Download to read offline
Cybersecurity Skilling at a Tipping Point.pdf
- 1. Cybersecurity Skilling at a TippingPoint Cybersecurity skill development, though slow and steady, has now reached a tipping point where current practices and systems must be reengineered to secure our future. December 02, 2024
- 2. Dinesh O Bareja CISA,CISM, ISO27001-LA, IRCA-LA, ITIL, • Founder & COO – Open Security Alliance; OSA Academy • IndiaWatch.in, Indian Honeynet Project • Advisor – Cyber Peace Foundation , DIAT • Ex Cyber Advisor – CDRC (Jharkhand Police) My work and interest areas in Cyber Security … Strategy & Design Education and Certification Government Policy Advocacy National Security & CII Protection GRC & Security Audits Training & Awareness Re-engineering & Support ABOUT ME
- 3. This presentation wasmade for a Faculty Development Program at one of the leading educational institutions in India. Name and reference to the institution has been redacted. If you need any information about this presentation please feel free to reach out to me / us using the contact information provided in the last slide.
- 4. It is thatcritical point in time when a system, behavior, or process reaches a threshold and begins to experience a significant or dramatic change, which may be irreversible. In the cybersecurity world, this tipping point has been present for a long time, and the risk continues to escalate towards a second, potentially irreversible, point of no return. Tipping Point
- 5. It is thatcritical point in time when a system, behavior, or process reaches a threshold and begins to experience a significant or dramatic change, which may be irreversible. This concept is used in various fields such as sociology, climatology, and economics to describe moments when minor events trigger larger, more dramatic changes. In the cybersecurity world, this tipping point has been present for a long time, and the risk continues to escalate towards a second, potentially irreversible, point of no return. Tipping Point In a world where technology is evolving at breakneck speed, the irreversible tipping point is not just a possibility—but an inevitability. Cyber threats continue to grow, becoming more sophisticated and relentless, calling for a response that must be proactive and unyielding, as the very foundation of our digital future hangs in the balance.
- 6.
- 7.
- 8. Sorry, Nothing Seems ToHave Changed !
- 9. We are ata cross-roads which is why I term this as the Tipping Point Our choices are few so lets select them wisely … and then… walk the talk
- 10. There are knownknowns there are things we know we know. We also know there are known unknowns; that is to say, we know there are some things we do not know. But there are also unknown unknowns— the ones we don't know we don't know.
- 11. The Cybersecurity Imperative •Growing Cyber Threats in a Digital-First World • Businesses, governments, and individuals increasingly rely on digital platforms, and as a result cyber threats are becoming more frequent and sophisticated. • Global cybercrime costs are expected to reach $10.5 trillion annually by 2025, up from $3 trillion in 2015 (Cybersecurity Ventures). • The Critical Role of Educators in Addressing the Skills Gap • Educators have the responsibility to nurture a cybersecurity workforce capable of addressing current and future challenges. • There is a global shortage of 3.4 million cybersecurity professionals (2023). • Need for a Robust Framework for Skill Development • The current fragmented approach to cybersecurity education is inadequate and needs serious rethink and redesign to enhance learning outcomes.
- 12. Current State ofCybersecurity Skill Development (Insufficient) Alignment with Real- World Challenges • Many programs focus on theoretical knowledge, neglecting practical, hands-on skills necessary for addressing real-world cyber threats. • The World Economic Forum (2022) reported that 45% of organizations believe their cybersecurity training is not aligned with industry needs, leaving graduates underprepared. (Fragmented) Curriculum Across Institutions • Cybersecurity courses and programs vary widely, leading to inconsistencies in the knowledge and skills imparted. • With multiple certification providers (e.g., CompTIA, CISSP, CEH), there’s no universal standard, leading to confusion among learners and employers about the skills and competencies required. • Lack of an Indian standard or certification of value. (Slow) Growth of Training Resources and Skilled Educators • Despite increasing demand, the development of cybersecurity training programs and qualified instructors has not kept pace. • A study by Burning Glass Technologies revealed that cybersecurity jobs take 21% longer to fill compared to other IT jobs, largely due to the lack of skilled candidates.
- 13. Current State ofCybersecurity Skill Development Number of Engineering Institutes = 8876 (2023) (https://www.jagranjosh.com/colleges/how-many-total-engineering-colleges-in-india-clga-1725281255-1) (2024) Approx 700+ institutes offering cybersecurity programs. Around 400+ are private institutions, 80+ are government-owned, and 7 are semi- government owned (https://www.shiksha.com/it-software/networking-hardware- security/colleges/cyber-security-colleges-india). Postgraduate programs, there are about 62 colleges offering M.Sc in Cybersecurity (https://collegedunia.com/msc/cyber-security-colleges) 29 institutes offering PGD (Postgraduate Diploma) in Cybersecurity (https://www.collegedekho.com/pgd-cyber_security-colleges-in-india/).
- 14. Why Change isNeeded.. Increasing Frequency and Sophistication of Cyberattack • Cyberattacks are not only becoming more frequent but also more complex, targeting critical infrastructure, businesses, and individuals. Growing Demand for Skilled Cybersecurity Professionals • The shortage of cybersecurity professionals is widening, leaving organizations vulnerable. Impact on National Security and Economic Stability • A lack of skilled professionals poses significant risks to national security, critical infrastructure, and economic growth. Speed of Technology Change • The advancements in technology make it difficult to keep up with the speed of change and it the threat surface becomes vulnerable.
- 15.
- 16.
