hey this is john ellis from siemens
energy today we're here to talk to you
about how to attract develop
and retain an industrial cybersecurity
workforce and we're excited to present
for ics village at defcon 29.
hi i'm julia atkinson and i'm an
industrial cyber alliances program
manager over at siemens energy and
excited to talk to you all today
so let's talk about the demand for ics
and ot
cyber security experts in the field and
right now we're focusing on the energy
space in particular
so demand for cyber security
professionals is exploding
especially in the ot or operating
technology specialty in a recent study
by ics square the organization behind
the cissp
researchers found that there were 3.12
million open cybersecurity roles
globally
in 2020. in the same study the
organization found that 64 percent of
companies report
significant or slight shortages of
skilled cyber labor
while 56 of companies report extremely
or moderately at risk
due to the cyber workforce shortage as
it stands
about 90 percent of national ics cyber
security workforce needs went unmet
in 2020 according to cyberseek.org
so what's driving demand for ot cyber
security expertise and why aren't more
individuals moving to ot
first the obvious answer there were few
ot cyber experts to begin with
ot cyber experts have traditionally come
up through the ranks
these individual individuals typically
have a mix of field experience
and on-the-job training that has been
difficult to replicate in academic
settings
the lack of academic options across all
geographies has also limited the growth
of specialists in this field
at our last count there were only five
colleges that provided classes
not degrees but just classes even in ics
security
from a market perspective there are
several other drivers of increased
demand in lagging supply of skilled
staff
including increased regulation including
the probable use of compliance-driven
cybersecurity investments in the coming
years
workforce changes including retirements
new market
entrants including deeper ot cyber focus
from large consulting companies
and of course a growing number of
connected devices in the ot network
in the next slide we will discuss the
typical skills found in the successful
ot cyber defenders and look at the
ecosystem needed to support the
development of the next generation of
cyber defenders
so let's take a look at this through an
ecosystem and skills based view
traditionally ot cyber security experts
have had a mix of industrial knowledge
relevant to the physical systems they
are defending and cyber security
knowledge especially of the ot networks
they are responsible to protect
individuals with this experience have
also typically gained on-the-job
experience and received mentorship from
the resident experts within their
organizations
some have also gained outside academic
training or attended boot camps
focused on industrial cyber security
topics and instant response
in order to truly scale up the ability
for the industry and governments to
respond to cyber threats
a new approach is needed one that brings
structure to training pathways
and accelerates the development of a new
group of industrial cyber defenders
the gradual development of expertise
over a decade is simply
too long to develop and sustain a stable
ot cybersecurity talent and workforce
pipeline
for the industry instead the successful
approach would include the development
of a program that considers the needs of
various stakeholders
invested in industrial cybersecurity to
better understand
the complex mix of needs in this
ecosystem let's take a look at the
the image on the right there are a few
key groups including diverse talent
academia government and industry
first off let's talk about the talent
themselves so diverse talent pool
really needs to to join have a program
that they can join with friends
something that they can join as a cohort
it's more fun to join something with
your friends and it becomes more of a
team sport
also individuals that go into these
programs they want job relevant
education they don't want to take
classes that they don't need
and they want to be able to use what
they learn they also want
post training placement so they're
looking for a job
after the rotation program or after
their education in this type of program
and finally no one wants a boring job so
we're look
companies that are hiring apprentices or
working through this type of model
will need to develop programs that
really fulfill the needs of an exciting
role
mentorship and allowing individuals to
learn on the
on the job for academia
many colleges and universities are
looking for assurance that academic
programs they develop are going to be in
demand and that that demand will be
sustained
to produce graduates that are attractive
to employers
and also they would like to make sure
that they avoid expensive investment
and difficult internal politics
but they'd also like to develop academic
partners also want to develop close
relationships with the employers that
they're working with
from the industry view it's all about
low turnover
having employees with relevant and
cross-trained skills
for organizational resilience and
employees with a mix of technical
and communication skills so soft skills
are absolutely relevant
even in these ot cyber defender roles
additionally industry is looking for a
diverse talent to be able to fill these
roles and actively respond to
the threats from cyber attackers
and finally employers want individuals
that want to grow with the organization
from the government view there are a
couple factors that need to be taken
into account as well
governments are looking for a
competitive workforce they want secure
infrastructure
and they want to develop high skill high
pay tax base
while growing the economy in the next
slide we'll talk about a framework based
on the apprenticeship model that
considers the ecosystem needs
while also developing a structured and
accelerated approach to attracting
