The quality of your IT security skills may mean the difference between data loss and high security. Encouraging your team to develop better IT security skills on their own time is unlikely to be effective. Instead, you need to develop an enterprise strategy to identify critical skills and equip your staff to succeed.
The Right Way To Approach IT Security Skills
Before we launch into specific examples of IT security skills to develop, there are a few other questions to consider first. After all, some organizations, like defense contractors, face different security expectations than small businesses. To quickly assess your IT security situation, review these quick self-assessment questions.
● What Did You Find In Your Latest IT Security Threat Assessment?
Review the most recent threat assessment completed at your company. If one has never been done, schedule this work for the coming year.
● What Patterns and Issues Have Contributed To Recent IT Security Incidents?
Review the IT security incidents your company has suffered in the past year or two. For example, you may find that you have had several events related to cloud security. In that case, it makes sense to develop IT security skills to address that gap.
● What Is Your Organization’s Technical Complexity?
As you add more technology to your business, you are faced with increased IT security risks. For example, adding SaaS tools to your company requires ongoing IT security monitoring. Your IT security skills need to keep up with the changing technology you install.
● Which Staff Have IT Security Skills As An Interest Or Goal?
Lastly, but certainly not least, review the career goals of your staff. For example, you may have programmers and technical specialists on your team who want to earn security certifications. In that case, the organization and the individual can both win by supporting IT security skills.
Based upon these assessments, you can make an educated assessment regarding next steps. For example, if you only have a handful of staff interested in IT security for their advancement, you have a leadership challenge to address. We will discuss that concern in the non-specialists section below.
IT Security Skills For Specialists
Your IT security professionals are the linchpin of your IT security strategy. To improve their skills, start with the fundamentals. Review the certifications that your staff have earned. Ideally, it is helpful to have a combination of vendor-neutral principles-based certifications such as ISACA and the Certified Ethical Hacker. Besides, look for vendor-specific security certifications and training. For example, Microsoft offers security exams. If you rely on Microsoft technology, it is worth taking a look at those options. Once you have addressed these foundational elements, you can look at advanced IT security skills.
Identifying the right advanced IT security skills for your company requires considering several factors. First, ask your staff to complete a self-assessment of their skills and what they want to learn to grow themselves. Second, reach out to managers and peers in professional groups such as the Financial Services Information Sharing and Analysis Center in the financial industry. Finally, refer back to your IT security strategy. Determine the most critical gaps to address.
IT Security Skills For Non-Specialists
A strong group of IT security specialists is your foundation for protecting your organization. However, it is not enough to keep you safe. In IT security, all it takes is one person making a mistake or two for you to suffer a significant breach. That’s one reason to offer IT security skills training across your workforce. Second, equipping your workforce with basic IT security knowledge will reduce the burden on your security specialists. Now, let’s take a closer look at some of the specific skills you need to develop this year.
● Password Creation
Each employee has a role to play by creating strong passwords. From a central IT perspective, you can encourage the right behavior with a robust password policy.
● Password Management
Provide guidance to employees on how to protect their company passwords. For instance, avoid writing down passwords in notebooks or slips of paper.
● Multi-Factor Authentication
Guide employees on when and how to use MFA. It’s not good enough to hand a security device to an employee and hope they figure out how to use it.
● IT Security Skills Outside The Office
Whether you are engaged in remote work or traveling for business, protecting information is essential. For instance, guide employees on when to use your VPN. In addition, provide physical security tips to minimize the risk of “shoulder surfing” (a hacker observing you entering a password).
● Phishing
Sending a fraudulent email remains an IT security threat. Sending simulated attacks to employees is one way to train employees. Find out more about ways to increase security awareness and anti-phishing training from the Infosec Institute.
● Where To Get IT Security Help
You cannot expect to cover every aspect of IT security skills for the majority of employees. After all, they have a day job to do! Instead, equip them with clear directions for when and how to reach out for support. For example, you may send them to your IT help desk. Alternatively, you might have an IT security chatbot available to complete password changes.
How To Make Time For Learning New IT Security Skills
Whether you are looking at IT security specialists or not, making time to develop new skills isn’t easy. You already have a full schedule of work tasks to work through each week. If you neglect training, your organization will only become more vulnerable to attack over time. The solution is simple. Use software tools to automate some of the most time-consuming tasks so you have time to invest in training.In terms of your IT security department, take a close look at how much time you’re spending on password reset changes. These routine requests can be handled much faster by an IT security chatbot. If you can free up 2-4 hours of work time each week, that’s all you need to make progress on developing new security skills. Once your security time has more capacity, they can brainstorm ways to develop better IT security training for the rest of the company.
