The Cybersecurity Professional and the Hunt for Gold

Finding that “Expert” Cybersecurity professional may no longer be a company’s dream, but rather its nightmare! Indeed, the situation could get worse.

In a study conducted by (ISC)², the “ISC2-Cybersecurity-Workforce-Study-2021”, it was estimated that there are a total of 4.19 million professionals working in cybersecurity worldwide. The study also makes a long-term recommendation, suggesting a 65% growth in these same professionals.

Brazil ranks first in terms of professional scarcity, with an estimated gap of 441,000, followed by the USA with 377,000 and Mexico with 260,000.

Real Consequence of Staff Shortage, https://www.isc2.org//-/media/ISC2/Research/2021/ISC2-Cybersecurity-Workforce-Study-2021.ashx

This gap represents a major cyber risk for companies and society as a whole. It is due to the lack of people in these roles that business systems — or those supporting critical infrastructure like hospitals and energy companies — will become even more vulnerable. The accelerated pace of technological innovation, adaptations in business systems, and new remote work models (WFH – working-from-home and working-from-anywhere) expose companies to a high potential for cyber risk.

The same (ISC)² research points out that the lack of professionals leads to real consequences, such as misconfigured systems, a lack of opportunity to assess and manage cyber risks, as well as an increase in time spent on software patch remediation, among other less representative issues.

The Global Cybersecurity Gap by Country, https://www.isc2.org//-/media/ISC2/Research/2021/ISC2-Cybersecurity-Workforce-Study-2021.ashx

“Security control provisioning” represents a 48% real need for focused personnel, followed by 47% for Analysis, Protection, and Defense. This is a gap widely exploited by attackers while they assess and execute attacks on organizations. Corporate inefficiency in vulnerability and cyber risk management extends the window of opportunity for security breaches to be exploited with more ease.

We know that companies need to meet delivery schedules — the famous “Deploy” of new systems — or even make changes/adaptations to technological environments already in production. However, it is in these moments that potential security breaches are created if there are no qualified people to provision controls.

The global need for Cybersecurity professionals may still represent a significant challenge for companies with opportunities in Brazil — a country that, compared to others, is becoming less attractive due to currency devaluation, quality of life, safety, and/or the possibilities of “work-from-home (WFH)” or “working-from-anywhere (WFA)” models.