Cybersecurity Professionals: Catching Up With The Bad Guys

By the BF Staff

From the May/June 2019 Issue

The severe shortage of cybersecurity professionals around the world continues to get worse while cyber criminals get bolder and bolder. New research by (ISC)2 estimates the cyber workforce gap at nearly 3 million, with about 500,000 of those positions located in North America.

According to (ISC)2’s Cybersecurity Workforce Study, the largest portion of the shortage is in the Asia-Pacific region, which has approximately 2.14 million unfilled positions. (ISC)2 polled 1,500 cybersecurity and IT professionals around the world. Among other findings, the study found that 63 percent of the respondents report a shortage of IT staff dedicated to cybersecurity. In addition, nearly 60 percent of respondents said their companies are at moderate or extreme risk of cybersecurity attacks as a result of the shortage. Almost half of the organizations polled say they plan to hire more cybersecurity professionals in the next year.

Cybersecurity Ventures, the leading cybersecurity researcher and publisher of Cybercrime magazine, has reviewed employment figures from dozens of global sources (including the media, analysts, job boards, vendors, governments and organizations) in order to estimate the number of cybersecurity job openings over the next five years.

Cybersecurity Ventures projects there will be 3.5 million unfilled cybersecurity positions by 2021. Cybersecurity jobs forecasts have been unable to keep pace with the dramatic rise in cybercrime all over the world, which is predicted to cost the world $6 trillion annually by 2021, up from $3 trillion in 2015.

Here’s the good news: locations around the world have made developing a cyber skilled workforce their top priority.

AN EARLY START MAKES SAN ANTONIO “CYBER CITY USA”

In San Antonio, cybersecurity isn’t new or even emerging. San Antonio’s cybersecurity industry is mature and growing stronger. Alignment of education, industry and government within cybersecurity, and the ability to collaborate across these sectors, presents the city’s most significant opportunity for industry development.

What began in 1948 when the Air Force established its Security Service operations in San Antonio has grown into a national leading cybersecurity hub. Some may be surprised to learn that San Antonio has the highest concentration of cyber and intelligence professionals outside of the national capital region. Proximity to highly advanced DoD and military operations, including the Air Force Cyber Command and NSA Texas, paired with leading cyber education programs, and a competitive cost of doing business puts San Antonio in a position that other cities cannot duplicate.

“To further develop San Antonio’s cybersecurity dominance, we’re focused on talent development tailored to industry needs in the cybersecurity industry,” said Tom Long, Chief Development Officer of the San Antonio Economic Development Foundation. “It’s a strategy gaining attention and investment from cybersecurity operations large and small, as well as large corporations with significant internal cybersecurity hub operations.”

Industry plays a key role in shaping San Antonio’s cybersecurity workforce efforts, through the San Antonio Economic Development Foundation’s workforce development team SA Works. With a pipeline of cybersecurity talent from San Antonio’s K-12, up through top higher education programs and advanced military backgrounds, San Antonio is preparing for jobs employers need to fill today and in the future.

CAST Tech, the first of three industry driven high schools, works hand-in-hand with industry partners to prepare students for careers in technology and business, fields where the demand is high for talented workers. Industry partners including H-E-B, USAA, Rackspace, AT&T, Frost Bank, root9B, Tech Bloc, Whataburger, JungleDisk, Geekdom and University Health System support students’ education through experience-based learning.

In higher education, San Antonio’s six NSA Centers of Excellence specialize in cybersecurity research and education and support a sustainable cybersecurity workforce pipeline. What’s more, the University of Texas at San Antonio boasts the nation’s top ranked cybersecurity undergraduate program and recently opened its National Security Collaboration Center (NSCC). The NSCC aims to build an environment where industry, government and academia can come together to solve issues surrounding cybersecurity, while advancing research, education and workforce development from San Antonio.

Supported by the cybersecurity workforce pipeline, San Antonio’s base of cybersecurity firms has increased to over 140 and more than 40 of those are headquarters operations.

