A Human Capital Crisis In Cybersecurity

Evidence continues to build showing our information infrastructure is vulnerable to threats not just from nation states but also from individuals and small groups who seek to do us harm or who wish to exploit our weaknesses for personal gain. A critical element of a robust cybersecurity strategy is having the right people at every level to identify, build and staff the defenses and responses. And that is, by many accounts, the area where we are the weakest.

Evidence continues to build showing our information infrastructure is vulnerable to threats not just from nation states but also from individuals and small groups who seek to do us harm or who wish to exploit our weaknesses for personal gain. A critical element of a robust cybersecurity strategy is having the right people at every level to identify, build and staff the defenses and responses. And that is, by many accounts, the area where we are the weakest.

The national security implications of the human capital crisis : joint hearing before the Oversight of Government Management, Restructuring, and the District of Columbia Subcommittee of the Committee on Governmental Affairs, United States Senate and the Subcommittee on Civil Service and Agency Organization of the Committee on Government Reform, House of Representatives, One Hundred Seventh C

Joint Hearing held by the Senate and House of Representatives to examine how the human capital crisis in the Federal Government is affecting, and indeed endangering, the national security establishment and the ability of the Federal Government to defend our Nation and its interests around the world. This is especially true with the civilian workforce of the Dept. of Defense (DoD). Witnesses: James R. Schlesinger, Commissioner, accompanied by Admiral Harry D. Train, USN, Ret., Commissioner, on behalf of the U.S. Commission on National Security/21st Century; Henry L. Hinton, Jr., Managing Dir., Defense Capabilities and Management, General Accounting Office (GAO); and Robert J. Lieberman, Deputy Inspector General, DoD.

President Bush's number-one management initiative for the federal government is the Strategic Management of Human Capital. According to Knowledgeworkers.com, human capital is the accumulated value of an individual's intellect, knowledge, and experience. In the U.S. federal government, a human capital crisis exists. The factors contributing to a human capital dilemma include a knowledge bleed due to retirement eligibility, changing perspectives on work, and escalating knowledge loss. According to a Joint Hearing on the Federal Human Capital, by 2005, more than half of the 1.8 million non-postal civilian employees will be eligible for early or regular retirement. An even greater percentage of the Senior Executive Service, the government's core managers, will be eligible to leave. All government agencies are required to develop a human capital strategy by 2005. Many of these agencies have scored a "red" (lowest rating) on the Government Scorecard in the way they are approaching their strategic management of human capital. This book is an executive briefing on developing a successful human capital strategy based on lessons learned from analyzing existing strategies at government agencies such as NASA. Using a knowledge management perspective, Liebowitz identifies four pillars of an effective strategy and gives examples of these in practice.

GAO-12-8. Threats to federal information technology (IT) infrastructure and systems continue to grow in number and sophistication. The ability to make federal IT infrastructure and systems secure depends on the knowledge, skills, and abilities of the federal and contractor workforce that implements and maintains these systems. In light of the importance of recruiting and retaining cybersecurity personnel, GAO was asked to assess (1) the extent to which federal agencies have implemented and established workforce planning practices for cybersecurity personnel and (2) the status of and plans for governmentwide cybersecurity workforce initiatives. GAO evaluated eight federal agencies with the highest IT budgets to determine their use of workforce planning practices for cybersecurity staff by analyzing plans, performance measures, and other information. GAO also reviewed plans and programs at agencies with responsibility for governmentwide cybersecurity workforce initiatives. Federal agencies have taken varied steps to implement workforce planning practices for cybersecurity personnel. Five of eight agencies, including the largest, the Department of Defense, have established cybersecurity workforce plans or other agencywide activities addressing cybersecurity workforce planning. However, all of the agencies GAO reviewed faced challenges determining the size of their cybersecurity workforce because of variations in how work is defined and the lack of an occupational series specific to cybersecurity. With respect to other workforce planning practices, all agencies had defined roles and responsibilities for their cybersecurity workforce, but these roles did not always align with guidelines issued by the federal Chief Information Officers Council and National Institute of Standards and Technology (NIST). Agencies reported challenges in filling highly technical positions, challenges due to the length and complexity of the federal hiring process, and discrepancies in compensation across agencies. Although most agencies used some form of incentives to support their cybersecurity workforce, none of the eight agencies had metrics to measure the effectiveness of these incentives. Finally, the robustness and availability of cybersecurity training and development programs varied significantly among the agencies. For example, the Departments of Commerce and Defense required cybersecurity personnel to obtain certifications and fulfill continuing education requirements. Other agencies used an informal or ad hoc approach to identifying required training. The federal government has begun several governmentwide initiatives to enhance the federal cybersecurity workforce. The National Initiative for Cybersecurity Education, coordinated by NIST, includes activities to examine and more clearly define the federal cybersecurity workforce structure and roles and responsibilities, and to improve cybersecurity workforce training. However, the initiative lacks plans defining tasks and milestones to achieve its objectives, a clear list of agency activities that are part of the initiative, and a means to measure the progress of each activity. The Chief Information Officers Council, NIST, Office of Personnel Management, and the Department of Homeland Security (DHS) have also taken steps to define skills, competencies, roles, and responsibilities for the federal cybersecurity workforce. However, these efforts overlap and are potentially duplicative, although officials from these agencies reported beginning to take steps to coordinate activities. Furthermore, there is no plan to promote use of the outcomes of these efforts by individual agencies. ~

The perceived shortage of cybersecurity professionals working on national security may endanger the nation’s networks and be a disadvantage in cyberspace conflict. RAND examined the cybersecurity labor market, especially in regard to national defense. Analysis suggests market forces and government programs will draw more workers into the profession in time, and steps taken today would not bear fruit for another five to ten years.

Cybersecurity Human Capital: Initiatives Need Better Planning and Coordination