Walk around the show floor at RSA Conference 2016 in San Francisco and two issues that come up constantly are the sharing of data intelligence and the dearth of talent needed to fill the growing number of information security jobs.
Christopher Young, Intel Security Group's senior vice president and general manager, addressed these issues head-on in his Tuesday morning keynote. Demonstrating just how serious the growing threats are today, Young points out that 10 years ago security firms faced roughly 25 new threats each day. Today that number is more than 500,000.
In order to build that cyber work force for the future Young says companies, schools and government need to work together to create opportunities and to hire and train students who will be the future workforce. “We'll be in a world of hurt in our industry if we don't start (hiring new talent) now,” he said.
Part of the challenge of finding new talent is knowing how to recognize it. Young noted that one security executive told him one way to entice Millennials into data security is to present the industry in terms they recognize – gaming. He cited the SANS Institute using its NetWars Tournament as an example of reaching gamers. He also lauded the White House's Cyber Corps efforts to engage “the next generation of talent.”
In terms of data sharing, Young said the industry is still learning how to do the job well. He cited an effort several years ago when members of the Cyber Threat Alliance decided the best way to learn about new cyber attacks was to share all of the data they generated on malware, throwing it all into a single proverbial pot. The result: “Nothing happened.” The problem was that data alone did not disclose any new threats.
Instead, he said, the group decided to focus its efforts on a specific malware attack: CryptoWall. By targeting a single malware attack the group was able to identify 4,056 individual malware samples with each group contributing samples from different industries. By focusing the intelligence sharing on a single project, Young said, it was possible to learn how to share information effectively.
Young challenged the concept that sharing intelligence data will harm competition. While acknowledging that some companies might need to redefine their business model, the sharing of intelligence itself will not be significant to corporate growth; rather it will be how companies use and process the shared data.