Accenture Federal Services, a wholly owned U.S. subsidiary of Accenture LLP, is a leading global professional services company, providing a broad range of services and solutions in strategy, consulting, digital, technology and operations. In San Antonio, the company employs over 1,300 at two offices and is growing its technology and cybersecurity capabilities. In 2019, Accenture has announced two significant San Antonio projects, the first adding 500 new jobs to further enhance the capabilities of its Advanced Technology center and the second establishing a federal Cyber Center, offering security as a service to federal clients.

“We are constantly innovating and evolving our business to bring advanced technologies, market-leading capabilities and the best talent to our federal clients,” said John Goodman, chief executive, Accenture Federal Services. “We have found San Antonio to be a collaborative community with skilled technology and cybersecurity talent to support the growth of our Advanced Technology Center and Federal Cyber Center.”

Accenture Federal further invests in San Antonio though providing high school and college internships and has developed an apprenticeship program at the San Antonio facilities. AFS also is an anchor industry partner for San Antonio Cyber P-TECH, a high school model which prepares students to graduate with the skills, credentials and industry-specific associate degrees for high-wage, high-demand careers in cybersecurity.

Just southwest of San Antonio’s urban core is Port San Antonio—a major platform that is growing advanced technologies in the region, including aerospace, cybersecurity, defense and manufacturing with an employment base of more than 13,000 professionals on the campus.

The Port’s development strategies include Project Tech—a set of state-of-the-art secure office facilities to support the growth of cybersecurity operations in the region and their connection with the industries they serve, including the defense, biomedical, energy, manufacturing and financial services sectors. In 2018 the Port launched the first 90,000-square-foot facility at Project Tech, which within months saw Lockheed Martin, CNF Technologies and CACI as its first occupants.

Additional planned development on the campus includes an Innovation Center where the San Antonio community, educators and technology employers can come together to strengthen San Antonio’s technology ecosystem, collaboratively develop new solutions and market them to industries around the world. The center will include an industry showroom, technology museum, maker space and technology arena and convention space—all under one roof.

“This development will be first of its kind, for San Antonio and the nation,” said Port San Antonio chief executive Jim Perschbach. “San Antonio is uniquely positioned in cybersecurity to continue building a well-established ecosystem by connecting people to opportunities, education to industry demand and buyers to industry.”

San Antonio leaders have staked their claim as Cyber City, USA.

CYBERSECURITY COMES OF AGE IN LOUISIANA

Cybersecurity breaches have harmed the world’s leading data enterprises: Equifax, eBay, Marriott, Target, Adobe, Home Depot, JPMorgan Chase, the U.S. government’s Office of Personnel Management—even Sony’s PlayStation network.

What then is a small business to do against the rising tide of cybercrime?

In July 2018, the applied research center of Louisiana State University, Stephenson Technologies Corp., secured a $10 million Department of Defense contract to strengthen the cybersecurity of small businesses that work with manufacturers in Louisiana. The thinking of the Defense Department and LSU is that critical operations of Louisiana’s $50 billion manufacturing sector are most vulnerable at their weakest link, often the small business vendor who lacks cyber resources.

“Whether we’re talking about the energy, chemical or maritime sectors, Louisiana plays a critical role in the nation’s economy,” said the state’s governor, John Bel Edwards. “What we do here has impact, and that’s why leading the country in cybersecurity is a priority. Through this major defense contract, our small businesses now have an ally in that fight, and we can provide real solutions to develop the cyber workforce of tomorrow.”

In 2017, Edwards created the Louisiana Cybersecurity Commission to bolster the state’s cyber safety and to position Louisiana as a national leader and preferred location for cyber business, education and research. A year later, he assumed co-chairmanship of the National Governors Association cybersecurity group.

In May, Gov. Edwards welcomed fellow governors and chief information security officers from nearly every state to Shreveport, LA, for the third cybersecurity summit held by the National Governors Association. NGA members and panelists wrestled with a broad array of challenges: keeping the electric grid safe; confronting cyber threats to public safety; navigating crisis communications during cyber events; the role artificial intelligence plays; supply chain impact; emergency management, the National Guard and cybersecurity; and election security.

