Part 6: Taking Control of the Stick

Part 6: Taking Control of the Stick

One cold — but rarely addressed — reality of Information Security is the “institutional attack vector.” Practitioners are battling against attackers from around the globe, from private individuals to state sponsored teams. They also battle against the basic insecure foundation of Internet protocols and personal computer operating systems. Add to that list poor programming techniques and the ever-dissolving edge of what they have to protect. However, there is another battle just as difficult and just as removed from their sphere of authority: the very business they are endeavoring to protect.

Information Security practitioners often face the challenge of battling the business. These battles take the form of coping with simple policies to facing complex issues like BYOD and compliancy. It’s rare for the business and the security office to be partners, because the security office is not observed at the board level.

Likewise, the security office is often not thinking at the board level, but happily isolated in the technology. In such cases the Information Security Office is not business enabling but business adverse, further isolating its participation and influence.

The question becomes, how would professionalizing this field help drive solutions?

A recently released report, "Professionalizing the Nation's Cybersecurity Workforce? Criteria for Decisionmaking," by the National Research Council (2013), concluded that cybersecurity is still too new to professionalize standards for its practitioners. The National Research Council’s arguments against professionalizing fall into three categories. In the first category, the council’s claim is that the knowledge, skills, and abilities required of the cybersecurity workforce are so dynamic that one cannot effectively establish a baseline for professionalization. Next, they claim that the knowledge and competencies required by the cybersecurity workforce are too broad and diverse to enable professionalization. Lastly, they state that at a time where demand for cybersecurity workers far exceeds supply, professionalization would create additional barriers to entry.

The questions, if observed with a historical context, might find parallel associations in other nascent times when disruptive technologies emerged. The American Medical Association (AMA) was founded in 1847 to address one of the very same issues: a lack of professionalization in the medical field. During the early nineteenth century, the major concern was a medical profession increasingly overrun with self-taught practitioners, only some of who knew what they were doing. Risk to the public was simply too great to bear, and a movement began to minimize “self-taught practitioners” and professionalize the industry.

The AMA accelerated the professionalization of medicine and the establishment of minimum standards in medical training, education and apprenticeship requirements to gain entry to the profession. The same could and should be done in the Information Security field with a similar cybersecurity national body and professional associations.

The Department of Homeland Security released a recent paper entitled, “The Path towards Cybersecurity Professionalization: Insights from Other Occupations” (2014). The paper makes a comparison of the similarities between the professions of Aviation and Cybersecurity. The aviation industry has a number of categories of pilot that include student, sport, recreational, private, commercial and airline transport. All levels require different training and licensing.

In contrast, the National Research Council in its report, “Professionalizing the Nation’s Cybersecurity Workforce? Criteria for Decision-making” (2013) stated that cybersecurity is still too new a field in which to introduce professionalization standards for its practitioners. Yet a similar break down of “pilots” for cybersecurity has already occurred from the National Initiative for Cybersecurity Careers and Studies (NICCS) with the National Cybersecurity Workforce Framework 2.0 (NCWF). The framework assembles similar types of cybersecurity work into seven broad areas of practice - securely provision, operate / maintain, protect / defend, investigate, collect / operate, analyze and oversight / development.

Francesca Spidalieri and Sean Kern, in an excellent paper titled, “Professionalizing Cybersecurity: A path to universal standards and status” from the Pell Center (2014), noted that the American Board of Medical Specialties has 24 general certificates and 125 subspecialty certificates. In terms of depth and breadth, Information Security does not appear to be any more complex than other professionalized occupations.

The National Research Council report against professionalizing went on to state that the knowledge, skills, and abilities required of the cybersecurity workforce are so dynamic that one cannot effectively establish a baseline for professionalization. A counterargument seems clear: in such dynamic times, an expectation of coalescing direction and business alignment from such chaos is highly unlikely.

Francesca Spidalieri and Sean Kern’s paper provides guidance to help professionalize the cybersecurity workforce following the traditional model of professionalization as represented by the medical profession and suggests a number of broad steps.

  1. Create a nationally recognized, regulatory body to serve as a clearinghouse for the cyber-security profession, similar to the AMA in the medical field.
  2. Establish member professional associations for each specialty.
  3. With these in place, develop a common body of knowledge (CBK) for each specialty. These bodies will then establish and maintain rigorous standards of training and education along with establishing certification/licensing requirements.
  4. To complete the training and certification an establishment of apprenticeships and residency requirements in each specialty will be developed.
  5. Finally, establish a standard code of ethics.

About the Author

Martin Zinaich is the information security officer for the City of Tampa’s Technology and Innovation department. The insights in this article were shared at a Wisegate member event, where senior IT professionals discussed these pressing security issues.

Featured

  • Integration Imagination: The Future of Connected Operations

    Security teams that collaborate cross-functionally and apply imagination and creativity to envision and design their ideal integrated ecosystem will have the biggest upside to corporate security and operational benefits. Read Now

  • Smarter Access Starts with Flexibility

    Today’s workplaces are undergoing a rapid evolution, driven by hybrid work models, emerging smart technologies, and flexible work schedules. To keep pace with growing workplace demands, buildings are becoming more dynamic – capable of adapting to how people move, work, and interact in real-time. Read Now

  • Trends Keeping an Eye on Business Decisions

    Today, AI continues to transform the way data is used to make important business decisions. AI and the cloud together are redefining how video surveillance systems are being used to simulate human intelligence by combining data analysis, prediction, and process automation with minimal human intervention. Many organizations are upgrading their surveillance systems to reap the benefits of technologies like AI and cloud applications. Read Now

  • The Future is Happening Outside the Cloud

    For years, the cloud has captivated the physical security industry. And for good reason. Remote access, elastic scalability and simplified maintenance reshaped how we think about deploying and managing systems. But as the number of cameras grows and resolutions push from HD to 4K and beyond, the cloud’s limits are becoming unavoidable. Bandwidth bottlenecks. Latency lags. Rising storage costs. These are not abstract concerns. Read Now

  • Right-Wing Activist Charlie Kirk Dies After Utah Valley University Shooting

    Charlie Kirk, a popular conservative activist and founder of Turning Point USA, died Wednesday after being shot during an on-campus event at Utah Valley University in Orem, Utah Read Now

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.