Building new cybersecurity pipelines. NICE Conference 2017 November 8, Strengthening Cyber Workforce Development sans.

Transcription

1 Building new cybersecurity pipelines NICE Conference 2017 November 8, 2017 Strengthening Cyber Workforce Development sans.org/cybertalent

2 Cybersecurity: The Current State Skills Mismatch Emphasis on theory over practice Education focus on theoretical over applied knowledge Lack of real-world skills 95% of security incidents involve human error Threat Proliferation Outpacing ability to respond 97% of Fortune 500 companies have been hacked. The other 3% have too, they just don t know it Average annualized cost of cyber incidents for U.S. companies is $15.4 million Increasing Risk & Cost Increasing data breaches Increasing vulnerabilities Yahoo: $350 million Undervalued in the organization C-suite understanding remains weak Rarely has something been so important and so talked about with less clarity and less understanding Talent Crisis Severe shortage of skills ~300,000 open positions over 12 months Est. to grow to 1.8 million by 2022 Fast growth across all industry verticals Only 11% female

3 CyberTalent Academies

4 SANS CyberTalent Academies Develop talent ØAssess aptitude ØSelect high potential ØTrain expertise ØDeploy into the cybersecurity workforce Ø SANS is the world s largest and most trusted provider of cybersecurity training.

5 CyberTalent Aptitude Tool Aptitude Testing SANS Training & GIAC Certification Qualified Cybersecurity Professional What It Measures: Aptitude Knowledge Application Comprehension Problem Solving Skills Foundational Skills Networking Concepts Defense In Depth Internet Security Technologies Operating Systems Communications Security Why use SANS CyberTalent Aptitude? Developed to determine if an individual has the aptitude and foundational skills to succeed in information security Designed by qualified information security subject matter experts, and predicts potential success on GIAC exams Exam was developed using common measurement and testing standards to support a validity claim for the test Shows a positive correlation with success in passing GIAC certifications such as GSEC, GCIH, GCED, and GCIA "In correlation with the VetSuccess program, the SANS CyberTalent Assessment has been an excellent tool in helping us identify high-potential talent who will thrive in the cybersecurity field. Scott Sherrell ALVA Technical Team Lead

6 CyberTalent Academies Curriculum : Core courses 1. SEC401: SANS Security Essentials Boot Camp Style 2. SEC504: Hacker Techniques, Exploits & Incident Handling Third course chosen from electives, including: FOR500: Windows Forensic Analysis SEC501: Advanced Security Essentials Enterprise Defender SEC503: Intrusion Detection In-Depth SEC542: Web App Penetration Testing and Ethical Hacking SEC560: Network Penetration Testing and Ethical Hacking ICS410: ICS/SCADA Security Essentials Core Curriculum Third Elective SANS VetSuccess changed the game for me as I start a new career after the military. Initially, I was looking at entry level help desk positions as a way to break into the industry. Because of the knowledge gained through the three SANS courses, I now have an entry level position in information security. (In fact, I had a few job offers to choose from!) That's a 20k difference in salary that would have taken me a few years to achieve on my own. Holding the three GIAC certifications demonstrated to employers my solid foundation in security and ability to learn quickly. VetSuccess has indeed set me up for a successful, rewarding career in cyber. Erin McCraw, US Army (ret.), Jr. Security Analyst at SambaSafety

7 SANS VetSuccess Academies Core Curriculum Student Performance: 2015-present Ø 111 students passed; 94% pass rate Ø Highest score of 99% Ø 36% of participants scoring > 90% Ø 13 participants scoring 95% or higher Ø 85% overall average Ø 87% average for those passing Ø 96 students passed; 96% pass rate Ø Highest score of 97% Ø 17% of participants scoring > 90% Ø 4 participants scoring 95% or higher Ø 83% overall average

8 Mike Small Pen Tester Optiv My career in cybersecurity was a journey. I tried a few different careers until I realized my real passion. Mike Small was an infantryman with little experience with computers and a passion for cybersecurity when he applied for the SANS VetSuccess Immersion Academy. After leaving the Army, Mike completed his undergraduate degree in business and discovered his passion was really IT. A friend told him about the SANS VetSuccess program and he applied, not thinking he would be accepted. When he received an offer to enroll in the program, he jumped at the opportunity. Over a year later, Mike is a pen tester and loving his career in cybersecurity. He is a 2016 graduate of the VetSuccess Academy. After graduation, Mike first worked as a SOC Analyst but soon found he wanted his specialty to be in pen testing, and landed such a role at Optiv. Military Experience US Army Sergeant Security Clearance: Secret (Inactive) Education B.S., Information Technology, University of Phoenix B.S., Business Administration, Post University A.S. General Science, Horry Georgetown Technical College Cybersecurity is everchanging. Find an area that interests you and learn all you can about it. You ll never get bored. GIAC Certifications

9 Immersion Academies: New Talent in the Field US Army Cyber Protection Brigade They are both quickly becoming my top performers and I am very happy with their level of commitment, security knowledge, and technical skills. Eldon Myers, CISSP, GSEC, GCED Information Security Architect & Engineering Associate Director, TSYS

10 NTT Security: Employer Partner Story 11 SANS VetSuccess Hires We ve been thrilled with the opportunity to participate in the VetSuccess Academy. It provides a new source of talent to help fill the gap. Graduates we have hired with GIAC certifications have the skills and can apply them right away. -Arlin Halstead, Strategic HR Business Partner, US

11 Contact Scott Cassity: Web: sans.org/cybertalent