This article was first published in Forbes by Justin Rende and has been reposted for its valuable insights. The original can be found here. To address cybersecurity talent management at the executive level, please contact Deborah Page, our Vice President of Technology and Government Contracting Practices.
The aftermath of the Covid-19 pandemic triggered a chronic labor shortage across most developed countries. This, coupled with the scarcity of talent—particularly in the cloud security space—has greatly impacted cybersecurity circles.
Statistics show that 52 million data breaches occurred globally during the second quarter of the year. The issue is spurring the demand for cybersecurity talent across all industries, but with more than 700,000 unfilled cybersecurity positions across the U.S., businesses could face serious losses unless they can find a satisfactory solution soon.
Quantifying The Cybersecurity Worker Shortage
As of March 2022, more than 60% of corporate data was already stored in the cloud. This percentage constantly increases as organizations move digital operations into cloud computing environments. Cybersecurity is already operating at an all-time high, with approximately 4.7 million professionals in the workforce.
In addition to the shortage of workers in this field, the 2022 Global CISO Survey showed chief information security officers (CISOs) in the United States were working under a cloud of burnout (53%) and job-related stress (60%). These challenges are direct consequences of the labor shortage, the growing trend towards cloud computing and the increasing number of cyber threats facing organizations.
The Impact On Company Operations
As the shortage of skilled cybersecurity workers continues, it has begun impacting companies’ ability to achieve compliance. Businesses need to achieve or maintain compliance, and their consumer data needs to be secure. Companies that don’t have enough resources to achieve compliance and guarantee customer data security could face challenges in marketing their products and services and, in turn, impact aspirations for growth and expansion.
Why Compliance Matters For Companies
Compliance is an important factor in any organization, but it’s not always driven by the need for cybersecurity. The main driver for compliance right now, especially with startups, comes from their customers needing them to have certain security frameworks and controls in place to sell their products to consumers. Before customers are likely to upload their data into a system, it needs to have passed certain stringent security standards.
For example, before users were willing to upload their photos to Instagram, the platform had to provide all the necessary controls and policies for people to feel safe. Achieving this type of compliance takes work, and when companies don’t have the resources to fill positions, they’re unable to do the work. The result is many initiatives don’t come to fruition, or even if they do, the market won’t embrace them because they aren’t sufficiently secure.
Facing The Fallout Of The Labor Shortage
Organizations that can’t recruit qualified, skilled workers to fill their cybersecurity positions will likely experience productivity losses that could slow down the overall technology environment. Many companies may find themselves unable to take their products to market. Without SOC 2 or ISO compliance, they won’t have the credibility required to thrive in the competitive marketplace. And as demand increases, the cost of cybersecurity staff will increase well beyond where it is currently.
Even companies with established cybersecurity teams may be at risk if the CISO and their team have more experience with on-premise systems than with cloud computing. These workers may lack an in-depth understanding of cloud architecture and are often more accustomed to securing physical servers than SaaS-driven systems hosted in the cloud.
Developing Potential Solutions
Finding and appointing qualified cybersecurity employees is currently challenging, and many companies can’t afford to wait until the situation changes. With current teams stretched too thin to function effectively, standard solutions such as on-the-job training, recruitment incentives and worker bonuses barely scratch the surface.
While solutions such as outsourcing certain positions are available to address some of these issues without incurring unmanageable costs, there are also steps that organizations can focus on to identify in-house solutions and ensure compliance in the interim. Companies seeking potential solutions should start by following the steps below.
1. Determine your current level of compliance.
Determining your organization’s current level of compliance is the best way to measure compliance status is to develop a clear understanding of every asset, resource and system and assess their security posture against a compliance framework.
2. Identify internal security duties.
Appoint high-level executives to carry responsibility for identifying all internal security duties. For example, a CISO understands compliance requirements and would be able to implement the protocols necessary for achieving compliance.
3. Conduct regular gap assessments.
Conducting regular gap assessments and implementing continuous monitoring can also help organizations maintain their compliance. These solutions monitor a cloud-hosted infrastructure’s security controls against various frameworks, such as NIST 800-53, ISO 27001, SOC 2 Type 2, PCI and others.
4. Develop adequate security documentation.
This is a crucial aspect of building an information security management system. This documentation outlines the responsibilities of each and every employee, allows organizations to determine whether tasks are assigned to the right people and identifies whether additional staff resources are required. Many compliance frameworks require a detailed and comprehensive “roles and responsibilities” document.
Finding A Route To Compliance
Overcoming the shortage of skilled cybersecurity personnel is critical for any organization operating in the technology environment. Organizations that have moved their operations to the cloud or are planning to do so in the near future must find a way to achieve the compliance required in their industry, or they could face monumental consequences and roadblocks. In the absence of adequate personnel, companies must take steps internally or look to outside solutions to ensure they implement essential compliance practices.
