We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Which IT security skills are most important?

I often hear from IT executives that it is hard to recruit and retain "good security people". Many lament the shortage of skills in this area and cannot reconcile the skills offered with the positions that need to be filled. Is there really a shortage of good security people? Or just a mismatch in the skills and the jobs?

Looking at security from an operational perspective and a risk-management perspective, there are two types of security skills that might be needed in a company: tactical security operations and strategic risk management. Unfortunately, many companies don't do a good job of separating the two and end up asking people to do both. The two skill sets are rarely found in one person. Worse, asking someone with a strategic risk mind-set to do operational security, or vice versa, often leads to job dissatisfaction and eventually resignation.

Operational security requires attention to details, a methodical and meticulous work ethic, and an ability to process large amounts of information. In a network or security operations center (NOC/SOC), operators are presented enormous amounts of data and need to be able to quickly discover the root cause of any alarm or event, and make efficient and effective decisions reactively. Contrast that type of work with the strategic risk-management work. A security professional who is responsible for managing risk will have to think strategically; look at the big picture; present difficult choices to a management team; and balance conflicting requirements, conflicting turfs and priorities while advancing the interests of the whole company.

The personalities required for these jobs are radically different, yet people are still surprised when someone quits after trying and failing to fulfill both jobs at the same time. Not only is this difference in roles important for hiring and retention, it is also important to keep in mind when deciding on a managed security service. When deciding to outsource part of security, companies are increasingly doing so primarily because of a lack of skills rather than to reduce cost.

Before outsourcing security functions you have to consider what type of people you currently have and how you can best use them? If you excel at operations, then outsourcing the SOC might be a bad idea. If you excel at risk management and want to 'free' your security experts from the operational role they grudgingly fill, outsourcing could give you a way to refocus and re-energize your internal team.

There might be a shortage of security skills, but I think there's a much bigger problem of mismatched skills and jobs. Understanding the strengths of your current team will allow you to apply their skills better, but also make them happier and less likely to leave.

IDG UK Sites

Android M Developer Preview announced at Google I/O: Android M UK release date and new features. Wh?......

IDG UK Sites

Why I think the Apple Watch sucks and you'd be mad to buy it

IDG UK Sites

Ben & Holly's Game of Thrones titles spoof is delightfully silly

IDG UK Sites

Mac OS X 10.11 release date rumours: all the new features expected in Yosemite successor