Report: Stress will drive a quarter of cyber defenders out the door

There
are
too
few
cybersecurity
experts
to
fill
jobs,
but
a
new
study
sees
the
crunch
increasing
through
2025
as
cybersecurity
experts
head
for
the
hills.

It
is
well
known
that
the
cybersecurity
field
faces

vacancies
and
a

skills
gap.
Unfortunately,
relief
may
not
come
soon,
if
research
firm
Gartner’s
predictions
hold
true
that
fully
a
quarter
of
security
leaders
will
depart
the
cybersecurity
field
entirely
by
2025
due
to
work
pressures.

In
a
new

report,
the
firm
predicts
that
nearly
half
of
cybersecurity
leaders
will
change
jobs,
and
that
by
2025,
lack
of
talent
or
human
failure
will
be
responsible
for
over
half
of
significant
cyber
incidents.

Jump
to:

Don’t
ask
cyber
staffers
‘Why
so
serious?’

Deepti
Gopal,
director
analyst
at
Gartner,
said
cybersecurity
leaders
are
burning
the
candle
at
both
ends
to
balance
technology
needs,
business
needs
and
environmental
needs
in
order
to
maintain
or
improve
their
organization’s
security.

“While
they
are
in
the
rush
to
achieve
this
they
are
really
spread
thin,”
Gopal
said.
“If
you
look
closely
at
today’s
world,
the
hybrid
work
environment
is
everything;
that
also
impacts
the
cybersecurity
leaders,
adding
complexity
to
their
work
and
the
way
they
strategize.”

She
added
that
“work
life
harmonization”
adopted
by
IT
amounts
to
dissolving
the
membrane
between
work
and
non-work,
particularly
as
work
and
home
are
in
the
same
location.

“If
you
listen
to
cybersecurity
leaders,
you’ll
hear
things
like
‘I
start
my
day
with
work,
emails,
alerts,
and
coffee,’
and
‘I
work
with
a
group
of
All
Stars
who
are
always
available,’”
Gopal
said.
“They
don’t
complain
about
the
workload.
These
are
all
elements
that
indicate
the
presence
of
high
stress,
high
demand.

“But,
there
is
a
loss
of
control
or
inability
to
have
a
sense
of
control
on
their
work-related
stress
—
the
inability
to
protect
their
time
for
the
things
that
matter
the
most.
I
like
to
ask
leaders
to
jot
down
the
things
that
they
absolutely
do
in
the
coming
week
and
then
look
at
their
calendars,
most
often
they
tell
me
that
they
haven’t
carved
out
any
time
for
the
tasks
on
their
list!”

Cybersecurity
teams
undervalued
at
companies
that
move
fast
and
break
things

Gartner
research
shows
that

compliance-centric
cybersecurity
programs,
low
executive
support
and
subpar
industry-level
security
are
all
indicators
of
an
organization
that
does
not
view

security
risk
management
as
key
to
business
success.
Gopal
said
such
organizations
are
likely
to
see
cybersecurity
talent
leave
for
companies
where
they
are
more
appreciated
—
where
their
impact
is
felt
and
valued.

“When
the
organization
is
charged
to
move
fast,
there
will
be
situations
where
security
is
not
top
of
mind;
that
needs
to
change,”
Gopal
said.
“We
need
to
see
cybersecurity
as
intrinsic
to
digital
design.”

SEE:

10
cybersecurity
predictions
for
tech
leaders
in
2023
(TechRepublic)

Insider
risk
rises
with
discontent,
‘talent
churn’

Paul
Furtado,
vice
president
analyst
at
Gartner,
said
talent
churn
of
cybersecurity
or
other
talent,
IT
or
otherwise,
could
constitute
its
own
security
bugbear,
as
it
raises
the
specter
of
insider
wrongdoing.

“The
cybersecurity
workforce
is
a
microcosm
of
society
and
made
up
of
individuals
who
respond
differently
to
different
stress
triggers,”
Furtado
said.
“For
some,
they
will
leave
their
employment
gracefully
without
any
disruptions.

“Others
may
feel
that
the
artifacts
they’ve
created
or
contributed
to
are
their
personal
intellectual
property,
and
therefore,
they
take
a
copy.
Some
may
feel
that
they
want
to

exfiltrate
some
data
that
may
assist
them
in
their
next
role
with
a
different
employer.”

