Cybercrime is one of the biggest threats to businesses all over the world, New Zealand included. As we are living in an increasing connected world the need for IT security specialists is on the rise. One prominent New Zealand business owner recently stated, ‘If I can get 30 IT security specialists to walk through our doors today, I will employ them all.”
More and more of our private and professional lives are defined by digital technologies. Organisations of all kinds such as Government, business, and NGOs are seizing the opportunity to deliver services, participate in business transactions, and communicate in cyberspace. While we embrace the openness of cyberspace, this online environment provides numerous opportunities for tech-savvy criminals.
A survey in 2014 found that 83% of New Zealanders had experienced some kind of cybersecurity breach. But this is only the tip of the iceberg. As we still do not have a central organisation for reporting cyber crime, breach disclosure isn’t accurate. Often, victims of cybercrime don’t know how to report it. As a result, we don’t have a consolidated picture of cyber crime in New Zealand, however, we do know that IT security jobs are becoming the hotspot for IT professionals.
But what are the skills that you need to be an IT Security Analyst and what does the job entail? We spoke to Shane Hanson, an IT Security Analyst and asked him a few questions about the world of IT Security.
IT Security Skills 101
When it comes to working in the IT security sector, you have to have the right skills. According to Hanson, the top three skills are:
- Attention to detail: IT security professionals work methodically and very detail oriented.
- The ability to continuously learn: IT security professionals have an eagerness to dig into technical questions and examine solutions and problems from all sides. They are also big believers of continuing education and take the opportunity to upskill as they understand how quickly technology changes and advances.
- The ability to see what motivates others. You have to be able to put yourself in someone else’s shoes and understand the ‘why’ to be able to anticipate and front foot the ‘how’.
As with all technical fields, Hanson believes that the devil is in the detail in cyber security. Even a minuscule thing can determine whether a packet is valid or harbouring a vulnerability. Because of this, a dedication to continuing education is vital in order for IT security professionals to keep up to date with the latest vulnerabilities and defences.
In addition to these skills, Hanson rates the following attributes:
- Enthusiastic and highly adaptable
- Strong analytical and diagnostic skills
- Demonstrated skills in innovation and collaboration
- Keep a current understanding of vulnerabilities from the Internet
- Maintaining awareness and knowledge of contemporary standards, practices, procedures and methods
- Ability to get the job done
IT Security Issues
Hanson says that cost is always the number one concern for businesses looking to hire an IT security specialist. He believes that outside of compliance requirements, businesses still see cyber security as a cost to be avoided rather than an essential element in their business strategy to protect their reputation and provide longevity.
And despite the many security breaches that we hear about again and again in mainstream media, this is certainly true for New Zealand businesses. IT security professionals continue to preach the benefits of a robust security plan, but many Kiwi businesses remain unprepared and unprotected from a wide variety of cyber security threats.
In fact, a majority of these businesses have no or only a partial system in place for controlling and tracking sensitive data. One step in protecting this sensitive data is by understanding the most likely sources/causes of security breaches. Let’s take a look at them briefly here:
1. Disgruntled Employees
It is sad but true: internal attacks are a business’ number one cyber security threat. Rogue employees, particularly members of the IT team, have access to networks, data centres and admin accounts, leaving a business wide-open to an attack. For instance, the notorious Sony hack was apparently the result of an inside job and not North Korea as it had been reported.
The best way to avoid this kind of privileged account exploitation is to identify all such accounts and credentials, and immediately terminate those that are no longer in use. The monitoring, controlling and managing of privileged credentials is necessary to prevent exploitation. Savvy companies should have the necessary protocols and infrastructure to track, log and record all account activities to ensure a quick response to malicious activity.