Perhaps no topic at the 2019 National Summit on State Cybersecurity assumed more importance than a panel on preparing the next generation of cybersecurity professionals. A November 2017 report to President Trump from his Commerce and Homeland Security secretaries identified nearly 300,000 active openings for cybersecurity-related jobs that year, with projections of a global shortage of 1.8 million cyber jobs by 2022.

It’s a challenge Cyber Innovation Center President Craig Spohn and his team have tackled for more than a decade. The CIC anchors Louisiana’s 3,000-acre National Cyber Research Park, where General Dynamics operates an 800-employee Integrated Technology Center and where Louisiana Tech University and Bossier Parish Community College operate a STEM Building aimed at fast-tracking students for cybersecurity and other technology careers.

On the final day of the summit, the Cyber Innovation Center’s Spohn and Kevin Nolten conducted a tour for governors and their cyber leaders at the research park in Bossier City, Louisiana. In 2010, the CIC created the National Integrated Cyber Education Research Center, or NICERC. Its goal: to expand cyber, STEM and computer science programs to teachers and students in kindergarten through 12th-grade classes across the U.S.

“NICERC is poised to introduce millions more students across the country to the opportunities in cyber-based degrees and careers,” said Nolten, the CIC’s director of academic outreach. “The demand for a cyber-literate workforce is monumental (and) NICERC has the sustainable and systemic solution that starts in K-12 education.”

The U.S. Department of Homeland Security awarded a second five-year grant to the CIC in 2018, with an expected value of $21.5 million over the next five years. To date, the CIC has attracted over $34 million to develop classroom tools in Louisiana that have impacted over 15,000 teachers and 2.5 million elementary and secondary students in all 50 states and three U.S. territories.

By 2023, with the new Homeland Security funding, the Louisiana center expects to broaden its cyber skills preparation to 10 million students and 50,000 teachers.

“Many of the students have gone on to study cyber engineering in college, obtained workplace-ready credentials and certifications, and even were employed directly from high school,” Nolten said.

A critical piece of solving the workforce puzzle is developing partners with the combined wherewithal to meet the cyber challenge. For years, Louisiana has cracked that code by investing in cyber partnerships at college campuses that embrace the private sector.

Case in point: Louisiana Tech University, located 60 miles east of the National Cyber Research Park, created the nation’s first four-year degree in cyber engineering. Simultaneous with that advancement, the State of Louisiana invested $14 million in a 10-year higher education initiative lead by Louisiana Tech to provide a pipeline of talent for the General Dynamics Information Technology center in Bossier City.

With support from Bossier Parish Community College and Northwestern State University, Louisiana Tech helped GDIT reach full employment ahead of schedule. After being based in the Cyber Innovation Center for two years, the company operations moved into a new 100,000-square-foot Integrated Technology Center in November 2016. By mid-2018, GDIT employed 900 tech professionals in Northwest Louisiana and 1,500 statewide.

Fully 35 percent of the GDIT employees at the research park are veterans, with the universities and the company drawing from personnel exiting the military at nearby Barksdale Air Force Base and even from Fort Polk downstate. In the case of both Barksdale, home to the nation’s Global Strike Command, and Fort Polk, home to a key Army training command, the military installations provided a source of personnel with security clearances coveted by GDIT for its work in serving major federal customers. In Louisiana and globally, GDIT’s cybersecurity team secures work under more than 25 federal and state contracts.

A look at successful GDIT projects provide a glimpse into state-of-the-art cyber missions:

Registration of more than 1 million drones through an application developed for the Federal Aviation Administration.

Development of a cloud-based communications network to support 6,000 FEMA agents at 25 sites who handled record workloads for U.S. natural disasters in 2017.

Modernization of an Army National Guard database that integrated a quarter-century of work orders and maintenance budgets, with the project completed under budget and five times faster than expected.

Such missions were made possible in Louisiana when the state invested $57 million and local governments $50 million to build the Cyber Innovation Center in the early 2000s. That investment created a western point-of-presence on what is now known as Louisiana’s I-20 Cyber Corridor. About 40 miles east of Louisiana Tech’s campus is the corporate headquarters for Fortune 500 CenturyLink.

