CompTIA powered Cybersecurity Apprenticeships

Supercharging the workforce with CompTIA powered
Apprenticeships

Copyright (c) 2018 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org
Zeshan Sattar
From Cybernetics to Cybersecurity
2
2004
• BSc Cybernetics & Virtual Worlds
• IT Support Tech, UK & Japan
2007
• Systems Administrator
• Technical Trainer, Europe
2013
• IT Expert Consultant, Worldwide
• Head of Curriculum
2015
• CompTIA Evangelist
• DCMS, NCSC, IFA, DFE

The Voice of the World’s IT Industry and over 2 million IT Professionals
 Higher Salaries
 Growing Demand
 Verified Strengths
 Universal Skills
“Three of the ‘Top 10
Certifications That Help IT
Workers Get Jobs’ are CompTIA
certifications.”*
CERTIFICATIONS
Largest Provider of Vendor-
Neutral IT Certifications
A non-profit trade association with
more than 7,000 members and
business partners. Our members
drive our programs through their
participation in CompTIA
communities, research studies,
events, sharing of best practices and
more.
ASSOCIATION
7000+ IT Channel
Providers & Partners
A 501(c)(3) charitable organization
that creates on-ramps for successful
IT careers, serving individuals who
are underrepresented in IT and
lacking in opportunities to be
successful in IT, including veterans,
youth, and the unemployed.
PHILANTHROPY
Creating IT Futures
Our advocacy division encourages
collaboration and advancing of
legislation that allows the private
sector to develop new products and
services, find solutions and sell
them in the global marketplace.
ADVOCACY
Public Policy & Reform
* Source: The Dice Report, February 2012

Copyright (c) 2018 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 4
Supporting 7,500+
premium members
worldwide
Partnering with 3,500+
schools and ICT training
groups worldwide
Certifying ICT
professionals in 150+
countries
2 Million+
Certified Professionals
A d v a n c i n g t h e G l o b a l I T I n d u s t r y f o r 3 0 + Ye a r s

Worldwide Leading Provider of
Vendor-Neutral IT Certifications
5
Created by Industry for Industry
 Relevant
 Regularly updated
 Internationally Recognised
Job Role Led
 Span entry level roles – to help entrants to the
their first job – through to more advanced roles
Vendor Neutral / Inclusive
 Independent of any particular technology,
product or platform
 Reflect the diverse technologies deployed in
today’s organisation

Cybersecurity Skills: From Entry to Expert

Percentage of CompTIA certifications objectives
covering cybersecurity skills
Certification Percentage
100%
100%
100%
30%
Certification Percentage
28%
37%
33%
20%
7

CompTIA Security+ is the global benchmark for best practices in IT security.
Over half a million Security+ certified professionals worldwide

6 Skills Learnt with CompTIA Security+ (SY0-501)
# 2 T E C H N O LO G I E S
& TO O L S
# 1 T H R E AT S
# 5 I D E N T I T Y
& A C C E S S # 6 C RY P TO G R A P H Y
# 3 A R C H I T E C T U R E
& D E S I G N
# 4 R I S K
M A N A G E M E N T

THE NEED FOR
CYBER SECURITY INTRUSION
ANALYSTS
10

Wake up calls for the IT security world

Disturbing trends
13
But the attacks are getting worse:
 Automation
 Scalable
 On an “as a service” basis – hackers
are now on a “pay to play” basis
 No longer need to be a security expert to wage attacks
IT security costs increasing
 How do security professionals
justify expenses?
 Hardware and software
solutions
 Training – end users and
security professionals

Technology changes
14
COMPLEXITY OF
PRIVACY
INCIDENT
RESPONSE
DISSOLVING
PERIMETER
EVOLVING
ENDPOINT
(IoT)
ENCRYPTED
TRAFFIC
VISIBILITY
SECURITY
POSTURE
NEW
SECURITY
CONTROL
ADOPTION
SECURITY
POSTURE

Security trends
• Notice the “unknown” category
• Ransomware
• Social engineering
• Zero-day attacks
• Browser infections
• JavaScript
• Adobe / active content
• POS – still a problem
• DNS – again?!!
• Web-based attacks
• SSL/TLS
• SQL injection
• Malware
• Boot-based
• SCADA / industrial systems
• Mobile
• Botnet

