RiskXtraSeptember2018

x
RISKXtra
‘What makes the
modern security
professional?’ As Tony
O’Brien observes, the
right combination of a
security mindset, hard
and soft skills,
technical ability, selfawareness
and
adaptability is almost
impossible to define.
Today, and
increasingly so, it’s all
about an individual
who’s every bit as
comfortable in the
cyber world as they
are in the physical
space and who readily
understands the
connectivity (and
indeed, the
interdependency) of
both realms
Creating The Security
Professional of The Future
As converged security services develop at a
rapid pace, finding people with this
diverse skill set is proving to be somewhat
challenging for many reasons. There’s a
requirement, then, to talk about building these
professionals from the ground up and assess
what we can do now to prevent the rest of the
industry from becoming the next dinosaurs.
When I think of the pace at which the world is
evolving and developing, it both amazes and
worries me. If we consider that, just ten years
ago, many of the platforms we now use on a
daily basis didn’t even exist, and that in five
years’ time they’ll likely be obsolete, this
illustrates precisely how quickly the world – not
to mention ourselves as its inhabitants – can
evolve. It also illustrates how those who are not
willing to adapt and develop can be left behind
in the wake of evolution.
The security industry isn’t immune to this
risk, and particularly so in the area of cyber
security. I would estimate (both anecdotally
and from the new entrants I see coming
through the doors) that 90% of the physical
security industry is well below a basic level of
understanding in areas of cyber security, cyber
crime and information security. To change this
situation could take a generation. However,
given the pace at which these areas are
evolving, our current security population could
be seen as obsolete long before that time.
As someone who teaches in this industry
both at entry level and higher up, I will be the
first to admit that the current training system
will not be fit for purpose in even two-to-three
years. It’s barely plugging the gap now. We
have large skills gaps in the cyber security area
and a large pool of under-trained physical
security operatives. This system, I believe, is
the very root of the problem.
Typically, we still treat the two areas as
completely separate roles when they’re not. Of
course, at higher levels the technical skills
involved will differ, but as converged services
become a reality, every single security operative
needs to be at least familiar with both
information and cyber security basics.
The problem I see daily is that professionals
operating in the physical security industry still
perceive that cyber security isn’t their job.
There’s a real fear of the subject. It’s the fear of
the unknown and the fear of new challenges
that terrifies the physical security industry and
those resident within. What we’re left with is a
group of security specialists who know a lot
about crime prevention and the essence of
what a crime looks like in their field.
We also have a cyber security industry
predominantly made up of IT specialists who
know lots about the cyber world, but not a
great deal when it comes to how criminals think
and act, or indeed about the knock-on physical
consequences of cyber security.
Why can’t we determine to build security
operatives with a skill set in both?
This issue then escalates at the security
management level, where we have people
promoted from within the physical security
ranks or recruited from policing and military
backgrounds. They possess high levels of
physical security knowledge, but no idea about
cyber or information crime. Upskilling these
individuals (of which I count myself as being
one) is both challenging and time-consuming.
Ultimately, the pace of skills development is
always going to struggle to keep up with the
pace of change.
Pathways for transition
Currently, there are very few pathways whereby
physical security professionals can transition to
cyber security and even fewer pathways in the
opposite direction. There are some, but they
52