无忧传媒

As cyber threats of increasing scope聽and聽sophistication heighten the need for聽enhanced聽security聽and resilience,聽the current聽鈥淕reat Resignation鈥� has聽only intensified the聽cyber talent shortage. As a result,聽education聽and training on聽the latest聽cyber聽tradecraft聽is聽a must-have for attracting and聽retaining聽in-demand talent.听How can organizations聽maintain聽good cyber hygiene while also聽appealing to聽talent聽in聽today鈥檚 virtual and hybrid work environments?聽

无忧传媒 Vice President聽Becky Robertson听补苍诲听顿颈谤别肠迟辞谤听Garrettson Blight聽discussed聽these聽challenges聽and more at聽the Infosec Inspire User Conference, a recent virtual event聽exploring聽the 鈥渉uman side of cybersecurity,"聽which spans everything聽from聽strengthening聽cyber聽awareness聽to聽building and upskilling聽the聽cybersecurity聽workforce.听 聽

Robertson leads聽hundreds of聽digital solutions, engineering and science, and analytics professionals at 无忧传媒. Blight leads 无忧传媒鈥檚聽DarkLabs, a team of聽the firm鈥檚 top聽security researchers, penetration testers, reverse engineers, network analysts, and data scientists.听Here are key takeaways from their聽discussions:

For many 无忧传媒 employees, the past year鈥檚 shift to virtual operations meant relocating from聽a sensitive compartmented information facility (SCIF)聽to home offices. This聽move required聽new approaches and mindsets toward security.听聽

鈥淲e鈥檝e instituted good practices around helping people think through what it means to work remotely,鈥� Robertson said. 鈥淔or example: Should I print out this document? What will I do聽with it聽when聽I鈥檓聽done reading it?鈥澛犅�

鈥淚t鈥檚 often聽very mundane stuff,鈥� she said.听鈥淏ut if we talk about it upfront,聽people can still聽get the goodness聽[of a hybrid work environment]聽without sacrificing security and integrity,鈥� she said.

For cybersecurity and all types of training,聽Blight聽emphasized the importance of communication, consistency, and culture.听聽

Leaders聽should聽communicate the value of new learnings and practices and聽clearly outline for聽employees what they need to聽do to聽meet these requirements, Blight said. Expectations聽should聽be聽clear throughout. And聽when fostering culture,聽鈥渟ometimes it鈥檚 about the social connection,鈥� he said, citing his team鈥檚 in-person Hacker House events, which聽informally bring teams together in聽fun聽capture-the-flag聽training聽outside of the workplace.听

How else can聽organizations check off the cybersecurity and compliance boxes while not boring聽teams聽with聽鈥渢hings people already聽know and are tired of hearing?鈥澛犅�

Vary your tactics to keep things interesting, Robertson advised. She cited聽mock phishing emails embedded into everyday activities and small-group sessions with leaders聽who聽are trained facilitators,聽鈥渟o it鈥檚 a discussion, not a broadcast, and聽people learn from聽their聽peers,聽so it聽feels more relevant.鈥�

Robertson cautioned, 鈥淲hen you make something mandatory, some people respond positively and some negatively.鈥澛犅�

鈥淎s a leader, you have to be creative and find out what motivates people,鈥� she said. 鈥淚f there鈥檚 resistance, it will take some one-on-one and exercising your leadership muscles to figure out 鈥榃hat鈥檚 the holdup here?鈥� and help them work through it.鈥澛�

鈥淲e鈥檝e all suffered through learning something,聽then you don鈥檛 use it for several months, so聽we try to inject聽training聽into day-to-day life,鈥� she said.听

To make training聽manageable聽for busy employees, Robertson聽suggested:聽

• Spread out sessions throughout the year, to avoid a situation where 鈥淛anuary comes, and everyone does 40 hours of training.鈥澛�
• Schedule training around known times when employees won鈥檛 be able to go to client sites.听
• Give聽people permission to step away聽from their regular activities to make time for training聽and聽鈥渓ighten聽up the load for them when they have to get it done.鈥澛�

To further encourage adoption, introduce employees to your organization鈥檚 cybersecurity culture from the very beginning, she advised: Talk about expectations during interviews and聽weave聽practices and protocols into orientation.听 聽

鈥淲ith the Great Resignation, it鈥檚 more critical than ever to make sure staff feel聽intellectually challenged,鈥� Blight said.