Where attacks tend to occur
• The interstices: Where one technology connects with another – the “in
between” places
• Examples
– Where “meat space” and
“cyber space” converge
• That evil television . . . Or notebook . . .
Or phone
• Business E-mail Compromise
• Coding issues
• Physical access to a building
– Wireless access points
(unencrypting data on the device)
– SMS/mobile/ and Web technologies: Facebook
– SQL and Web servers (SQL injection)
– Domain Name Server (DNS) network

The Advanced Persistent Threat (APT)
18
 Long-term infiltration
– Requires significant reconnaissance
– Highly-skilled individuals
– Traditionally state-sponsored
– Not so much anymore
Planning
Malware
Introduction
Command
&
Control
Lateral
Movement
Target
Identification
Exfiltration
(Attack Event)
Retreat
 Cloud implementation issues
– Weak authentication
– End points
– Practical monitoring
– IP theft issues
– Covert
channels

Ransomware and BEC/BPC
19

Hacking as a Service (HaaS)

Just outsource for your hacking needs:
– No need to even be
technical
– Physical attacks
– Warehousing stolen data
and criminal data
– Hacktivism
– Attacks originate
from inside and
outside the company

DDoS attacks
22
Not just for script
kiddies anymore
 Hacktivism
 Misdirection
Managing DDoS
 Network resilience
 Traffic patterns
 Attack traffic
 Control
 How do you manage the “hits”

A case in point – IoT: What it should be
1. Development of the IoT device
• Firmware / storage
• Connectivity
2. Network creation – making it work
• Smart cities
• Marketing
3. Maintenance – keeping it working
4. Data analytics
• Crunching numbers
• Identifying trends
• Determining product/service
placement
• Product features
• New data streams
Considerations: Speed to market, ease of communication,
ability to monetize.

What IoT looked like in October 2016
• The Dyn attack heat map
• Just an example of what can – and will – happen worldwide
The question:
What was the
real objective of
this attack?

Another heat map
• This is a map of the Wannacry attack
• 13 May 2017

What if…

A conundrum
 More resources are being directed
at security than ever before
 Yet, attacks are on the increase
 They’re also getting more severe
 Why is this happening?
 What approaches will help reverse this trend?
 Moving beyond signature-based approaches is the
answer
According to the Ponemon
Institute, over the last five
years, 2,800 publicly disclosed
data breaches occurred to the
tune of roughly $139 billion.
Gartner: Over $75
billion spent in 2015
alone. Over $300
billion lost.

Lessons learned
28
Apply behavioral analytics – known
as User Behavior Analytics and
Network Behavior Analytics – to
security workers.
 We must focus on network behavior in
an organization’s interior network
 We must identify network anomalies
that indicate bad behavior
 Also, user-based anomalies
We must train IT security
professionals security analyst skills,
which include:
 Threat modeling and management
 Vulnerability management
 Cyber incident response
 Security and architecture tool sets
 Anticipating ransomware

We asked over 2200 Security Analysts worldwide
about the skills needed…

Critical skills
User / entity behavior analytics
– Targeted attacks
– ”Hidden” threats
– Machine learning algorithms
Threat modeling
– Threat hunting
– Determining susceptibility
Configuring threat detection tools
– Monitoring systems
– Proper placement
– Security Information Events Manager (SIEM)
30
Interpreting results
– Correlation between systems
– Creating risk ratings
Applying big data techniques
– Visualisation of the right data
– Structured and unstructured data
– Finding trends
Creating solutions
– Best practice solutions
– Organising and coordinating
a response

Cyber Kill Chain
31
 Developed by Lockheed Martin
in 2010
 A borrowed military concept
 Potential to stop the bad activity at
any stage
 Large scale breaches take weeks or
even months to unfold
– Hence the powerful nature of using
the Kill Chain approach as opposed
to the Security Onion

Total number of job postings
Security Analyst job role
32
39,920
48,947
58,456
109,819
10,000
30,000
50,000
70,000
90,000
110,000
130,000
2012 2013 2014 2015
Information Security Analysts
Source: Burning Glass Technologies Labor Insights, January 2016
175% increase
from 2012 to
2015
Figure not just US data
– trend is worldwide

The Result
CompTIA Cybersecurity Analyst (CySA+)
Developed to address the need for IT Security Analysts.
As attackers have learned to evade traditional signature-based solutions, an analytics-
based approach has become extremely important. CSA+ applies behavioral analytics
to the IT security market to improve the overall state of security.