developing and retaining an industrial
cybersecurity workforce
so putting together the needs of various
ecosystem stakeholders
we feel that an apprenticeship model is
one of the best ways to develop
in the industrial cybersecurity
workforce of the future
a well-designed program provides
opportunity for participants to learn in
the classroom
as well as from their employers mentors
and community
when designing this framework we first
looked at the needs for in-class
training
what we found is that the ideal program
combines a mix of mechanical
electrical and computer engineering with
a heaping dose of cyber security topics
the specific make of the program should
mirror or provide flexibility to align
the learning outcomes to the specific
types of systems
that the participant is likely to
encounter in their day job
anyone that has undertaken a project
like this in the past will know that
designing an academic program like this
is hard and challenges can arise from
getting different departments such as
engineering and computer science
to talk to each other among other issues
a basic understanding of ics ot
industrial cyber security can be
delivered as part of a two-year academic
program
stretched over four years as part of the
apprenticeship program
education is paid for by the employer in
this model
next let's look at the on-the-job
training part of the program
participants in an apprenticeship
program enjoy the opportunity to learn a
program
to earn a progressive paycheck that
grows as they learn through the duration
of the program
typically on-the-job training provided
through an apprenticeship program
includes access to a mentor
and rotations through three to four
roles for industrial cyber security and
here at siemens
we recommend the first rotation to
include industrial control system
installation
upgrade experience followed by back
office rotations and analysis
threat intelligence parsing and threat
hunting
apprenticeship programs should also have
defined milestones along the way
this could include the completion of
certain training activities
skills trained and practiced and
measured or rotations completed
there is a lot of opportunity to gamify
the process as well
with challenge coins or anything else
as with many targets they should be
specific measurable
attainable and realistic the time boxing
is
is up to you in your design finally the
apprenticeship program should focus on
building up a community and culture
apprentices are employees from the start
and should be included in the team
part of team activities and supported by
the group in general
while learning and beyond community and
culture are also important to make sure
that apprentices are learning a shared
vocabulary
working from similar playbooks and
ultimately able to work as a team to
respond to cyber threats
this includes getting familiarity with
the organization's
policies procedures and guidelines and
being well trained on these
ahead of the end of their rotational
program in the next section we'll cover
some of the benefits of apprenticeships
and walk through some of the outcomes
from similar programs in the past
so why should employers choose an
apprenticeship model versus any other
workforce development model well
research shows that for every dollar
invested no other workforce training
method is as impactful as apprenticeship
applying this model to cyber security
allows companies to leverage a proven
model with decades of success in
professions
like carpentry employers can build a new
talent pool
by tapping into diverse networks of
early career professionals
as well as career switchers and once
this talent pool is built
oppress apprentices are also much more
likely to stay with the company
versus new hires off the street
apprentices develop a deep understanding
of the company through rotation
and mentorship and their retention rate
is over
90 percent one year after graduation
additionally according to many case
studies apprentices
also have a higher productivity and
capacity
than new hires though creating an entire
program from scratch
could seem daunting for any company a
consortium apprenticeship model
where multiple companies can band
together to pool demand
would allow for shared costs on things
like program design
training equipment as well as hiring
outreach
overall the investment is well worth it
without a stable pipeline of cyber
experts to fill the rising number
of open cyber positions companies are
not going to be able
to grow and to meet rising demand
speaking of funding on the next slide
i'll get into some funding opportunities
that are available to companies
many states already have incentives in
place to help companies stand up
apprenticeship programs
things like tuition reimbursement may be
available for a portion of tuition
as well as various state and federal tax
incentives
additionally when it comes to justifying
the investment internally
statistics show that the return on
investment for every one dollar
spent on any on an apprentice is nearly
a dollar forty six
this is more than any other workforce
training program
the internal rate of return versus a
direct hire
is nearly eight percent higher the
initial investment in
education and on-the-job training pays
off
as i mentioned previously in retention
so even after three years
not just one but three years after
graduation nearly 90
of apprentices are still with the hiring
company
so what's next if you're looking to put
together an apprenticeship
program
we can move to the thanks so we believe
that the whole industry benefits from
building up
the ics ot cyber talent pipeline as we
know
many of these job positions are just
sitting open right now
therefore we're opening this program up
and looking to share best practices with
other ics and ot cyber companies
if you're interested in learning more
please feel free
to contact either john or myself for
more information
looking forward to continuing the
conversation with all of you
thanks for coming to our session thank
you