The cyber security skills gap is real and growing; there simply aren’t enough cyber security employees to go around.

Cyber crime is rapidly escalating, and board rooms are taking notice. KPMG’s 2017 U.S. CEO Outlook survey shows cyber security risk to be among CEOs’ top concerns, yet only 40% of them feel that their organizations are fully prepared to handle a cyber attack. This isn’t surprising in light of the very serious – and worsening – cyber security skills gap. The cyber security unemployment rate was zero in 2016, and it’s expected to remain there until 2021. Coincidentally, that’s the same year by which Cybersecurity Ventures predicts there will be 3.5 million unfilled cyber security jobs.

Small and medium-sized firms are being hit the hardest by the cyber security skills gap, as the short supply of qualified talent is quickly snapped up by multinational firms that can afford to pay the high salaries and provide the “Cadillac” benefits and perks that this talent has the power to demand. The situation is expected to worsen in light of New York’s new cyber security law, which requires finance and insurance firms operating within the state to hire CISOs and “qualified cyber security personnel.”

Governments and private-sector organizations are wringing their hands over how to deal with the problem. The mayor of New York City has announced a plan to invest $30 million in in cybersecurity training, academic research, and development labs, with the goal of creating 10,000 new cyber security jobs over the next decade. IBM has launched what it’s calling a “new collar” jobs initiative to train both students and older workers in cyber security.

Outsourcing the Best Way to Immediately Bridge the Cyber Security Skills Gap

In light of the cyber security skills gap, the best option for most organizations is to outsource their cyber security functions to a reputable cyber security provider such as Lazarus Alliance. Our Cybervisors® service allows organizations of all sizes to immediately retain the services of the best and brightest subject matter experts in cyberspace law, cyber security, risk assessments and management, audit and compliance, governance and policies, and more.

In addition to getting the help you need right away, there are many other benefits to outsourcing your enterprise’s cyber security functions, including:

• Significant cost savings. It is almost always less expensive to outsource cyber security than to hire and maintain a security team full-time in-house. Even outsourcing just part of your cyber security functions, such as compliance, could result in significant savings.
• Allows you to focus on your business’ core competency. Most likely, you don’t hire in-house staff to handle your own legal matters or do your own taxes. You realize that law and accounting are not part of your core competency, so you outsource those functions to attorneys and accountants. (Along the same lines, you probably outsource your building security to a security firm!) Using this logic, why would your firm handle its own cyber security? Outsourcing this function to a professional frees up monetary and human resources that can be used to create, innovate, and drive your business.
• Allows you to access a level of expertise most companies don’t have internally. Cyber security is a highly specialized field, and the skill set it requires is quite different than those in other IT areas. It’s also highly dynamic, with new technologies and threat vectors emerging daily. Our Cybervisors® focus on only one thing: cyber security. They are highly experienced in this field, they are immersed in it, and they engage in continuous education to stay abreast of the cyber threat landscape.

Initiatives like the ones New York City and IBM have launched are positive steps in the direction of bridging the cyber security skills gap, but training new cyber security professionals takes time, and organizations need help right now. Your organization can’t wait 10 years, or even six months, to get the security help it needs, at a price it can actually afford. The cyber security skills gap is here for the long-haul, and outsourcing is the best way to handle the problem right now.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

What will the state of cyber security look like under the Donald Trump administration?

The election is over, the votes have been counted, and thankfully, other than a few isolated reports of malfunctioning voting machines, Election Night was unremarkable from a cyber security perspective. Now, it’s time to turn our attention to President Elect Donald Trump and what a Trump Administration will mean for cyber security in the U.S.

Donald Trump’s Official Stance on Cyber Security

Cyber security is the only tech-related topic Trump addresses directly on his official website. At this point, his plan has four main points:

• Appoint a “Cyber Review Team” composed of “individuals from the military, law enforcement, and the private sector” to perform “an immediate review of all U.S. cyber defenses and vulnerabilities, including critical infrastructure” and “provide specific recommendations for safeguarding different entities with the best defense technologies tailored to the likely threats.” The Cyber Review Team will also be tasked with establishing protocols and setting up “mandatory cyber awareness training” for government employees.
• “Instruct the U.S. Department of Justice to create Joint Task Forces throughout the U.S. to coordinate Federal, State, and local law enforcement responses to cyber threats.”
• “Order the Secretary of Defense and Chairman of the Joint Chiefs of Staff to provide recommendations for enhancing U.S. Cyber Command, with a focus on both offense and defense in the cyber domain.”
• “Develop the offensive cyber capabilities we need to deter attacks by both state and non-state actors and, if necessary, to respond appropriately.”

Much like HIPAA, Trump’s plan focuses on procedural generalities as opposed to technical specifics. However, this is to be expected of a presidential candidate who comes from a business background, not a tech background. The positive thing about the plan is its focus on taking proactive measures to prevent attacks, not just responding to them after they occur.

What to watch out for: Who Trump appoints to his Cyber Review Team. President Elect Trump should seek out experienced cyber security professionals with deep knowledge of the industry and the issues to hammer out the technical details of his plan.

The End of the H-1B Visa?