And
then
there’s
the
possibility
—
more
remote
perhaps
—
that
individuals,
regardless
of
where
they
are
in
the
organization,
may
go
beyond
theft
to
commit
acts
of
sabotage
or
disruption
of
systems
or
data.

“The
reality
is
that
security
leaders
must
be
prepared
for
each
of
these
occurrences;
there
are
numerous
examples
where
these
behaviors
have
occurred,”
Furtado
said.
“The
scary
part:
In
some
cases,
insiders
won’t
wait
for
a
layoff
or
resignation
to
start
some
of
these
behaviors.

“Preparing
to
manage
insider
risk
is
critical
in
preventing
it
from
becoming
an
actual
insider
threat
event.”

Gartner
predicts
that
by
2025
half
of
medium
to
large
enterprises
will
adopt
programs
to
deal
with
insider
risk
—
up
from
10%
today.

Taxonomy
of
insider
threats
and
how
to
deal
with
them

Furtado
said

insider
threat
activities
typically
revolve
around:

• Phishing.
• Misrepresentation.
• Financial
  theft
  and
  other
  forms
  of
  embezzlement
  such
  as
  expenses
  fraud.
• Exfiltrating
  or
  viewing
  unauthorized
  data.
• System
  sabotage
  involving
  malware,
  ransomware,
  account
  lockouts
  and
  data
  deletion.

3
types
of
threat
actors

He
identifies
three
kinds
of
actors:

• Careless
  users:
  Accidentally
  exposes
  sensitive
  and/or
  proprietary
  data,
  including
  errors
  and
  improper
  configurations.
• Malicious
  users:
  Intentional
  sabotage
  or
  data
  theft
  for
  either
  personal
  reasons
  or
  financial
  gain.
• Compromised
  credentials:
  Credentials
  exploited
  by
  someone
  outside
  the
  organization
  for
  the
  purpose
  of
  data
  theft
  and/or
  sabotage.

Insider
threat
attack
sequence

According
to
Furtado,
taxonomies
of
insider
attacks
show
that
many
determined
and
planned
exploits
followed
this
sequence:

1. The
   actor
   makes
   a
   genuine
   error
   and
   reverses
   it.
2. When
   no
   consequences
   are
   experienced,
   the
   actor
   tests
   to
   see
   if
   the
   error
   can
   be
   repeated
   at
   will.
3. The
   critical
   point
   is
   reached
   when
   a
   combination
   of
   work
   stressors,
   personal
   stressors
   and
   character
   flaws
   allows
   the
   actor
   to
   rationalize
   harmful
   behavior
   as
   deserved,
   serving
   a
   higher
   cause
   and
   so
   on.

Countering
insider
threats

In
order
to
counter
this
risk,
Furtado
counsels
organizations
to:

• Rule
  of
  three:
  Implement
  the
  “rule
  of
  three”
  to
  mitigate
  risk
  while
  effectively
  using
  limited
  security
  resources.
  Furtado
  said
  this
  involves
  deterring
  individuals
  from
  wanting
  to
  act
  in
  the
  first
  place,
  detecting
  the
  activity,
  and
  disrupting
  the
  effort.
• Security
  culture:
  Establish
  an
  enterprise-wide
  culture
  of
  security
  by
  developing
  a
  formal
  insider
  risk
  program
  aligned
  with
  key
  areas
  of
  the
  organization
  (especially
  HR
  and
  legal).
• Social
  and
  risk
  governance:
  Mitigate
  the
  insider
  risk
  by
  implementing
  behavioral
  technology,
  risk
  measurement
  and
  sound
  governance
  practices
  (Figure
  A).

Figure
A

Humans:
the
cause
and
the
target

Gartner
predicts
that
by
2025,
lack
of
talent
or
human
failure
will
be
responsible
for
over
half
of
significant
cyber
incidents
due,
in
part,
to
spiking
social
engineering
exploits
and
lack
of
data
hygiene.
The
firm’s
data
also
suggests,
however,
that
employees’
perception
of
risk
may
not
reflect
clear
and
present
cybersecurity
dangers.
If
not,
top-down
guidance
may
be
of
little
value.

Last
spring,
when
Gartner
surveyed
some
1,300
employees,
69%
of
them
said
they
had
bypassed
their
organization’s
cybersecurity
guidance
in
the
prior
12
months,
and
74%
said
they
would
be
willing
to
bypass
cybersecurity
guidance
if
it
helped
them
or
their
team
achieve
a
business
objective.