The Complexities of the Cyber Landscape

With technology rapidly evolving and computer and network systems becoming more intricate, there is a high market demand for qualified, analytical, and innovative cybersecurity professionals to oversee these networks. 2021 showed a 50% increase in attacks on corporate networks compared to the year before, which had already witnessed a historically high number of data breaches. This increased threat is exacerbated by the labor deficit, with nearly two-thirds (60%) of the Cybersecurity Workforce Study participants reporting that the cybersecurity staffing shortage is placing their organizations at risk. An (ISC)2 study and the Cyber Workforce and Education Summit hosted this summer by the White House reiterated the pressing need for cybersecurity professionals and the correlating demand for accessible, quality educational options to train them. 

“More than ever, organizations globally need skilled leaders that understand the technical, business, and policy challenges that cybersecurity presents,” says Brenden Kuerbis, research scientist within the School of Public Policy at Georgia Tech and Executive Director of the Online Master’s of Science in Cybersecurity (OMS Cybersecurity) program.

“Cybersecurity professionals need a solid technical foundation but also complementary critical-thinking and problem-solving skills that allow them to understand broader impacts, manage change, and move quickly to solutions.” 

A range of solutions to address this challenge are being pursued, and while on-the-job training can account for some of the gap, a large amount of the workforce needed is in mid-to upper-level management. “Cybersecurity is a dynamic and complex field,” says Milton Mueller, professor at Georgia Tech’s School of Public Policy and program director for the Policy Track of the OMS Cybersecurity program. “Short-term training in minor technical skills does not create a mindset that allows one to understand and approach complex issues.”  

As technology advances and global events unfold, acquiring the skills to understand and approach complex cyber issues is becoming even more crucial. Multiple events this year have validated the need for this level of acumen in your cybersecurity team.      

Invasion of Ukraine 

Russia sent shockwaves around the world when it invaded Ukraine earlier this year. Governments and companies sought the latest information regarding the possibility of Russian attacks, including in cyberspace.  Numerous public and private efforts to boost awareness and bolster organizational defenses emerged to combat destructive cyberattacks within Ukraine, network penetration and espionage outside Ukraine, and cyber-influence operations. 

“Technologists are good at managing vulnerabilities, but we also need strategists who can think about adversaries,” says Jon Lindsey, Associate Professor at the School of Cybersecurity and Privacy at the Georgia Institute of Technology. “Cyberattacks like digital subversion and espionage are problems that must be continuously managed because they cannot be solved with technology alone. More sophisticated information systems just enable more creative forms of deception."

"Competitive advantage in politics and business will go to those organizations with people who are able to think smartly and creatively about both technological and political complexity.” 

The Russian invasion will not be the last geopolitical event to impact cybersecurity. Future events will again demand that we continue to maintain and fortify our collective cybersecurity, requiring creative insight from technologically adept, strategically savvy leaders.  

Federal Rulings 

Meanwhile, two back-to-back federal policies significantly impacted the landscape of cybersecurity reporting on a national scale, tightening the cyber defense relationship between the private and public sectors.  

On March 9, the Securities and Exchange Commission (SEC), a federal agency dedicated to overseeing the security of capital markets, released new regulations to increase oversight and visibility of cybersecurity in the private sector. Publicly listed companies, registered under the SEC, must now make several periodic disclosures relating to their management and governance of cyber risks. In addition, they must report any material cybersecurity incident to the SEC within four business days after its discovery.  

"The Commission has done well to focus on material cybersecurity incidents,” comments Jerry Perullo, former Chief Information Security Officer of IntercontinentalExchange (ICE/NYSE) and Professor of the Practice at the School of Cybersecurity and Privacy at the Georgia Institute of Technology. 

“However, the lifecycle of a cyber incident, material or not, is highly complex, and it is important to understand that incidents begin as tiny seeds, most of which die along the path of investigation."

"Consequently, the majority of incidents that are ultimately deemed reportable will have had to matriculate through a process that adds information along the way until materiality can be properly assessed.” 

Six days later, on March 15, the White House signed into law the Cyber Incident Reporting Act which requires entities that own or operate critical infrastructure to report covered cyber incidents (e.g., a ransomware attack) to the federal government. The covered entity has only 24 or 72 hours to report information to the Cybersecurity and Infrastructure Security Agency (CISA), which is now holding rulemaking consultations with stakeholders around the country.  

These policies will likely increase the demand for cybersecurity labor, influencing the operations of tens of thousands of organizations in subtle but significant ways. “In complex legislation and regulatory proceedings,” says Kuerbis, "cybersecurity leaders need to be well-versed in the various incentives of stakeholders and possess a deep understanding of how these policies can impact their organization's operations, security, and risk.”  

Cryptocurrency 

Over the past few years, Bitcoin and other blockchain-based currencies have steadily risen in popularity and value, enlarging the digital real estate available for cyber-attackers to leverage.  Mueller notes the gravity of this trend for organizations and individuals alike.

“The digitization of payment systems and money raises the stakes of cybersecurity to new levels,” says Mueller.  

During the first half of 2022 alone, even while cryptocurrency dropped in value, a study showed that crypto-related cybercrime nearly doubled from the same period in 2021. Since January, over $1.97 billion have been stolen from crypto-related systems and companies. The main victim was Ethereum, a decentralized digital blockchain-based ecosystem, which lost over $1 billion in 32 hacking attacks.  

Most of these attacks rely heavily on social engineering, which is when an attacker uses fraudulent means, such as phishing, to trick a human working inside the organization into granting them access to internal software or data. This reveals an urgent need for training and awareness programs in organizations. While automated tools to detect and reject phishing messages can help, non-technical methods such as managing internal awareness programs are more important, especially for subject-matter experts.   

Closing the Gap 

Effective cybersecurity is increasingly crucial in today’s business environment. Whether domestically or globally focused businesses need skilled cybersecurity experts, able to navigate the increasingly complicated landscape of distributed systems and pervasive connectivity. To do so, these experts must possess holistic leadership skills and knowledge: an understanding of the history, stakes, and impact of a wide variety of cyber-related topics—not only technologies, systems, and processes, but also organizational strategies, governance structures, and geopolitical situations. 

As each day brings new developments in cyber threats and cybersecurity, society and security depend increasingly on cyber experts and their ability to make strategic, effective actions.   

Programs like Georgia Tech’s Online Master’s in Cybersecurity (OMS Cybersecurity) provide a comprehensive cybersecurity education that prepares students to face and manage increasingly complex cyber issues effectively and confidently. Addressing a wide range of topics, from technical skills to policy at the enterprise, national and transnational levels, an advanced degree of this quality can help fill the growing need for cybersecurity leaders.  

 

 

Georgia Tech Professional Education is a leader in innovative educational delivery, designed for working professionals in tech, business, and leadership. Our connection to the marketplace — coupled with our world-class faculty, researchers, and subject matter experts — provides an unparalleled perspective on education innovation, industry trends, future work, and lifelong learning. To uncover additional trends, challenges, and opportunities impacting your industry, visit our Industry & Trends page.