As a candidate, Trump famously took a hardline stance on immigration, including an initial pledge to eliminate the H-1B visa program that is heavily used by the tech industry. This has alarmed many tech employers, who claim that the H-1B is necessary because there is a shortage of qualified IT workers in the U.S., and that without being able to import talent from overseas, critical positions would go unfilled. This is an important issue in the cyber security field, which faces a severe skills shortage; there are approximately 200,000 unfilled cyber security jobs in the U.S., and demand is expected to increase by 53% by 2018.

However, it is important to note that Trump softened his stance on the H-1B at a Republican debate in March, claiming, “I’m changing. I’m changing. We need highly skilled people in this country.” Additionally, since his election, he has backed off from his initial zero-tolerance immigration stance overall.

What to watch out for: Whether Trump will abolish the H-1B is debatable. As a businessman, he used it to hire foreign workers, and his wife, soon-to-be-First-Lady Melania Trump, came to America on an H-1B. However, it is likely that Trump will make some changes to the H-1B program, and it is up to cyber security companies to ensure that our voices are heard as he makes decisions on this issue.

Cyber Security as Part of National Security

Throughout his campaign, Donald Trump referred to cyber security in the context of national security. At a debate against Hillary Clinton in September, he spoke of the gravity of the threat of foreign cyber terrorism against the U.S.:

…when you look at what ISIS is doing with the Internet, they’re beating us at our own game. ISIS.

So we have to get very, very tough on cyber and cyber warfare. It is — it is a huge problem. I have a son. He’s 10 years old. He has computers. He is so good with these computers, it’s unbelievable. The security aspect of cyber is very, very tough. And maybe it’s hardly doable.

But I will say, we are not doing the job we should be doing. But that’s true throughout our whole governmental society. We have so many things that we have to do better, Lester, and certainly cyber is one of them.

What to watch out for: It is possible that a Trump Administration will increase spending on cyber security at the federal level and impose more stringent requirements on state and local governments. Since the number and severity of data breaches and ransomware attacks are intensifying, these would be welcome changes.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. We offer full-service risk assessment services and Continuum GRC software to protect companies from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization secure your systems.

Cyber security is key to a sustainable, future-proof digital transformation

The rise of ecommerce, particularly mobile ecommerce, has fundamentally altered both consumer and business buying habits. Organizations are embracing digital transformation in an effort to appease modern buyers and enhance the customer experience while cutting costs and improving efficiency. The 2018 State of Digital Business Transformation survey by IDG found that 89% of organizations have either adopted or plan to adopt a digital-first strategy.

While cutting-edge technologies such as the IoT and IIoT, cloud computing and multi-cloud networks, and low-code platforms provide great benefits to organizations and their customers, they also gift cyber criminals a much larger attack surface. Today’s hackers are more skilled, educated, and well-funded than ever, and the attacks they launch are highly organized, complex and, if successful, destructive. In a survey of IT business leaders by Frost & Sullivan, respondents listed cyber security as their top challenge to navigating digital transformation.

Despite these concerns, too many organizations still view cyber security as an afterthought at best, a stumbling block to innovation at worst. Security can get pushed to the wayside in the rush to implement the day’s newest, shiniest technologies. However, digital transformation isn’t supposed to focus on what’s hip and trendy now; the goal is to ensure that your organization is prepared not just for today’s trends but tomorrow’s opportunities through implementing sustainable, future-proof solutions, and cyber security plays a critical role in this process. Here are a few best practices for integrating cyber security into your digital transformation plans.

Integrate Cyber Security from the Beginning

Digital transformation involves implementing new technology and finding new uses for existing technology. However, application security is often addressed very late in the software development lifecycle (SDLC). Three-quarters of security and IT professionals surveyed by Dimensional Research felt that security was addressed “too late in the [development] process, and [applications] must be retrofitted after key decisions have been made.”

Attempting to secure an application late in the SDLC makes the entire process more complex, resulting in delays, budget overruns, or possibly even a failed project. Cyber security should be baked into the SDLC of every digital transformation initiative from the beginning so that potential risks can be identified and addressed early on, and applications can be patched as new cyber threats emerge post-deployment.

Involve Your Security Team in All Important Decisions

Often, cyber security personnel are not included in marketing or business meetings, even though critical decisions are made that impact the technical aspects of the digital transformation initiative. Worse, the security team may not be included in IT meetings or involved in the project at all; only 18% of respondents to the Dimensional Research study reported cyber security personnel being involved in all digital transformation initiatives.

If security personnel are not present to provide input at critical junctures of the project, the end result could be an application that is riddled with security holes. Instead of having security experts swoop in only after an attack has occurred, organizations should take a proactive approach, involve their security teams in all project meetings and decisions, and prevent attacks from happening in the first place.

Don’t Forget the Human Factor

The weakest link in any organization’s cyber security is its own people. Often, organizations lean too heavily on technology to defend against cyber attacks, train only their IT staff on cyber security best practices, or both. Every employee who touches a computer must be trained on cyber security best practices, and the organization must adopt a security-first culture on all levels, from the C-suite down to the reception desk. The human factor is also another reason to involve security at all junctures of a digital transformation initiative; one aspect of secure development is to design applications in such a way as to limit the ability of human error or malicious acts to open up the system to cyber attacks.

Integrating proactive cyber security into digital transformation efforts from the very beginning and creating a security-first culture on all levels of the organization doesn’t just protect against hacks; it also ensures that digital transformation efforts are sustainable and future-proof.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.