Louisiana Tech supported CenturyLink through two early corporate headquarters retention projects, and is doing so again through an agreement Gov. Edwards announced in early 2019 that will keep CenturyLink headquartered in Monroe, Louisiana, through 2025. Next door to CenturyLink, an IBM Client Innovation Center is ramping up 400 software and IT jobs; and, also in 2019, Louisiana Economic Development announced a $1.2 million investment to advance technology careers for students at Grambling State University, one of Louisiana’s Historically Black Colleges and Universities, also located on the Interstate 20 Cyber Corridor.

Grambling State will launch the state’s first four-year degree in cybersecurity while providing faculty with externships and students with internships, apprenticeships and other work-based learning opportunities at such leading Louisiana employers as CenturyLink, IBM, GDIT, Microsoft, DXC Technology and CGI.

In addition to the groundbreaking cyber engineering program, Louisiana Tech is developing a master’s degree in cyber technology, extending an emphasis that has grown the number of cyber-related undergraduates enrolled from 300 in 2012 to 800 in 2019. Since 2007, Louisiana Tech has attracted over $20 million in external cyber-related funding, including a 2018 grant of $3.5 million through the National Science Foundation’s CyberCorps program.

Higher education remains a critical pathway for Louisiana’s cyber success.

In the past decade, Louisiana has invested more than $200 million in higher education STEM initiatives that are producing over 20,000 new jobs tied to economic development projects. The scope is statewide. One of the first came with a 10-year, $5 million initiative led by the University of New Orleans, which created a software engineering apprentice program for GE Digital’s 300-job Solutions Technology Center in the Central Business District of New Orleans.

Similar initiatives linked an 800-job IBM Client Innovation Center with LSU; a 400-job CGI IT Center of Excellence with the University of Louisiana at Lafayette, with CGI announcing in 2018 that it would expand to 800 jobs; and a DXC Technology Digital Transformation Center in New Orleans that will employ 2,000. The DXC Technology project, backed by a state higher education investment of $25 million, will involve every higher education system in Louisiana.

Those partnerships have proved foundational to making the software, cybersecurity and IT industry Louisiana’s fastest-growing employment sector, but cybersecurity efforts are focused on protecting assets as well as building them.

At LSU, the Stephenson Technologies Corp. anticipates over $30 million in newly awarded contracts in 2019 that will strengthen cyber operations in defense, intelligence and law enforcement.

LSU and National Governors Association officials accompanied Gov. Edwards on an October 2018 economic development mission to Israel. There, they met with leaders of Check Point Software Technologies, a Tel Aviv-based network security vendor with 4,300 employees who protect over 100,000 global businesses and organizations from cyberattacks. In January 2019, Check Point leaders visited Baton Rouge to launch an Innovation and Integration Lab partnership.

Among other aims, the partnership will utilize LSU’s Joint Cyber Training Lab, which collaborates with the Louisiana National Guard and has led Cyber Shield training for National Guard teams from all 50 states. The Israeli partnership with LSU will pursue field testing of Check Point’s software and hardware products, and incorporate the university’s work with industry.

“Check Point’s decision to join us in building an Innovation and Integration Lab underscores the importance of these challenges, affirms STC’s deep cyber capabilities and underscores the importance of Gov. Edwards’ focus on cybersecurity and his ability to build relationships internationally,” said Jeff Moulton, president of LSU’s Stephenson Technologies Corp.

Buoyed by Louisiana’s emergence as a cyber leader, Twistlock announced the 2018 opening of a Global Engineering Solutions Center at LSU Innovation Park. A leader in cloud-based cybersecurity, Twistlock protects 35 percent of Fortune 100 companies.

“We selected Baton Rouge and Louisiana for our engineering center because of the state’s growing cybersecurity industry base, the business-friendly climate and the opportunity to develop a talent pipeline with a major research university in LSU,” Twistlock CEO Ben Bernstein said. “We help protect some of the most sophisticated cloud environments at many of the world’s largest companies and governments.

Like Check Point, Twistlock has significant operations in Israel, a nation with $6.5 billion in annual cybersecurity exports.

