| The United States is facing a critical shortage of cybersecurity professionals, one that government watchdogs and experts say is only expected to grow in the coming years. The shortage, which runs into hundreds of thousands of people, has spurred government officials to ramp up their efforts to address two of its driving factors: a lack of professional development opportunities and barriers surrounding diversity. "Developing sound public policy requires diverse perspectives from communities that represent America. It requires the recruitment, development and retention of diverse talent," Department of Homeland Security Secretary Alejandro Mayorkas said in a speech last month announcing the agency's plans to launch a diversity and workforce development initiative in the coming months. "It requires equal access to professional development opportunities to fill the current half-million cyber vacancies across our country and to prevent future shortages that threaten our ability to compete." The significant task comes at a critical moment for U.S. cybersecurity as both the government and private sector are still reeling from a major Russian hacking campaign that infiltrated at least nine government agencies and a separate Microsoft breach that compromised thousands of local U.S. businesses and organizations. Efforts from the public sector demonstrate there's one way to make a huge immediate impact on the workforce problem: highlighting and promoting existing talent in underrepresented communities. "You cannot effectively change a pipeline without making it visible who's already there," says Camille Stewart, who co-founded the nonprofit campaign #ShareTheMicInCyber with Lauren Zabierek, executive director of the cyber project at Harvard Kennedy School's Belfer Center. They launched the online campaign in June as a way for prominent cybersecurity leaders to lend their platforms to Black professionals by allowing them to tweet from their accounts. The aim of the project was to amplify the voices of Black people who work in cybersecurity as well as connect them with professional opportunities. "Our goal is really to show people that there are individual actions that they can take to elevate the fact that there are black practitioners already working in this space," says Stewart, a cybersecurity attorney and a Cyber Fellow at the Harvard Kennedy School's Belfer Center. "After the murders of George Floyd, Ahmaud Arbery among others, the cyber community, like many other communities, is really looking for ways to effect change and be part of something bigger. So this is a way to do that." Since the first campaign, #ShareTheMicInCyber has hosted two additional events and companies including Google and Twitter are helping by offering trainings and programming. As a result of the events, participants have connected with new business partnerships and even board seats, Stewart says. #ShareTheMicInCyber has also partnered with the nonprofit think tank R Street Institute for a project called "Making Space." The initiative started as a pledge to get organizations to commit to including women and minorities on panels they hosted or sponsored. It now boasts more than 40 partners and has expanded to other work, including a new effort to launch an online database for organizations and companies to connect with Black professionals. "What I didn't want to do is publish a pledge and get people signed on board without giving them the resources to make that pledge actionable," said Tatyana Bolton, policy director for R Street's Cybersecurity & Emerging Threats team. "Part of the problem is that people always say, 'I love diversity and we absolutely want women and people of color on our panels and events. We want to hire them. But I don't know of any.' I wanted to take away that excuse."  A worker at her computer. (Credit: Images by #WOCinTech/#WOCinTech Chat) | Tearing down barriers to entry such as excessive job requirements and unaffordable training could also help address diversity. A key factor in the workforce shortage is a culture of hiring requirements that many experts agree don't reflect the what's needed for entry-level employees. Those excessive requirements can often deter qualified applicants from applying. "We cannot close the workforce gap by continuing to hire the way we have been hiring for the past 20 years," said David Forscey, managing director for the Aspen Cybersecurity Group. "We failed. And that's because we are cutting off a lot of the available talent through biased hiring." The Aspen Cybersecurity Group has worked with more than 30 employers to get them to expand their candidate pipelines for cybersecurity jobs and rewrite job descriptions. Training and certification, which can often run into the thousands of dollars, also pose barriers to low-income applicants. #ShareTheMicInCyber now also offers a scholarship in partnership with Women in Security and Privacy to help cover training, certification and other professional development expenses for Black cybersecurity professionals. Issues of diversity don't stop at getting professionals in the door, experts note. Organizations have to be willing to invest in sustained change, including promoting diverse leadership and creating a safe work environment where Black professionals can actually thrive, Stewart and Bolton say. Lawmakers and policymakers are also working to address barriers to entry. A policy report from Congress's bipartisan Cyberspace Solarium Commission last fall urged the federal workforce to ensure cyber development policies and programs "consistently and deliberately incorporate efforts to recruit and retain underrepresented populations including women, people of color, and the neurodiverse." The report's recommendations align with those from nonprofits: lessening recruitment barriers, investing in workforce training programs and sustaining investment in retaining a diverse workforce. "While a lack of diversity in the federal government is by no means unique to cybersecurity, the demand for more people, and more diverse perspectives, in cyber makes the need especially acute," the report noted. "The federal government can and must help drive this change throughout the national cyber workforce." But those successful retention policies — or even the exact diversity of the current cybersecurity workforce — are hard to quantify, experts say. "It's very unclear what the baseline is," says Forscey. "There's just not a lot of data on what's the picture of diversity today and what [practices] companies have adhered to that have actually generated success." Just nine percent of the U.S. cybersecurity workforce identifies as Black or African American, according to a 2018 study conducted in partnership with the nonprofit International Information System Security Certification Consortium and the International Consortium of Minority Cybersecurity Professionals. Official government data on the U.S. workforce is virtually nonexistent, however. "If we're going to make meaningful change on diversity, equity and inclusion in the federal government, we have to understand who already is in the workforce," says Laura Bate, a senior director on the Cyberspace Solarium Commission and cybersecurity policy fellow at New America. "And we have to understand the dynamics that shape that. What causes people to stay? What causes people to leave?" Experts say diversity is also a national security issue. "We won't prevent the next SolarWinds or Microsoft Exchange hack if we keep doing the same things with the same people over and over and expecting different results," Bolton says. "We have to recruit and elevate diverse and new voices in cybersecurity. It's critical to our national security." A diverse workforce is also key to dealing with foreign adversaries, who have weaponized systemic racism in the United States to sow discord, Stewart says. For instance, Russian actors exploited racial tensions in information operations in the 2016 election. "It is a national security imperative for us to address systemic racism, and part of that is diversifying the workforce. Part of that is having uncomfortable conversations about how racism manifests itself in our institutions and creates bias and our technology," says Stewart. "And so I tend to start my conversation there because we've seen that the argument that it is the right thing fails with some people. I think an argument that works for everyone is the fact that it is essential to the mission and it is." | Share The Cybersecurity 202 |  |  |  | | | 
Email 
No comments:
Post a Comment