As yet I have only had time to read the summary of the latest Cyber Security Skills report but a penny dropped. Current skills policy is not designed to meet the needs of business. If it was ever consciously "designed", it was to develop a pool of potential cyber warriors for GCHQ, MoD and their supply chain. A consequence is that, as incidents and awareness rise the proportion of businesses lacking confidence in incident management is rising steadily: from 27% in 2020, to 32% in 2021, to 37% in 2022 to 41% in the 2023 survey.
For 84% of those not working in the sector itself, cyber is a part-time add-on.. Even in large user organisations it is rare to have a full time cyber "professional". Their cyber security suppliers may need full time students or apprentices. But they need access to affordable micromodules (that can be quickly mastered and tested), linked to alert and support services that will help protect them against attacks by those renting AI assisted "cybercrime as a service" tools to help them assess potential victims and infiltrate, impersonate and loot them, after bypassing traditional signature based protection services.
Meanwhile those providing their support services commonly need the "generalist" skills in the Cyber Security Career Route map. But that "map" is little known and does not link to mainstream digital skills taxonomies (like SFIA) or those cyber taxonomies used by the rest of the world.
The 2022 DfE review of skills taxonomies recommended use of the US Occupational Information Network with the definitions for Digital Skills expanded in line with SFIA . SFIA has been mapped against the NIST security standards. Meanwhile Financial Services Skills Commission framework covers Cyber, PCI standards are mandatory for many and the NSA has worked with industry to produce the Enduring Security Framework. Plans are under discussion to map the Cybersecurity Council career pathways against SFIA but accreditations are based on knowledge (as per Cybok) rather than skills.
Meanwhile most public sector funding agencies appear to still use National Occupational Standards. These are recognised and/or used by almost no-one else and the Institute for Apprenticeship and Technical qualifications has started a major review of post-16 technical qualifications.
Training providers, recruitment agencies and employers are confused.
I plan to make time to read and review the report but, in the mean time,
wish to hear from those interested in helping the Skills sub-group of the London Cyber Resilience Centre organise micro-modules to update the skills of those in the financial services supply chain, including to handle tools and tasks not currently covered in mainstream cyber programmes. #cyberresilience #cyberriskmanagement #lcrc
For 84% of those not working in the sector itself, cyber is a part-time add-on.. Even in large user organisations it is rare to have a full time cyber "professional". Their cyber security suppliers may need full time students or apprentices. But they need access to affordable micromodules (that can be quickly mastered and tested), linked to alert and support services that will help protect them against attacks by those renting AI assisted "cybercrime as a service" tools to help them assess potential victims and infiltrate, impersonate and loot them, after bypassing traditional signature based protection services.
Meanwhile those providing their support services commonly need the "generalist" skills in the Cyber Security Career Route map. But that "map" is little known and does not link to mainstream digital skills taxonomies (like SFIA) or those cyber taxonomies used by the rest of the world.
The 2022 DfE review of skills taxonomies recommended use of the US Occupational Information Network with the definitions for Digital Skills expanded in line with SFIA . SFIA has been mapped against the NIST security standards. Meanwhile Financial Services Skills Commission framework covers Cyber, PCI standards are mandatory for many and the NSA has worked with industry to produce the Enduring Security Framework. Plans are under discussion to map the Cybersecurity Council career pathways against SFIA but accreditations are based on knowledge (as per Cybok) rather than skills.
Meanwhile most public sector funding agencies appear to still use National Occupational Standards. These are recognised and/or used by almost no-one else and the Institute for Apprenticeship and Technical qualifications has started a major review of post-16 technical qualifications.
Training providers, recruitment agencies and employers are confused.
I plan to make time to read and review the report but, in the mean time,
wish to hear from those interested in helping the Skills sub-group of the London Cyber Resilience Centre organise micro-modules to update the skills of those in the financial services supply chain, including to handle tools and tasks not currently covered in mainstream cyber programmes. #cyberresilience #cyberriskmanagement #lcrc