Current Situation.
The following is a discussion document developed for me by Stefan Umit Uygur following my return from the Tallinn Digital Summit where this year’s theme was ‘Delivering trusted connectivity through trusted partnerships’. I believe that there is great work being done here in Ireland in the area of Cybersecurity, but I hope readers will forgive me when I say there are far too many independent silos. It’s time we all came together. So please read and feel free to comment.
Ireland, North & South has gained a reputation as a Cyber Security Hub.
Some of the largest, cyber software, multinationals have set up in Cork, international banks have their cyber teams in Dublin, as have the Big Four. Belfast has gained a reputation for development companies. Letterkenny has TCS, Galway has HP and Sligo has Advantio.
Indigenous, IT Services companies with cyber teams have offices in the main cities and the UK as well as in major EU cities (some in USA).
There are cyber security undergraduate and postgraduate degree programmes in many of the third level colleges. Cyber Skills is funded by the Department of Education and is a joint venture between Cork, Dublin, and Limerick. Only MTU and Carlow IT provide courses in Operational Technology for Cyber.
According to the 2021 (ISC)2 Cybersecurity Workforce Study, there is a cybersecurity workforce gap of more than 2,72 million positions (Geographic scope 48 countries which includes all of EU members). While this number is decreasing, it is not enough. The global cybersecurity workforce needs to grow by 65% to be able to effectively defend critical assets. However, no one organization, institution or government can remedy this. Consistent, active participation and partnerships between industry, academics, and governments, will be the difference in deterring and diminishing cyber threats and defence for resources that are under threat.
“The study tells us where talent is needed most and that traditional hiring practices are insufficient. We must put people before technology, invest in their development and embrace remote work as an opportunity. Most importantly, organisations must adopt meaningful diversity, equity, and inclusion practices to meet employee expectations and close the gap.’’
Under-resourced, teams experienced misconfigured systems, rushed deployments, slowly patched critical systems and not enough time for proper risk assessment and management.
Cloud computing security was found to be the top priority for cybersecurity professionals’ skills development over the next two years. Just under 40% said their organisations were using cloud service providers to overcome their workforce gaps.
College courses alone cannot meet the demand and do not have the capability to deal with strategic and operational needs, as suggested above.
The desire for graduates is oftentimes the easy way out. High specifications rule candidates out but the gap is still there. Recruitment practices need reform, employers need a better understanding of the forces at play and the urgency to fill the gap.
Many entry-grade jobs do not need degrees that are often out-dated before the course is completed. There is an obvious need for better cyber managers, strategic thinkers who can see and solve the major and minor problems in cyber warfare.
The larger organisations use Corporate Programmes to train up their key cyber people. They look to headquarters for the latest materials and insights, rather than the colleges.
Ireland has a proven capability to attract multinational corporations from all over the world, particularly the US. These relationships have proven beneficial for both the Irish economy and the multinationals’ ability to gain footholds into the EU and the advantageous, Corporation Tax rates. In the cyber area, we have many of the best-known software and services companies. This provides Ireland with an image that appears to be at the leading edge of cyber work. State Agencies will use this to great effect, suggesting that this helps the country to remain safe and secure.
The absence of a National Security Strategy and local resources to support it, presents a different scenario that must be addressed in light of the new, global perspective.
Global Perspective
All the above and the following paragraphs must be seen in the context of the country’s lacklustre approach to the HSE Ransomware attack and the consequences of the Russian invasion of Ukraine.
Energy is now the battleground in every sense. Not just the supply but the security of infrastructure, all of our Citizens are targets whether it’s through safe delivery or escalating prices. We did not effectively act when the HSE was hit, this time there is nowhere to go: we must prepare everybody. A Change programme often needs reasons to do things differently and better. We have our moment.
Cyber Clusters
Cyber Ireland and NI Cyber are cluster organizations representing hundreds of cyber and IT companies across the island. Lately, new organisations have been joining who represent a different calibre and perspective from those who signed up in the first phase of development; they are less corporate, academic, and more practical.
Potentially, these cluster organisations could be a major force for change and serious improvement. Both have been working seriously again post Covid. There is a renewed energy that can bring about many improvements in the Irish ecosystem. They are a key part of this Vision.
They must bring Leadership and key priorities to the process of engagement. They have shown how they can bring public and private organisations together under the cyber banner. The ability to facilitate a major change process is a key skill that their Leaders need to bring to the cyber community and the country, at large.
Cyber Ireland has already identified key areas of activity for their work in their Chapters and Special Interest Groups (SIG). The Chapters consider Talent Development, Career Promotion to Students and Children and Threat Intel, Networking & Collaboration, Talent & Skills and Awareness & Advocacy, Forums and Mentoring.
There are two SIG’s: Threat Intelligence and Operational Technology Security (OT Sec). These Chapters and Groups are dominated by multinationals. Undoubtedly, these are the right areas for discussion, but discussion is restricted with the participants coming from largely, multinationals.
Collaboration is at the heart of the cyber clusters but limiting this to academics and multinational people minimizes the quality of the debate and the outputs. SMEs are critical strategically and economically; their inclusion is not just necessary but compulsory.
Cyber Security Vision for Ireland – The Engine – The Ecosystem
Ireland will be a global cybersecurity hub in the next five years. Supporting the country’s needs and future development to export security services to the world.
This can happen by building a harmonious ecosystem to raise cybersecurity standards. The ecosystem can include those currently involved but change the emphasis from multinational companies to private and public indigenous organisations.
Academic and training organisations are here to service the needs of the Citizens, students, apprentices, trainees, employed, underemployed and unemployed.
The cyber clusters already in existence, can provide the engine to drive and accelerate the changes needed; they have started discussing key topics, it is now necessary to connect the component parts of the ecosystem and create an action-based agenda that brings about serious improvement and connectivity. Collaboration is at the heart of this system; communication is the circulation.
Participants in this process need to be conscious that the work to be done is for the greater good of Citizens, the Country, and its global ambitions.
The current components are the following, others will materialise:
- Cybersecurity Awareness – for all; in every parish, club, and charity.
- Cyber Skills – defined by the latest version of cyber frameworks.
- Training – that complements the college offering and is fast tracked, dynamic, developmental and leads to career progression.
- Supporting local businesses – meeting the needs of SMEs and supporting indigenous software and service companies, though:
- Risk Management
- Software Research & Development
- Security Operation Centres
- Cybersecurity as a Service
- Adopting Circular Economy Philosophy.
- Job creation – building on all of the interconnected components to create jobs for unemployed, career changers and those who would like to move into a career in cyber from their current employment.
Work In Progress
Some work has already been started with the Advanced Manufacturing Training Centre of Excellence Centre (AMTCE) in Dundalk. Then use this project to expand to the entire country, including Northern Ireland.
The Dundalk project is to create a consortium that involves academia, public sector and local private sector, specialists in manufacturing and cybersecurity. Then build an OT and IT training suite.
This initiative brings some of the component activities above together and starts the Engine for the cybersecurity ecosystem.
Future plans include the following training activities for:
- Students – primary, secondary and college.
- Employed people who are interested in cybersecurity.
- Unemployed people who are interested in cybersecurity.
- People who would like to make career change.
- Organizations employees/staff.
The Security Operation Centre to be built using almost exclusively with indigenous cybersecurity solutions. It can provide cybersecurity services to local organisations whose businesses are outside of the IT/OT domain but heavily relying on IT/OT. Once built the model can be taken to various locations across the country.
Working with the cyber clusters provides local direction and energy to see what is feasible and where.