Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/26/2019
08:00 AM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Your Employees Want to Learn. How Should You Teach Them?

Security practitioners are most likely to stay at organizations that offer career development. Here are eight tips to consider as you plan your course of action.
Previous
1 of 9
Next

(Image: Anzebizjan - stock.adobe.com)

(Image: Anzebizjan stock.adobe.com)

Cybersecurity is an industry of constant change. Organizations most prepared to face new and emerging threats are the same ones investing in the education of people who keep them safe.

It's no secret: Businesses large and small struggle to find skilled security talent. The challenge doesn't end when they land a good fit – it's notoriously difficult to keep security professionals. Opportunity abounds. On average, infosec employees receive 1.5 recruiter messages per week, according to a survey by Cybrary of more than 3,100 IT, security, and other professionals. 

"Everybody's fighting for the same people," says Cybrary co-founder and CEO Ryan Corey. The company's research shows it takes an average of 12 months to get a security pro up to speed in a new role, he adds, but the average tenure for experts in the space is only 18 months.  

If you want to beat the odds and keep your security team, invest in their career development. People in this industry want to learn and progress, Corey continues. Most of them are self-taught, taking courses at night or on the weekends. If their current organizations don't offer them the opportunity to move forward professionally, they'll move on to one that does.

"Over almost any other benefit – nobody asks about stock options or 5% bonuses – training is the first thing that comes out of people's mouths," says Robert Lee, SANS security fellow and curriculum lead for SANS DFIR, of the modern job interview process.

Here, Corey and Lee dive into the trends and challenges surrounding continuing education for cybersecurity pros. What do team members want to learn, and how do they want to learn it? Should you be sending them to conferences or trainings? And what if you educate them – only to lose them to another company? Read on to find out.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 9
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "SpearPhish! Everyone out of the office!"
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10100
PUBLISHED: 2019-07-17
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.
CVE-2019-12175
PUBLISHED: 2019-07-17
In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser leads to DoS because a case-type index is mishandled.
CVE-2019-12475
PUBLISHED: 2019-07-17
In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
CVE-2019-13346
PUBLISHED: 2019-07-17
In MyT 1.5.1, the User[username] parameter has XSS.
CVE-2019-13403
PUBLISHED: 2019-07-17
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.