A recent report from Cisco mentions that it's becoming more difficult to hire skilled IT security professionals...
and that data analysis skills are increasingly important in the security industry. My company has definitely had trouble bringing in qualified security staff, so I'm wondering if we should consider mining the talent pool for people who can do data analysis and teach them security skills on the job. What are the pros and cons?
It is getting increasingly difficult to find skilled security practitioners to fill key roles in information security teams. Hiring managers have to look outside of candidates with traditional information security skill sets to fill open positions.
Experience with data analysis is one nontraditional skill set that could be useful to an information security team.
One of the most important skills an information security professional can have is acute awareness of normal operations and being able to recognize immediately when something is out of the ordinary. A candidate with strong data analytics experience might already understand how to identify data that doesn't match the normal patterns.
Monitoring security event logs and network patterns is a job that's often overlooked by information security professionals because it isn't as "sexy" as finding exploits and it can be incredibly time-consuming. If we have learned anything from the latest data breaches, it is that our current technique for monitoring networks for intrusions and data exfiltration is simply not working. New information security professionals who come from a data analytics background could bring fresh ideas that are sorely needed if we are to improve early detection of network intrusions.
The difficulty will be getting these candidates up to speed with the technology of information security. I remain skeptical that anyone can be trained in these technical skills. It would be like saying that an accountant could make a good physician because both positions require attention to detail and are heavily government regulated. I don't want my accountant to perform surgery any more than I want my physician to do my taxes. There may be some data analytics candidates who do possess an aptitude for the technical aspects of information security, but they have to be evaluated individually.
An effective information security team should contain members with a diverse set of skills. Candidates who come from the field of data analytics could be a part of this effective team if they're paired with technical security practitioners. They have the potential to improve monitoring processes, but they need to be evaluated for the technical aptitude they need to understand what they are monitoring.
There are other areas to mine for information security candidates that should be explored as well. Systems administrators, network engineers, programmers and even ham radio operators often possess the technical curiosity required for a career in information security and will require less training. The information security team needs a diverse set of skills, but technical skill is the one common denominator that cannot be excluded.
Ask the Expert
Have questions about enterprise security management? Send them via email today! (All questions are anonymous.)
For more insight on security staffing woes, check out this magazine feature.
Dig Deeper on Information security certifications, training and jobs
Related Q&A from Joseph Granneman
The consequences of phishing attacks could fall on the victims as enterprises start to punish employees who fall for this age-old scam. Expert Joseph... Continue Reading
CERT's ITPM certification is designed to help enterprises with their insider threat programs. Expert Joseph Granneman discusses the certification and... Continue Reading
Privileged users pose a growing threat to organizations. Expert Joseph Granneman looks at this insider threat and shares ways to mitigate it. Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.