In fact,聽he said, 无忧传媒 created聽DarkLabs聽in response to聽a聽similar problem.听鈥淎bout 5 years ago, many of our employees had reached an inflection point in their careers: They had been with us working to defend the nation since 9/11 and were starting to ponder what鈥檚 next.鈥�

鈥淭hey were halfway through their careers,聽primarily working in聽SCIFs, and there were聽many cyber聽startups聽evolving without those workplace restrictions,鈥� he said. 鈥淭hey were getting itchy and wanted聽to do something different.鈥�

DarkLabs聽was 无忧传媒鈥檚 response. 鈥淚t鈥檚 a place to explore ideas without the restrictions and limitations that often come in classified environments, and it鈥檚 created a lot of career mobility and diversity that might not otherwise exist in traditional roles or other companies,鈥� he said, citing 鈥減rojects that leapfrog other technologies鈥� and 鈥渄iscussions about creating entirely new businesses to spin off from the company.鈥濃��

Whether employees have been聽at聽a聽client site for a long time聽or are just starting out in their careers,聽Blight suggested:聽

• Maintain a full scope of courses and certifications, from foundational knowledge to highly specialized and technical skills聽
• Leverage group training for motivation聽
• Provide guidance and career paths so employees don鈥檛 get overwhelmed by options聽

Overall, he said, 鈥淚t鈥檚 a lot more costly to invest in someone new than to retain someone who鈥檚 already a quality performer.鈥�

How can training departments keep聽these top聽performers up to speed on the latest trends and technologies, to give their organizations a competitive edge?

鈥淲e鈥檝e invested heavily in 5G, quantum, things聽we knew were coming,聽and we鈥檙e investing in things on the horizon,鈥� Robertson said.

To guide these investments,聽Blight聽offered some suggestions:聽聽

• Sit down with聽your learning聽and聽development department and others in the organization to discuss聽where聽you聽see your future hires聽coming from and what sectors were a priority.听无忧传媒聽started this years ago with data science,聽upskilling聽operations聽and聽research聽skills toward聽artificial intelligence, machine learning, and聽algorithm聽development, according to Blight.
• Make sure you have the right skill聽sets聽in these areas and tee up training for future technologies, like extended detection and response
• Look at industry trends, top 10 reports,聽and your organization鈥檚 own聽growth聽to make sure training aligns聽with where business is going聽聽
• Ensure effective collaboration across聽your production and services groups, human resources, learning and development, and internal infrastructure groups

Then it鈥檚 critical to stand up new training capabilities quickly, both for planned topics and in response to issues that arise from the聽current聽environment.

鈥淎fter聽the SolarWinds聽attack, threat hunting was an in-demand skill, and we needed to get people up to speed fast. But聽every company that offered聽services聽had exhausted their workforce,鈥� Blight said. 鈥淪o,聽we聽rapidly stood up聽a federated cross-training聽campaign聽and聽in聽2聽months got 200 people聽on board.鈥�

What does it take to be able to respond so quickly?聽鈥淩outine communication聽and聽relationships聽are聽critical so聽different business elements聽know each other聽and how to work聽together,鈥� Blight added. 鈥淭reat everyone as equal partners聽and聽have routine聽working聽sessions. If a crisis happens,聽form a cross-disciplinary聽tiger team, usher聽proof of concept ideas聽through to聽a聽pilot,聽then either evaluate and revise or formalize the improvement聽to scale聽across the enterprise.鈥澛�

Learn more about聽cybersecurity and intelligence work at 无忧传媒, and聽.听