skills, if you decide you want to work in a cyber career.
And then the last imperative is really focused on building ecosystems because we have found throughout all of that engagement that I talked about, that ecosystems, regional, local, that can really tailor to the needs of a community but also create these networks of feedback that can help inform how training happens, how education happens, how employers find their workforce, are really vital to a thriving cyber workforce. So when employers can inform academics on what the education and training apparatus should look like, and when those same academics can ask for skills based opportunities for their students, you know, and we can engage the community, you get a more robust dialogue that not only solves the workforce challenge, but solves a number of other challenges. So that was kind of a lot. But I think those three imperatives are really honing in on that. And the fact that all of those things, needing to address the entire ecosystem of players and the four pillars, but also those three things, came from you all. Came from everyone who engaged on this strategy.
Simone Petrella: Yeah, no. It makes complete sense. And you know, having been in this space so long myself, just one of the many challenges is there are so many stakeholders. You know, thinking about who you reached out to. It is a very robust and rich community, which is wonderful, but also a challenge at the same time. And so, you know, given that, what do you see as one of the things or a number of the things that are critical to the success of this strategy?
Camille Stewart Gloster: Everyone taking ownership of the implementation of the strategy. So what I hope is every person, every organization, every institution that picks up this document recognizes that the federal government has the smallest piece of implementing this strategy. We can provide funding, we can work on the federal workforce, you know, we can work on some strategic things and provide support, but the private sector, academia, state and local governments, non-profit partners all need to drive implementation. And that work has begun. We saw some of that in the launch of the strategy and the commitments that came out from our partners. But also we're embarking on an implementation road show, where we are going to different regions and locales around the country to have a dialogue about sparking an ecosystem or supporting an ecosystem that already exists. That work started August 9th in Nevada at UNLV, University of Las Vegas, where we had our director, Kemba Walden, really launch a collaborative effort with academia, private sector, and a number of others to have a conversation about what a cyber workforce ecosystem looks like there, what those needs are, how the state and local governments can continue to support them. So that folks can get into the good paying jobs that are in the cyber workforce.
Simone Petrella: Yeah. I love that you say that because, you know, it's so incumbent on the industry, whether it's academia or employers, to kind of step up and take responsibility. And you know, this strategy is such a great step in calling that out. But another thing that struck me immediately that I think distinguishes this strategy versus other executive orders we've had over the years on education and workforce in cyber is that there actually are opportunities for funding and investment through the federal government to kind of give a little bit more teeth and emphasis to some of these initiatives. What's your recommendation for institutions or organizations looking to take advantage of those investments and really step up to the plate?
Camille Stewart Gloster: I'm so glad you said that. Some of our partners, like National Science Foundation, they are saying we need more partners! We have more money to give! Right? That is an awesome opportunity. It's not very often the government --
Simone Petrella: Right!
Camille Stewart Gloster: –we have more than enough money to meet the needs of our partners. And I mean, quite frankly, I don't know if that means that we have more than enough money, but what it does mean is that there's a lot of opportunity for organizations that aren't currently connected to institutions like the National Science Foundation to get connected. If you are an academic organization, if you are a non-profit, if you are eligible to get grant money from them focused on some of these cyber workforce initiatives. If you start to do work that is implementing this strategy, I encourage you to reach out to partners like National Science Foundation, CISA, NICE, that have money and resources or can be a conduit to you getting some. We are not the only source of funding. There are funders and philanthropists who are doing this work. There are private sector organizations that are doing this work as well. And so there's a lot of opportunity for funding. I encourage folks to start to reach out to those organizations that have made themselves available for them to get the resources.
Simone Petrella: Great. So I want to go back to the concepts of ecosystems that you brought up. Because it's also something that is something I feel very passionate about. Which is, you know, we have so many stakeholders in play when we talk about cyber workforce. Whether it's academia, whether it's employers, whether it's government agencies, whether it's training providers and partners. And one of the challenges is the fact that it is a very busy space. And it's hard to scale a lot of great initiatives. You touched on this a little bit before with some of the implementation road show that you'll be doing. But what is the White House's role going to be bringing these stakeholders together given the vastness of the industry and just how many providers there are in a space?
Camille Stewart Gloster: Yeah. I mean, we are conveners. Our goal is to pull folks together, to help with resource sharing, and to catalyze action. What I don't want to be is a bottleneck. So I want organizations, I want regions, I want locale to feel empowered to go do this work with or without my or the Office's involvement. But where we can support, where we can bring organizations together, where we can help spark a cyber workforce ecosystem, I want to do that as well. So I've kind of been thinking about it in two parallel tracks. Where there are organizations that get the work, please start this in whatever location, whatever region, you think is right for having a cyber workforce ecosystem. And on the other side, we will be going to other areas with either an expressed interest in having a cyber workforce ecosystem, or has one that's burgeoning or starting out and needs some support. Or has a really robust one that could provide a lot of feedback and best practices for their counterparts. And our goal is that those more robust ecosystems will be a model for their peers. How do we extract the best practices and the lessons learned so that they can be adapted to different environments? They won't all look the same because they don't need to. That's why there are local, regional, and quite frankly even international ecosystems. So, that they are tailored to the outcomes, the communities, the you know, groups and organizations that are part of it. There needs to be that flexibility and responsiveness to all of those factors. But we want to help bring folks together. So that would be my goal, the convening.
