The Most In-Demand Cybersecurity Skills to Learn in 2021
It's an unfortunate reality most organizations are faced with on a daily basis—cybercrime is at an all-time high due to malicious actors looking to capitalize on the pandemic, whether it be exploiting weaknesses in healthcare IT or gaining access into the enterprise via work-from-home employees.
While mitigation tools are getting more advanced, new threats like machine learning (ML)-assisted phishing exploits and polymorphic malware put cybercriminals one step ahead of the game.
An estimated 3.5 million global cybersecurity jobs will be available but unfilled this year, making cybersecurity one of the fastest-growing industries. Newly minted graduates with an interest in cybersecurity are looking at a job market with a 0% unemployment rate and a myriad of options for all majors and backgrounds.
Cybersecurity is both technical and interdisciplinary. Above all else, the most valuable attributes for a candidate to possess are analytical skills and the ability to acquire technical knowledge quickly.
Vendors may assist professionals and learners in updating their cybersecurity skill sets. For example, Microsoft's Cybersecurity Awareness Kit, exclusively designed for remote workers, delivers end-user security awareness and training. Similarly, Fortinet's Training Advancement Agenda (TAA) offers cybersecurity training and career opportunities for individuals and employers alike.
Criminal startup teams offering ransomware-as-a-service (RaaS) now exist on every continent to facilitate the needs of local criminal syndicates and state actors. Payment is typically made in a cryptocurrency such as Bitcoin to provide the requisite anonymity. More often, services such as malware development and the creation of distributed denial-of-service (DDoS) campaigns are also offered in conjunction.
Unfortunately, ransom payment these days is no guarantee of data recovery, as in many cases the user's data is irrevocably encrypted.
Though still in its infancy, current ML-based exploitation methods include the automated orchestration of botnets and profiling of outdated systems and their inherent vulnerabilities. Since ML frameworks and the required IT infrastructure, such as servers, graphic processing units (GPUs), and storage, can also be leased on a utility basis, attacks can be carried out on virtually any scale, at any target.
Last year, popular brands such as Marriott International, Twitter, and Software AG fell victim to cyberattacks. This year, CNA Financial—one of the biggest cyber insurance firms in the US—succumbed to a ransomware attack that cost the company $40 million. Clearly, anyone can and will end up in the crosshairs of cyberattacks, even those in the business of preventing these incidents from occurring.
Microsoft's terrifying announcement that it had detected multiple zero-day exploits being used against its flagship email server solution sent waves of panic across the enterprise. With 78% of the on-premises email server market share, Microsoft Exchange Server and its newly discovered flaws left upwards of 30,000 US organizations in the hands of Chinese cyberattackers.
Colonial Pipeline, JBS Meat Processing, and a Florida water treatment facility all fell victim to cyberattacks this year. These are just the latest in a series of increasing cyber incidents involving operational technology (OT) environments—that is, environments with physical processes and industrial control systems, on top of standard IT environments.
Ultimately, cyberattacks on OT have the potential to impact public safety (e.g., compromised food/water quality, energy grids).
In partnership with CompTIA, Burning Glass—through their Cyberseek.org website—offers some insights regarding overall cybersecurity job demand by region and title. Based on their research, the following are the top cybersecurity skills and disciplines projected to grow the fastest over the next five years in terms of job growth.
ADVERTISEMENT
ADVERTISEMENT
Software-as-a-service (SaaS) apps are the primary way for businesses and consumers to consume software these days. Because they are "always on" and available, they must maintain a continuously strong security posture. This means lengthy battle testing and baking in industrial-strength security during development. Software engineers skilled in this regard are therefore in high demand.
In fact, application development security is the most desired cybersecurity skill for this year, with demand expected to increase by 164% over the next five years.
As enterprises continue migrating their on-premises IT infrastructures to the cloud, even more firms—typically startups—are launching as "born in the cloud" companies. In either case, cloud security requires a unique set of skills for managing virtual infrastructures. For example, numerous data breaches involving exposed AWS S3 buckets could have been avoided through consultation with a competent cloud security architect.
Because of its impact on the entire organization, cybersecurity these days is no longer just an IT function; it's an integral part of the enterprise's broader risk management strategy. To this end, cybersecurity risk analysts are often hired to work hand in hand with the CFO to quantify cyber risk into business risk.
Threat intelligence analysts augment network/IT environment monitoring with third-party threat intelligence feeds, open-source intelligence (OSINT) resources such as data dumps, the dark web, and other alternative channels for threat intelligence. These efforts help the organization better position itself against future attacks by proactively monitoring threats in the wild.
Regarding cyberattacks, cybersecurity professionals will often say it's not a matter of if, but when. Organizations must therefore plan the proper actions to take when a cyber incident does occur. Incident response is typically automated or orchestrated using tools such as security orchestration and response (SOAR) platforms as well as homegrown tools. Security analysts with experience using SOAR can command a premium for their skills.
Organizations doing business in regulated industries may have specific cyber guidelines and compliance validation requirements to meet. Even for more general business practices, expansive compliance regulations such as the General Data Protection Regulation (GDPR) require strong cyber skills. Cybersecurity professionals with knowledge of compliance and controls are highly sought after to guide organizations through the cyber compliance landmine.
In short, there has never been a better time to protect the world's digital economies from cybercriminals and prevent service disruptions and safety issues from harming consumers and businesses alike. The demand for cybersecurity professionals is expected to skyrocket over the coming years, with both government and public organizations fighting for the best talent. When it comes to cybersecurity training, however, a myriad of specializations are possible, as the field has grown both in terms of sophistication and breadth—as well as demand.
.png)
The WorkFlow podcast is hosted by Steve Glaveski with a mission to help you unlock your potential to do more great work in far less time, whether you're working as part of a team or flying solo, and to set you up for a richer life.
To help you avoid stepping into these all too common pitfalls, we’ve reflected on our five years as an organization working on corporate innovation programs across the globe, and have prepared 100 DOs and DON’Ts.
ADVERTISEMENT
ADVERTISEMENT