2. Uninformed Employees
A forgotten or lost unlocked smartphone in a taxi or cafe is just as precarious as a disgruntled employee who maliciously leaks information. Both careless employees and untrained employees are guilty of putting businesses at risk through their ignorance of best cybersecurity practices, such as the following:
- Having weak passwords
- Visiting unauthorized websites
- Clicking on links in suspicious emails
- Opening email attachments from unknown sources
Training employees on cybersecurity best practices are important, but offering ongoing support is essential as criminals are quick to crack onto new ways to scam. Some employees don’t know how to protect themselves online, which can put company data at risk. Many kiwis also don’t understand the importance of strong passwords – which are often the first line of defence regarding cyber security.
3. Unpatched/Unpatchable Devices
Network devices, such as routers, servers, and printers are vulnerable to attacks. Some software companies offer patches to cover these vulnerabilities, but even Microsoft is no longer offering security updates for Windows 2003, despite 10 million physical Windows 2003 servers still in use.
Businesses can avoid this kind of breach by ensuring devices and software are kept up to date at all times through a patch management system. Best practice states that if a certain piece of equipment is not updated or patched within a certain amount of time, it is taken offline.
Businesses run on IT and they need help to secure it. Hanson is quick to state that IT security professionals need to remember why these jobs exist in the first place: to serve businesses. “Without business there’s no requirement for security, not vice versa”, he says.
What the Job is Really Like
But he has solid reasons for loving this line of work too. “For me as a contractor the best part of the job as an IT security specialist is the variety of things I get to do in a day, and seeing the myriad of different ways used to achieve the desired outcomes along the way when tackling a problem.”
Steve Hanson says he loves the variety that his job brings.
And the job really is varied. Information security specialists may have expertise in working with different types of computer networks associated with the government and NGOs, defence industries, and the banking and commerce sector, to name just a few.
There are a variety of roles available within the field of information- and cyber security. Some of these roles do not, and cannot, exist in isolation from each other, so is it very common that an IT specialist working in one area will develop a strong understanding of the work in other areas. This is exactly what keeps the career interesting.
As employers use slightly different job titles for the same role, overlaps between roles can occur. Therefore, when exploring careers in information and cyber security, read job descriptions thoroughly to get an understanding of what’s involved with a particular role.
From analysing and assessing potential security risks, developing plans to deal with such incidents by putting measures in place such as firewalls and encryption, to monitoring and auditing systems for abnormal activity, to executing corrective actions, IT security specialists never have a boring day. And it’s exciting too: IT security specialists can essentially do everything a hacker can, only they use these skills for good not evil! Say hello to the modern superhero.
What to expect
Much of IT security work is office-based, but specialists can also work as consultants, either for an employer or as self-employed, travelling out to visit clients, sometimes even across the world for global clients. The industry is male-dominated, but there are schemes in place to entice women to enter this line of work.
Although it is possible to enter the IT security without a degree via entry level positions in IT (such as help desk support), statistics show that it is becoming more challenging to enter the field from a more general IT role. More recent entrants are graduates, which is a good indication of the growth of information security as a sector.
Currently, half of IT security specialists have an undergraduate degree, with the most common degree subject being IT. There are other useful degree subjects that have desirable transferable skills, such as:
- cyber security
- network engineering
- networks and security
- computer science
- forensic computing
- mathematics
- physics
While those subjects don’t sound like the most exciting subjects, Hanson notes that as someone who “gets to poke around in a lot of other people’s environments” he often comes across some very interesting things. “I’ve seen people running secret cloud services inside corporate networks along with everything from unsecured wireless APs to printers on public addressing.”
IT security is the fastest growing sector for a reason – get in touch with us to find out how we can help you land that IT security job you’ve been dreaming about.
Further Reading:
http://www.csoonline.com/article/3013060/security/top-15-security-predictions-for-2016.html
http://www.cnbc.com/2015/12/28/biggest-cybersecurity-threats-in-2016.html
https://www.newzealandnow.govt.nz/work-in-nz/nz-jobs-industries/information-technology-jobs
Videos:
http://www.cnbc.com/2015/12/04/want-job-security-try-cybersecurity.html
https://www.youtube.com/watch?v=h0SXO5KUZIo