Simone Petrella: Yeah. Well, and let this be a PSA to everyone listening that if you haven't picked up the strategy already and read it, you need to. And if you are taking the time to read the strategy, then you should also be thinking about how you can implement some of the initiatives that could help improve the workforce in your own organization, too.
Camille Stewart Gloster: Yeah.
Simone Petrella: You know, there are also, because I have to ask, there's also a component of the strategy that addresses the federal cyber workforce. And much of the tactical recommendations that you all have put forward include coordinating efforts across multiple departments and agencies to build, expand programs, tap into grant funding. How are you thinking about prioritizing those initiatives at the federal level?
Camille Stewart Gloster: Yeah, I think that's an important question. So the federal government of course is a unique beast. A piece of the whole, the national ecosystem, and so one of the things that I will prioritize is the connectivity between the private sector and the federal ecosystem. But we really have to think about where are our resources, where do budgets align, where do we have authorities, who owns what piece of the puzzle, and we'll use that to help us prioritize where we start. And what things are short, medium, and long-term winds that will help us get to that desired end state. The nice thing is, and I think the thing that gives this strategy and this work staying power is we've established the National Cyber Workforce Working Group and the Federal Cyber Workforce Working Group. And those two bodies will help drive implementation of the strategy. The Federal Cyber Workforce Working Group is most germane to this piece of the conversation because that is where we're having the conversations about what are the priorities for the federal government? What is the support we're needing? What's working across the federal government as we transition to things like skills based hiring? How do we continue to implement that? How do we have shared resourcing around hiring fairs and things like that? And so our partners OMB and OPM have been very collaborative as we seek to make sure that we're giving federal agencies what they need to be successful in doing that prioritization exercise.
Simone Petrella: Great. Well I think it's safe to say that even though you are now the culmination of releasing a strategy, really the work is starting now.
Camille Stewart Gloster: It starts now, yes.
Simone Petrella: So a lot of exciting things in store. Last question, certainly not least though, on a personal note, having been doing this for the last, you know, year plus now and coordinating and herding all these cats, what's the one area of the strategy that you're the most excited or proud of?
Camille Stewart Gloster: So I think to start it's the look across the entire environment, right? Most strategies that you see focus on the national cyber workforce, focus on federal, but coming together and thinking about how do we equip every American? How does that feed into their access and opportunity, such that they become part of the cyber workforce? And then how do we look at the entire national cyber workforce, including the federal workforce, and our international partners and how they feed into our understanding of what are best practices but also how we share that so that we're all thriving so that we get the workforce that we need. I think that holistic view and being able to set an affirmative vision around that is a thing I'm most proud of. In terms of being excited about the implementation work, I think the fact that we're taking it outside of DC and getting to each local region and talking to folks about what their needs are in context is going to be really important to the success of this, because for example, state and local governments, they lead on education. They will have to drive what the needs of their communities are. They will be the conduits for getting rural communities more engaged. And I think that is going to be really important. I'm excited for people to realize the there are good paying jobs across a number of different disciplines in cyber. You know, everyone has that misperception that, you know, cyber is just for super technical folks, engineers, coders. But there are a myriad of different job opportunities. Lawyers, marketers, training folks, like I mean, there's so many opportunities. And recognizing the importance of each of those and how they all come together to attack the challenges and realize the opportunities is going to be really important. And then the last thing I'll say, too many.
Simone Petrella: Just so much excitement to go around.
Camille Stewart Gloster: Right, exactly. Is probably the hardest and challenging strategy, but I don't want to shy away from it, it's the data challenge. Right? When I talked about the dynamism of the ecosystem, which means we have a changing set of needs, we have a changing set of definitions for what's cyber, we have a changing set of technologies, that's why we have not nailed down nationally or federally that data question. Right? And been able to track it in a way that's consistent and coherent. I want to do the work to try to start to address that. I mean, it will take time. But that is one of the hardest problems in the strategy and one that I am looking forward to taking a bite out of.
Simone Petrella: Yeah, fantastic. Camille, thank you so much for joining us today and sharing all of your insights. Really appreciate all of your support in putting out this strategy and getting it going. And best of luck as you hit the road with it.
Camille Stewart Gloster: Thank you so much. I really appreciate you having me come talk about it.