“One of the most compelling parts of our economic development mission to Israel is the extraordinary growth of cybersecurity applications in both of our economies,” said Louisiana Economic Development Secretary Don Pierson. “At LED, we excel at connecting overseas investors with foreign investment opportunities in Louisiana, and at identifying international export and business development opportunities for Louisiana firms. Our trip would have been worthwhile for that potential in cybersecurity alone.”

GROWING CYBERSECURITY FROM THE GROUND UP IN SIERRA VISTA, AZ

With a successful STEM program that feeds into higher education, visionary developers and a long-standing partnership with one of the U.S. Army’s critical, tech-heavy installations, Sierra Vista is a hive of cybersecurity activity. A visit to this mid-sized southeast Arizona community is marked with stunning scenery and easily accessed outdoor activities, but the technology engines that drives Sierra Vista are leading the nation.

Not only has Sierra Vista been able to attract top cybersecurity firms, it has also implemented a sustainable STEM education system, designed to integrate the city’s youth in STEM and cybersecurity education, ultimately establishing Sierra Vista as a strong base for today’s and tomorrow’s cybersecurity talent.

The most prominent example of its dedication to education is at Sierra Vista’s Buena High School. The school partners with CyberPatriot, a program created by the Air Force Association (AFA) to inspire students to pursue careers in cybersecurity and other STEM disciplines. In fact, Buena High School gained national attention in 2010 when participants finished second in the CyberPatriot annual network defense competition. In 2019, Buena High School’s Nifty Engineering Robotics Design Squad qualified to attend the FIRST Championship in Houston Texas, earning a place as finalists in the Championship Subdivision, again demonstrating the STEM proficiency in local schools.

However, Sierra Vista’s focus on cybersecurity doesn’t stop with secondary education. University of Arizona Sierra Vista boasts one of the nation’s top Cyber Operations programs. The National Security Agency designated U of A’s Cyber Operations program as a Center of Academic Excellence in Cyber Operations—a designation shared by only 20 cyber programs in the nation.

Unique to the U of A Sierra Vista program is its approach to cyber security, encompassing defensive as well as offensive positions. The program takes a 360-degree, hands-on approach through a forensics lab; a malware sandbox; an Internet of Things lab; and Cyberapolis, a virtual city with a 3D GUI with network attack map, 15,000 virtual residents (each with unique personas), an underground hacker community, an organized crime element, entity and data relational linkages, and activity patterns. Cyberapolis is an ever-evolving community—just like real life—thanks to U of A’s Director of Cyber Operations Jason Denno, who built an artificial intelligence that generates social media posts for Cyberapolis residents, thus continuously increasing the complexity of the lab.

Also in Sierra Vista, Cochise College has been teaching information security and cybersecurity for over a decade. Cochise works closely with U of A Sierra Vista and will host one of its Internet of Things labs. Cochise also primes young minds for the industry with their annual cyber summer camps, training students in cybersecurity and the importance of ethical hacking.

Finally, at the top of Sierra Vista’s cybersecurity industry stands Fort Huachuca. As the headquarters of the Network Enterprise Technology Command (NETCOM), the fort is the key to maintaining and protecting the Army’s global portion of the DoD Information Network. Fort Huachuca also houses the Army’s Information Systems Engineering Command (ISEC) to engineer, install and test networks around the world. The advanced workforce also includes the Joint Interoperability Test Command (JITC), ensuring joint warfighter IT capabilities support mission requirements through global net-centric testing. It also hosts the U.S. Army Intelligence Center of Excellence to teach the doctrine, procedures and skills for intelligence support to cyber operations in the Army and Department of Defense.

Not only does Fort Huachuca help to install, test and protect the country’s network, it also helps boost local businesses. The fort hosts live testing environments accessing the 2,500-square mile Buffalo Soldier Electronic Testing Range across Southern Arizona. Huachuca also contracts with many key defense companies, including Northrop Grumman and Jacobs. These and other tech companies set up shop in Sierra Vista to provide services that support this mission.

In its dedication to STEM education, Sierra Vista has created a solid base to bolster its cybersecurity industry. By raising the next generation of cyber professionals, the city has established itself as a cybersecurity hub for the present and future.