- 17. Training and Education Thisis happening … • Ethical Hacking • Network Security • Application Security • Access Controls (IAM, SSO etc) • Asset Management • Physical Security • Cryptography • Data Analytics • AI … etc This is what needs to be added • Weaponisation of • Misinformation • Deepfakes • Biohacking • Bio-engineering • Cybersecurity in thought process • Threat Modelling • Prompt Engineering • Incident Response
- 18. Upcoming Trends WhichEveryone Talks About AI-Driven Cyberattacks and Defense Artificial intelligence (AI) is being leveraged by both attackers and defenders, with AI-powered malware and autonomous threat detection becoming prominent. Quantum Computing’s Disruption to Cryptography Quantum computing has the potential to break widely-used encryption methods, posing a major threat to secure communications. Proliferation of IoT Devices, Drones (UAV) and Security Risks The rapid growth of IoT devices, projected to exceed 75 billion by 2025, increases the attack surface for cybercriminals. Evolving Privacy Regulations and Compliance Needs As governments enact stricter data privacy laws (e.g., DPDP, GDPR, CCPA), organizations must adapt to ensure compliance while protecting sensitive data.
- 19.
- 20. Collaboration Between Industry and Academia Strategiesfor Developing Cybersecurity Professionals Hands-On Training and Real-World Simulations Incorporation of Interdisciplinary Learning Focus on Soft Skills Development Early Cybersecurity Education Integration Upskilling and Reskilling Initiatives for Current Professionals Dynamic Redesigned Syllabus Best practices & Standards to Design Learning
- 21. Undergraduate (UG) Coursesin Cybersecurity • Core Concepts of Cybersecurity • Cybersecurity fundamentals • Threats, vulnerabilities, and risk assessment • Information security principles (confidentiality, integrity, availability) • Networks and System Security • Networking basics (protocols, OSI model) • Firewalls and intrusion detection/prevention systems (IDS/IPS) • Secure system architecture • Operating System and Application Security • Security features in Windows, Linux, and macOS • Hardening operating systems • Secure application development basics • Cryptography • Symmetric and asymmetric encryption • Hashing algorithms and digital signatures • Applications of cryptography • Ethical Hacking and Penetration Testing • Basics of ethical hacking • Tools like Metasploit and Wireshark • Penetration testing methodologies • Web and Application Security • Common vulnerabilities (e.g., OWASP Top 10) • Secure coding practices • Security for web and mobile applications • Cybercrime and Digital Forensics • Basics of cyber laws and regulations • Forensic tools and techniques • Chain of custody and evidence handling • Cybersecurity Tools and Technologies • Antivirus, SIEM systems, and endpoint protection • Vulnerability scanners (e.g., Nessus) • Network monitoring tools • Practical Lab Work • Hands-on exercises in sandboxed environments • Simulated attacks and defenses Postgraduate (PG) Courses in Cybersecurity • Advanced Cybersecurity Concepts • Advanced threat intelligence • Incident response and management • Zero trust architecture • Advanced Cryptography • Blockchain and cryptographic applications • Quantum-resistant cryptography • PKI and certificate management • Advanced Network Security • Software-Defined Networking (SDN) security • Cloud security principles (AWS, Azure, GCP) • IoT and 5G security • Advanced Ethical Hacking and Penetration Testing • Red teaming exercises • Advanced exploitation techniques • Social engineering and phishing attack simulations • Machine Learning and AI in Cybersecurity • AI for threat detection • Behavioral analytics • Deep learning applications in cybersecurity • Cybersecurity Governance, Risk, and Compliance • ISO 27001, NIST, GDPR, PCI DSS • Risk assessment and management frameworks • Auditing and compliance programs • Digital Forensics and Incident Response (DFIR) • Advanced forensic techniques • Malware analysis and reverse engineering • Memory forensics • Specialized Domains • OT and SCADA security • Healthcare cybersecurity (HIPAA) • Financial sector security (PCI DSS, SWIFT)
- 23. Upcoming and happening which noone talks about
- 24. The Need Is ToLook Beyond The Six Million Dollar man (1970) Body Implants Bio Magnetic implants
- 29. Transhumans Grinders See inthe dark... Human based implant attacks
- 30. Exoskeleton It is therigid covering found on the exterior of many animals, particularly invertebrates such as arthropods and mollusks. Several uses for exoskeletons, including: • Increasing strength and productivity. • Reducing fatigue. • Minimizing injury. • Providing support. • Returning function (in the case of paralysis or injury).
- 31. Exoskeleton, Grinders, Transhumans •Exoskeleton Suits: 26 Real-Life Examples | Built In • 4 Biohacking Tricks to Turn Yourself Into a Transhuman Superhero • https://www.wareable.com/wearable-tech/meet-the-grinders- implantables • Meet Len: The Offensive Hacker With 10 Microchips Implanted In His Body https://news.stanford.edu/stories/2022/10/exoskeleton-makes-walking-faster- less-tiring
- 32. A Critical Function Whilerecognized as a critical activity research is an add-on and may not be a primary function at educational institutions. Reason: Our concept of “research” conditioned by traditional mindset where we need output for journals, patents etc Reason: it needs a lot of equipment and money! Break these myths and engage in research.
- 33. - Study ofglobal cybersecurity standards to enhance Indian - Risk Assessment and management framework - Mapping modus operandi of global cyberattacks to threat models and applying to Indian scenarios - Develop gamification models for cyber drills and training - National cybersecurity framework and organization structure - Cybersecurity skill/knowledge assessment and programs based on NICE framework - Adoption of NICE framework to Indian environment for development of a standard education / training program Research Can Be Simple – Breaking The Myth
- 34.