The Remediation Series — Part 3
Part Three of the Remediation Series
As previously established, an organizations cybersecurity doctrine is centered around disrupting the cyber-attack process, aka “killing the chain.” The ability for a potential victim to carry out this Kill Chain strategy depends largely on personnel and their collective KSA body. Entities that can build and maintain the proper assortment of KSA’s will succeed in their defense against cyber-attack, whereas those that lack such a collective will struggle to ensure the confidentiality, integrity, and availability of their digital assets. Bearing this in mind, it is essential to establish and promote the knowledge, skills, and abilities the industry has deemed critical to possessing and mastering.
Industry KSA’s can be divided into two groups: hard and soft skills. Hard skills refer to the expertise necessary for personnel to successfully complete job responsibilities. Such skills are specific to the job and can be defined, evaluated, and measured. Soft skills consist of attributes and personality traits that influence interpersonal relations and workplace productivity. Perhaps most important to note is the fact that hard skills can taught in concrete steps, whereas soft skills require more nuance and are relatively more difficult to teach. Despite this difference, both skill types are required to be professionally successful[1].
To begin, the “Soft Skills” set revolves around the internal and external nature of personnel. The archetype of the arrogant but intelligent lone wolf is no longer seen as desirable in hiring circles within the cybersecurity industry. In fact, such individuals are seen as a detriment rather than an asset[2], with social soft skills taking precedent in the mind of many industry leaders. Soft skills such as teamwork and strong communication and writing ability highlight the increasingly involved dynamic IT security personnel have with other departments as well as management. Hiring managers also look for strong problem-solving abilities as well as an innate curiosity and desire to understand how things work[3]. Both skills are essential in troubleshooting and signal an individual’s ability to grow and adapt to an organization needs. When considering the economic risk businesses undertake when onboarding cybersecurity personnel, it is understandable that hiring managers wish to detect strong potential in a candidate.
The “Hard Skills” set can be further divided into five general categories, each with their own subsets that represent a diverse array of KSA’s needed for successful cyber defense[4][5][6][7].
Of course, due to the flexibility of the field, many of the listed skillsets have considerable overlap with other general categories. Furthermore, there are many skills which exist within the industry that have not been explicitly listed. This table is not meant to be exhaustive, however, it is comprised of the most requested skills by hiring managers and represent a strong base on which to focus learning and mastering. It is worth noting the tendency of these skills to overlap dictates an industry-wide framework be adopted to establish clear lines of separation of responsibility to encourage specialization. Such examination will be the focus of the succeeding article.
[1] The Balance Careers. (2020). What are hard skills? https://www.thebalancecareers.com/what-are-hard-skills-2060829
[2] McAfee. (2017). Hacking the Skills Shortage (1). https://www.mcafee.com/enterprise/en-us/assets/reports/rp-hacking-skills-shortage.pdf
[3] RAND Corporation. (2014). Hackers Wanted: An Examination of the Cybersecurity Labor Market (RR-430). https://www.rand.org/pubs/research_reports/RR430.html
[4] McAfee. (2017). Hacking the Skills Shortage (1). https://www.mcafee.com/enterprise/en-us/assets/reports/rp-hacking-skills-shortage.pdf
[5] Homeland Security Advisory Council. (2012). CyberSkills Task Force Report. U.S. Department of Homeland Security. https://www.dhs.gov/sites/default/files/publications/HSAC%20CyberSkills%20Report%20-%20Final_0.pdf
[6] RAND Corporation. (2014). Hackers Wanted: An Examination of the Cybersecurity Labor Market (RR-430). https://www.rand.org/pubs/research_reports/RR430.html
[7] Crumpler, W., & Lewis, J. A. (2019). The Cybersecurity Workforce Gap (1). Center for Strategic and International Studies. https://www.csis.org/analysis/cybersecurity-workforce-gap
