Optimism About Cyber Workforce Advancements

The threats from adversaries far and wide digitally attacking our networks, technologies and critical infrastructure will only increase, and a robust, highly-skilled cybersecurity workforce is necessary to protect our country. Officials understand this, and seeing a huge number of unfilled cyber positions in the military, government and private sector, they have sprung into action over the last several years.

The cyber workforce plays a key role in national and global security and are the key to countering evolving cyber threats and maintaining readiness, said Mark Gorak, principal director of resources and analysis in the U.S. Department of Defense (DoD’s) Chief Information Office. 
Workforce gaps in cyber, information technology and networking still exist in large numbers, but there are positive inroads. The DoD is making advancements in recruiting, developing and retaining the best cyber talent through the implementation of several programs, Gorak confirmed.

At AFCEA’s TechNet TransAtlantic conference in Frankfurt, Germany, on December 4, Gorak moderated a panel with Lee Rossey, co-founder and chief technology officer, SimSpace; Matt Isnor, cyber workforce development program manager, DoD Chief Information Office; and Jeff Worthington, executive strategist at CrowdStrike.

Rossey added that it has been great to see how some U.S. universities and community colleges are putting a lot more emphasis on cybersecurity, which will aid the workforce. 

“We were all recently down at the University of Texas-San Antonio, and they had 2,200 cybersecurity students going through, and not computer science students,” Rossey said. “They were cybersecurity students. We are starting to see this in Texas and in states all across the board. So yes, there is a shortage, but I'm also positive, optimistic, that, at the developmental level, a lot more people are being built up to start coming into the workforce.”

Gorak advised a shift in attitudes away from perpetuating “don’t steal my people” fears and toward a more holistic appreciation of cyber talent wherever it is in the United States.

“It is not a competition between industry and government and academia and allies and partners,” he emphasized. “It's a partnership. We have to look at it as a partnership. DoD turns over 10,000 cyber professionals a year. That's not a bad thing. That is helping the nation in its cyber talent shortage. It is. So, we have to kind of look at it that way.”

For Isnor, the key is to create the tools and resources for people to be successful in their cyber jobs. His early work at the U.S. Cyber Command helped influence how to build out similar mission training resources for the cyber workforce. Isnor noted, however, that these tools need to cover more than just cybersecurity but also information technology, communications and other networking skills.
 
“Range environments are so crucial to the actual development of our workforce,” he stated. “We learned that at Cyber Command, getting hands-on the keyboard, getting in various sandboxes and working in those skill sets really gives folks the developmental phases. It's extremely important.”

The department is also beginning to qualify the cyber workforce’s skill sets, so ranges provide the platform for that development. “Ranges are huge for what we're doing,” Isnor offered. The DoD is also working with about 450 universities to help inform them of the cyber workforce that will be needed in the next five to 10 years, which is helping the schools prepare their programs of study.

Confirming that cyber ranges are crucial, Rossey explained that SimSpace grew out of the Massachusetts Institute of Technology’s Lincoln Laboratories from its effort to create cyber ranges for U.S. Cyber Command and the Defense Advanced Research Projects Agency. At the time, they had to figure out, for the 6,000 operators of the command, a dedicated environment in which to build offensive, defensive and operational training, both on an individual level and as a team.

“Now, we work with the U.S. military, cyber command, as well as very large enterprises, such as banks, universities, other financial companies, to help build up their talent,” Rossey stated. “The question becomes, how do you develop the skills at the individual and team level to operate.”

This work is extending to NATO nations to raise the collective cyber defenses of each country and the alliance, Rossey noted. 

“We recently started working with countries like Slovenia, Croatia, Albania and North Macedonia to provide a dedicated cyber range so that they can build up their own skills in each country and start doing some nice joint exercises with U.S. National Guard units,” he shared. “It has been wonderful to see U.S. members side by side with our allies, learning and building up cyber talent.”

Rossey added that cyber skill development needs to also include how to fight in modern cloud-based networks that have new security tools. “Do the cyber operators know how to use them and have the ranges evolve to meet them?” he asked.

To find their cyber workforce, CrowdStrike pulls in people from various backgrounds or locations. They pull in people who have left the workforce, as well as veterans. “CrowdStrike started as a remote-first company, and that really allowed us to hire from talent across the globe,” he said. “Certainly, we aren’t beholden to one city or region. And we actively recruit those that have taken a break from working for whatever reason, with a return-to-work program. We also have an extensive veterans program.”

Worthington also advised companies to consider Guard and Reserve cyber warfighters. Companies are not doing as good a job at hiring such experts. “They can be a rock in your storm,” he said. CrowdStrike has worked to change the language of their job descriptions to be more inclusive and attract a greater pool of the population, including female candidates.

Lastly, Gorak emphasized that it is indeed people who are most important to cybersecurity.

“The cyber fight is not just about tools, systems or strategies,” he advised. “It is about people. Their creativity, expertise and dedication must give us the edge we need to confront and overcome cyber threats.”

TechNet Transatlantic is organized by AFCEA International in conjunction with the AFCEA Europe office. SIGNAL Media is the official media of AFCEA International.