The U.S. would need to create 359,236 more cybersecurity professionals to have enough talent available for it to be possible to secure all organizations’ critical assets, according to (ISC)2’s April-June 2020 Cybersecurity Workforce Study.
NCSF’s initiative now homes in on the slice of cybersecurity professionals who can respond in real-time to military-level cyber attacks — a particularly scarce kind of talent in an already high-demand field, said Alan Paller, national director of this “25 x 25 challenge” project, in a recent Government Technology interview.
Paller also serves as president of the Cyber Talent Institute, a nonprofit “research and action” organization that NCSF recently launched to support cyber talent development efforts, and president of regionally accredited cybersecurity training school SANS Technology Institute, which offers scholarships to those who advance far in NCSF’s cyber training game and perform highly in an ensuing competition.
GAME-BASED RECRUITMENT
Expanding the ranks of rising cybersecurity professionals means finding ways to reach beyond those who already know they like cybersecurity to draw in others who may have never considered or never been exposed to the field, but who could discover a knack and passion for the work, Paller said.
“One of the great challenges in state and local government is recruiting in the cybersecurity field because the hunger for people who are talented is enormous,” he told GT. “There are a lot more kids who’re good at puzzles and games than there are who are going into computer science — the chances of finding a much larger pipeline of cyber talent down this path is pretty high.”
A game-based approach is intended to throw the doors open to this larger crowd, by offering a low-pressure, fun way for newcomers to explore ciphers, hacking and other areas of cybersecurity, without the pressure or commitment of formally enrolling in a class.
Players without any experience can learn during the game through training resources and hands-on experience working through the puzzles and challenges. Difficulty ramps up gradually as users progress.
Participants who progress through enough of the game's challenges within a set six-month time frame are invited to a cybersecurity competition, with top-performers winning scholarships for cybersecurity training.
Achieving a crop of 25,000 top-tier specialists will require getting 2 million people to try the game, Paller said. Such a large pool is important, given that not all players will finish or attain high levels of expertise.
INCLUSIVE RECRUITING
Making cybersecurity training accessible and reaching untapped talent also requires making a deliberate appeal to demographics traditionally underrepresented in the field.
To boost gender and racial diversity in the sector, the organization offers a girls-only group called Girls Go CyberStart and collaborates with Junior Reserve Officers’ Training Corps (JROTC) programs, which Paller said tend to have significant numbers of Black and Hispanic participants. The U.S. Army states that about 40 percent of its JROTC programs are in center city schools at which roughly half the population is nonwhite.
The most recent CyberStart game drew in 29,000 participants of which roughly 36 to 37 percent were female, 19 percent Hispanic and 9 to 10 percent Black, according to Paller.
STUDENT EXPERIENCE
For students like Haya Arfat, the gamified approach seems to be working. Arfat was a junior interested in computer science but with little exposure to cybersecurity when she first tried the game. She told GovTech that the scholarship prize initially caught her eye, but the fun of the game kept her hooked.
“It immediately felt like I wasn’t studying or competing – rather that I was playing this just for fun. It became more of a pastime than something I had to do for my college applications,” Arfat said.
Arfat said the game and the ensuing competition were both presented as learning opportunities, not tests to beat, making them feel accessible to curious newcomers. She won a scholarship from the competition during her junior year, and is now a rising sophomore at Texas A&M University, where she’s pursuing a cybersecurity career.
The game “really opened my eyes up to what else is out there in the field of computer science besides just programming and becoming a software developer,” Arfat said. She added that her participation gave her confidence to dive into other cyber competitions and familiarized her with areas like Python that have been useful in college classes.
NCSF launched its CyberStart America game-and-competition program for U.S.-based high schoolers in 2017. A Cyber FastTrack companion program, meanwhile, targets college students — including those who may have intended to pursue entirely different majors — as well as those already in the workforce.
Jennifer Maynard was one of the latter. She had been working an IT support and administration job when she decided to try FastTrack to explore new options.
“When I had graduated college … I was interested in analytical problem solving,” Maynard told GT. “When I read about the CyberStart FastTrack competition, I thought that sounds interesting … maybe it’ll be fun, and I’ll just see how this goes.”
She became a finalist, winning a scholarship to the SANS Institute’s Applied Cybersecurity Program which she completed within a year, obtaining Global Information Assurance Certification (GIAC). Maynard then landed her first cybersecurity role, working as a SOC analyst for managed protections startup Expel.
“The best and worst thing about the [CyberStart] competition is it was very tedious,” Maynard reflected. The version of the competition she participated in during 2019 was lengthier than its current form, she said. “[It] ate up a lot of time [but that was] good for me since I came out of it more determined in saying, ‘Hey, this is what I’m really interested in.’”
PROGRAM UPDATES
Other efforts have been underway to refine the program, too.
Discussions with employers led to new career-relevant skills being added to the game, and Paller said the program is continuing to seek ways to collaborate with companies to direct CyberStart players to jobs and internships, a topic that is the focus of an upcoming July 21 virtual forum.
The organization is also in discussions about potentially hosting its game on a popular platform like Steam or Twitch to draw in more players and is working to boost its reach through collaborations with college-based cyber clubs to provide them access to the game.
