Image

This is the second blog in a three-part series that analyzes the gaps in many vulnerability management programs. Focusing on the core elements or “stool legs” of technology, people and process, this second blog post examines the role of people. Catch up on the series by reading the first blog on the technology leg.

People: Bridging the Human Gap

Although technology may seem like the most important leg of the stool in the cybersecurity field, the tools are nothing without the right people to leverage them in the most optimal way for a particular organization. By focusing on the key issues of overcoming the cybersecurity skills gap and investing in continuous training programs, organizations can better ensure that employees are equipped to quickly and effectively respond to new threats.

The human element in vulnerability management is indispensable, yet the industry grapples with a significant shortage of skilled cybersecurity professionals. Addressing this skills gap requires a commitment to continuous training programs for existing staff, ensuring a proactive and adaptive cybersecurity workforce.

Skills and Talent Shortages

To help overcome the cybersecurity skills gap is to bring in entry-level workers and genuinely set them up with success. Start with foundational concepts like networking, operating systems and basic security principles. Online platforms, courses and certifications like CompTIA Security+ can provide a solid grounding. Encourage hands-on experience through labs, virtual environments or internships. Platforms like Cybrary and Udemy offer diverse and self-paced courses, many of which are free.

Organizations often have a CISSP certification requirement, even for lower cybersecurity positions. How do we go beyond the CISSP filter? I recommend emphasizing practical experience and relevant certifications over a CISSP. Showcase hands-on skills and specific achievements in previous roles. Organizations should focus on soft skills, communication abilities and a collaborative mindset. A CISSP certification is valuable, but organizations must also seek professionals who can effectively communicate and work within a team. Assess problem-solving skills, critical thinking and a passion for cybersecurity during interviews or through practical assessments.

Continuous training programs covering the latest cybersecurity trends and mitigation strategies are essential. Collaborating with educational institutions and industries creates a pipeline for future cybersecurity professionals. When it comes to continuous training programs aimed at enhancing vulnerability management skills, it is beneficial to cover a range of subjects to ensure a comprehensive understanding of the field. Here are specific training subjects and learning objectives that can be particularly helpful:

Communication Breakdowns: Unifying IT and Security Teams

Effective vulnerability management hinges on the collaborative efforts of IT and security teams. Communication breakdowns between these two groups can lead to delayed response times, misaligned priorities and increased security risks. To foster better communication, initiate cross-functional training programs where members from IT and security teams can learn about each other's roles, responsibilities and challenges. The vulnerability management team should schedule regular meetings between IT and security teams to discuss ongoing projects, challenges and upcoming remediation SLAs. Finally, encourage temporary swaps between IT and security teams where team members work in the other department for a designated period. Defining well-defined communication channels to ensure rapid response times during security incidents further promotes a culture of shared responsibility.

Real-World Scenario

Like in my previous blog, we encountered a client who experienced communication issues between the IT infrastructure and the security teams. These teams faced challenges in remediating identified vulnerabilities. I’d like to explain further how these communication concerns posed key risks.

On the one hand, the vulnerability management team was proficient in the day-to-day operations and identifying new and existing vulnerabilities within the organization. However, when they communicated remediation efforts to the teams responsible for patching and remediating the vulnerabilities, a breakdown occurred. Despite the client having well-established policies and standards, they received resistance from the operational teams. In these cases, the perceived risk of bringing down a system outweighed the actual risk of a security incident.

This issue is a testament to the broader challenge where leadership often perceives vulnerability management as a checkbox rather than a fundamental aspect that protects the company’s reputation and future existence. Addressing the communication breakdown requires an approach aimed at fostering collaboration, understanding and a shared commitment to cybersecurity. Fostering transparent, open communication between the teams is imperative. At a minimum, weekly stakeholder and IT security meetings should be held to assess the vulnerabilities and the risks to the affected systems. Communicating awareness and the need for security ensures that everyone understands the importance of timely remediation and the potential risks associated with leaving them vulnerable. Finally, clearly communicating the actual risks associated with security incidents vs. the perceived risks of remediation efforts can provide a more balanced perspective.

In our next blog post, we will delve into the process challenges within vulnerability management and propose strategies to fortify the three-legged stool.