The search for Cybersecurity Talent
 Cybersecurity professionals combine broad
technical skills with specific security
expertise and an understanding of business
risk
 Currently 1 Million unfilled Cybersecurity
jobs worldwide
 In 2019, this number is set to rise to 1.5
million
 UK has the third highest demand globally
for cybersecurity professionals
35

1. Emerging tech, i.e. IoT, AI, automation [59%]
Integrating different apps, data sources, platforms, devices [59%]
Cloud infrastructure / cloud apps [57%]
Digital business transformation / modernizing legacy HW or SW [57%]
Cybersecurity [55%]
Software or app development [55%]
Data management / data analytics [53%]
2.
3.
4.
5.
6.
7.
Top IT Skills Gap Areas
Source: CompTIA Assessing the IT Skills Gap | n=600 U.S. IT & business executives
Based on NET gaps (moderate gaps + significant gaps)
“Being able to integrate
new software quickly
enough, and having
efficient people to do so.”
-- Senior IT executive in
professional services
industry

1%
27%
29%
30%
40%
42%
42%
50%
57%
None of the above / other
Predictive analytics
Penetration testing / ethical hacking
Legal compliance / security policy development
and enforcement
Risk management / mitigation
Cloud security
Network monitoring / access management
Firewalls and antivirus
Data loss prevention / data security best practices
Cybersecurity Skills Gap Concerns / Priorities
A top concern for 42% of
firms reporting overall skills
gaps growing significantly
over the past 2 years
Source: CompTIA Assessing the IT Skills Gap | n=328 U.S. IT & business executives
reporting cybersecurity skill gaps

Areas of more
concern to IT
managers vs.
business managers

More of a concern for
business managers vs. IT
managers

National Cyber Security Centre (NCSC) initiatives…
 Long term strategy of 5 – 20 years
 Cyber Discovery Schools Programme
– Aimed at 14 – 18 year olds
 Cyber First Programme
– Aimed at 11 – 17 year olds
– Bursaries for students
 Supporting short term interventions e.g.
Certification-aligned training
 Apprenticeships
38

Upskilling and Reskilling the Workforce:
Cybersecurity Skills Pathway
39

CompTIA Security+ certified employees…
40
1 Are more confident
2 Are more knowledgeable
3 Reach job proficiency more quickly
4 Perform at a higher level
Source: IDC White Paper, sponsored by CompTIA, IT Support and Security Performance: The
Impact of CompTIA Certification on Organizational Performance, IDC #252603, December 2014
According to an IDC Report:

41
Training without Benchmarking

CySA+ Performance-Based Assessments
The CySA+ exam includes hands-on, performance-based simulations.
 To prepare for these performance-based assessments, trainers, educators and publishers
should emphasise open-source analytics tools and teamwork.
Recommended open source
software for training purposes*
Description URL
Wireshark Network protocol analyzer / packet
capture tool
https://www.wireshark.org
Bro and/or Snort Network intrusion detection
systems (NIDS)
https://www.bro.org
https://www.snort.org
AlienVault Open Source SIEM
(OSSIM) with Open Threat
Exchange (OTX)
Security Information and Event
Management (SIEM) software
https://www.alienvault.com/prod
ucts/ossim
Kali Linux Open Source Linux Distro used for
launching and protecting against
cybersecurity attacks
https://www.kali.org/

Certifications help to fill the Skills Gap
43
Certification
Sustainable Career

The Cyber Apprentice Experience
Application &
assessment
Pre-
Apprenticeship
Weeks 1-6: simple tasks,
progress reviews every
couple of hours
Months 1-4: simple
tasks, daily progress
review
Months 5-12: more complex tasks,
progress reviews twice a week
Months 12-18: like
a regular employee
START
APPRENTICESHIP
Months 18-24
Endpoint
Assessment
“A steep
development curve”
COMPLETE
APPRENTICESHIP
Confidence
Growth!

For more information contact:
Zeshan Sattar
Senior Manager, Certification Evangelist
Mobile: : +44 (0) 7817 617 975
CompTIA UK, 11th Floor, City Point, 1 Ropemaker Street, London, EC2Y 9HT
Email: zsattar@comptia.org
Twitter: @zeshandotcom
49

CompTIA powered Cybersecurity Apprenticeships

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie CompTIA powered Cybersecurity Apprenticeships

Ähnlich wie CompTIA powered Cybersecurity Apprenticeships (20)

Mehr von Zeshan Sattar

Mehr von Zeshan Sattar (14)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

CompTIA powered Cybersecurity Apprenticeships

Hinweis der Redaktion