Cybersecurity experts admit that the lack of knowledge leads to certain mistakes in the workplace

Since human errors have caused nearly two-thirds of all cyber incidents in the past two years, over 50% of cybersecurity professionals admit to having made mistakes early in their careers due to a lack of theoretical or practical knowledge, according to the latest global study commissioned by Kaspersky. The percentage of respondents admitting such mistakes rises to nearly 60% among those with two to five years of experience in the field.

According to a recent study by Kaspersky over the past two years, organizations have suffered at least one cyber incident due to a lack of qualified cybersecurity personnel. While hiring more qualified cybersecurity personnel could be one of the suitable solutions to address this problem, companies worldwide are facing a serious shortage of information security (InfoSec) professionals. Current estimates place the cybersecurity workforce shortage at nearly 4 million.

The overall deficiencies in cybersecurity skills are accompanied by the fact that many industry newcomers must cope with gaps in practical and theoretical knowledge, which initially leads to problems and mistakes at work. Failing to update software (43%), using weak or easily guessable passwords (42%), and not making timely backups (40%) were among the most common mistakes made by InfoSec professionals worldwide early in their careers. In APAC and North America, the use of outdated security measures was also a common mistake made by cybersecurity experts at the beginning of their careers.

As cybersecurity professionals acknowledge, they may not have had the necessary skill set and practical experience when they entered the field, and then they have to face additional difficulties. Despite the continuous reporting of a workforce shortage in the cybersecurity industry, 34% of respondents claim to have had three or more failed interviews before being selected for an InfoSec role.

The initial challenges faced by cybersecurity experts when entering the industry might explain why nearly half (46%) say it took them more than a year to feel comfortable in their first cybersecurity roles. While 31% of respondents managed to feel comfortable with the job within one to two years, less than 10% of respondents said the process took them two to three years (9%) and more than three years (6%).

The full report and more information about the educational background of cybersecurity experts and the initial challenges they faced in their careers are available here.

To address the lack of knowledge and ensure an easier integration of the cybersecurity workforce into workflows, Kaspersky recommends a series of both preventive and reactive measures:

1. At the educational level, training programs should be updated and become more flexible and agile, which can be achieved through collaboration with industry actors and experts. Kaspersky contributes to this process by running a special program for universities – Kaspersky Academy Alliance – which integrates cybersecurity expertise, providing program participants with access to lectures and training sessions, as well as the latest technologies.

2. Those who intend to join the cybersecurity field can gain experience in managing real-life cybersecurity scenarios by undertaking an internship in an information security or research and development department. Another opportunity to enhance practical skills is to participate in international competitions or Capture the Flag events. More information about internship positions and updates on the global student competition Secur’IT Cup can be found on Kaspersky's LinkedIn page.

3. Large companies can invest in upskilling programs for their corporate staff, helping employees acquire new knowledge and skills and stay competitive. Kaspersky offers a wide range of training programs dedicated to information security professionals, providing both professional education for individuals and corporate training.

   
   

To address the lack of knowledge and ensure an easier integration of the cybersecurity workforce into workflows, Kaspersky recommends a series of measures, including preparing employees with a minimum of knowledge in the field using the Kaspersky ASAP platform - https://k-asap.com/ro.