What It Takes to Become a Cyber Expert

I submit that anyone who says they are a “cyber expert,” isn’t.

Sadly, I’ve noted an ever-increasing number of folks who market themselves as cyber experts to audiences hungry for revelations on what they can do to solve every cybersecurity issue yet, as I review these so-called “cyber experts’” credentials and experiences, I’m left shaking my head in disbelief. Many of these so-called “cyber experts” do not have hands-on experience in core cyber skills, do not have any acknowledged industry certifications or credentials beside their own attestations, nor have even led organizations that operate significant information technology enterprises. While many are imposters or hucksters, others are legitimate highly skilled practitioners of one of the many cyber skill sets but certainly do not have deep experience across the many disciplines required to operate an effective cybersecurity program. Perhaps you too have encountered such self-proclaimed “experts” and are left wondering why they should be considered a cyber expert.

Given my bold declaration that nobody truly can be a cyber expert, what should those who aspire to be a cyber expert do to get closer to their objective?

First, I recommend you get hands-on experience in core cyber skills. You can’t be a pilot without actually flying a plane and I believe the same goes for core cyber skills. How can you become a cyber expert if you do not know how to code or operate a network? If you do not have experience in core cyber skills, consider taking some courses from your local community college or university so that you have not only an understanding but also experience first-hand what it takes to effectively execute those critical cyber tasks. Remember, just because you took one course, doesn’t make you an expert. It takes years of experience. Nevertheless, education and training courses are a great first step in building experience.

Secondly, don’t rest on your laurels. Declaring victory because you have completed a course of study or demonstrated mastery of a task doesn’t mean that you stay current in today’s ever-evolving cyber domain. Continuous professional education is a must for cyber professionals as it is in other professional fields. My friends in the medical and accounting professions are proud of the fact that they are required to maintain continuous professional education in order to maintain their board-certified credentials. We cyber professionals ought to embrace the same commitment to continuous professional education.

Third, earn and maintain the professional cyber credentials required for your position. If I am looking to hire someone to lead my software development team and I want my software secure-by-design, I’m including a Certified Secure Software Lifecycle Professional (CSSLP) certification to the qualifications. Similarly, if I am hiring in the health care sector, I want someone who maintains the HealthCare Information Security and Privacy Practitioner (HCISPP) certification. Moreover, as a supervisor, I budget for the time and expense required for my workforce to maintain their currency through continuous professional education. Not only is that an attractive recruiting and retention tool for my workforce, but also for my clients.

Fourth, if you are in a supervisory or leadership position, identify and incorporate into your position descriptions what cyber certifications and tasks are expected for each position. Not every position requires a cyber certification such as the CISSP yet in today’s contemporary business environment every position requires some cyber skills. Make the time to identify what cyber skills and capabilities you need the employees in each position to master and train to the tasks.

Fifth, continuously exercise your cyber skills. Leaders at all levels should commit themselves and their teams to continuously practice their cyber skills. One-and-done annual training is insufficient in today’s hotly-contested cyber environment. Incorporate cyber exercises and drills as a mechanism to keep your workforce cyber-ready while protecting your information, brand, and reputation.

Finally, recognize that the job you’ll have in 10 years likely hasn’t been invented yet (and you actually may be the one who will invent it). Strive to acquire knowledge and skills beyond those required for your current duties. Seek to learn how things work and why. Do your homework to understand not only the newest technology but also how to apply it for positive effect. Ask for help and seek mentors. Continuously test yourself, your technology, and your processes to discover flaws or weaknesses as well as effective compensating controls.

In today’s environment of accelerating change, I believe those who declare themselves to be cyber experts exhibit a lack of awareness consistent with the Dunning-Kruger effect. (Note: Look it up! Most cyber professionals probably haven’t heard of this yet likely have seen it in action.) Benjamin Franklin said, “The doorstep to the temple of wisdom is a knowledge of our own ignorance.” I’ll bet if old Ben was sitting at the keyboard today, he’d be working on his CPEs and advising you to do the same.

Brig. Gen. (retired) Greg Touhill, CISSP, CISM, is the president of Cyxtera Federal Group, former federal chief information security officer, and guest author for the (ISC)² U.S. Government Advisory Council Executive Writers Bureau.