Cyber Leaders Share Insights on the Future of Work

As cyber threats of increasing scope and sophistication heighten the need for enhanced security and resilience, the current “Great Resignation” has only intensified the cyber talent shortage. As a result, education and training on the latest cyber tradecraft is a must-have for attracting and retaining in-demand talent. How can organizations maintain good cyber hygiene while also appealing to talent in today’s virtual and hybrid work environments? 

Booz Allen Vice President Becky Robertson and Director Garrettson Blight discussed these challenges and more at the Infosec Inspire User Conference, a recent virtual event exploring the “human side of cybersecurity," which spans everything from strengthening cyber awareness to building and upskilling the cybersecurity workforce.   

Robertson leads hundreds of digital solutions, engineering and science, and analytics professionals at Booz Allen. Blight leads Booz Allen’s DarkLabs, a team of the firm’s top security researchers, penetration testers, reverse engineers, network analysts, and data scientists. Here are key takeaways from their discussions:

For many Booz Allen employees, the past year’s shift to virtual operations meant relocating from a sensitive compartmented information facility (SCIF) to home offices. This move required new approaches and mindsets toward security.  

“We’ve instituted good practices around helping people think through what it means to work remotely,” Robertson said. “For example: Should I print out this document? What will I do with it when I’m done reading it?”  

“It’s often very mundane stuff,” she said. “But if we talk about it upfront, people can still get the goodness [of a hybrid work environment] without sacrificing security and integrity,” she said.

For cybersecurity and all types of training, Blight emphasized the importance of communication, consistency, and culture.  

Leaders should communicate the value of new learnings and practices and clearly outline for employees what they need to do to meet these requirements, Blight said. Expectations should be clear throughout. And when fostering culture, “sometimes it’s about the social connection,” he said, citing his team’s in-person Hacker House events, which informally bring teams together in fun capture-the-flag training outside of the workplace. 

How else can organizations check off the cybersecurity and compliance boxes while not boring teams with “things people already know and are tired of hearing?”  

Vary your tactics to keep things interesting, Robertson advised. She cited mock phishing emails embedded into everyday activities and small-group sessions with leaders who are trained facilitators, “so it’s a discussion, not a broadcast, and people learn from their peers, so it feels more relevant.”

Robertson cautioned, “When you make something mandatory, some people respond positively and some negatively.”  

“As a leader, you have to be creative and find out what motivates people,” she said. “If there’s resistance, it will take some one-on-one and exercising your leadership muscles to figure out ‘What’s the holdup here?’ and help them work through it.” 

“We’ve all suffered through learning something, then you don’t use it for several months, so we try to inject training into day-to-day life,” she said. 

To make training manageable for busy employees, Robertson suggested: 

• Spread out sessions throughout the year, to avoid a situation where “January comes, and everyone does 40 hours of training.” 
• Schedule training around known times when employees won’t be able to go to client sites. 
• Give people permission to step away from their regular activities to make time for training and “lighten up the load for them when they have to get it done.” 

To further encourage adoption, introduce employees to your organization’s cybersecurity culture from the very beginning, she advised: Talk about expectations during interviews and weave practices and protocols into orientation.   

“With the Great Resignation, it’s more critical than ever to make sure staff feel intellectually challenged,” Blight said.

In fact, he said, Booz Allen created DarkLabs in response to a similar problem. “About 5 years ago, many of our employees had reached an inflection point in their careers: They had been with us working to defend the nation since 9/11 and were starting to ponder what’s next.”

“They were halfway through their careers, primarily working in SCIFs, and there were many cyber startups evolving without those workplace restrictions,” he said. “They were getting itchy and wanted to do something different.”

DarkLabs was Booz Allen’s response. “It’s a place to explore ideas without the restrictions and limitations that often come in classified environments, and it’s created a lot of career mobility and diversity that might not otherwise exist in traditional roles or other companies,” he said, citing “projects that leapfrog other technologies” and “discussions about creating entirely new businesses to spin off from the company.” 

Whether employees have been at a client site for a long time or are just starting out in their careers, Blight suggested: 

• Maintain a full scope of courses and certifications, from foundational knowledge to highly specialized and technical skills 
• Leverage group training for motivation 
• Provide guidance and career paths so employees don’t get overwhelmed by options 

Overall, he said, “It’s a lot more costly to invest in someone new than to retain someone who’s already a quality performer.”

How can training departments keep these top performers up to speed on the latest trends and technologies, to give their organizations a competitive edge?

“We’ve invested heavily in 5G, quantum, things we knew were coming, and we’re investing in things on the horizon,” Robertson said.

To guide these investments, Blight offered some suggestions:  

• Sit down with your learning and development department and others in the organization to discuss where you see your future hires coming from and what sectors were a priority. Booz Allen started this years ago with data science, upskilling operations and research skills toward artificial intelligence, machine learning, and algorithm development, according to Blight.
• Make sure you have the right skill sets in these areas and tee up training for future technologies, like extended detection and response
• Look at industry trends, top 10 reports, and your organization’s own growth to make sure training aligns with where business is going  
• Ensure effective collaboration across your production and services groups, human resources, learning and development, and internal infrastructure groups

Then it’s critical to stand up new training capabilities quickly, both for planned topics and in response to issues that arise from the current environment.

“After the SolarWinds attack, threat hunting was an in-demand skill, and we needed to get people up to speed fast. But every company that offered services had exhausted their workforce,” Blight said. “So, we rapidly stood up a federated cross-training campaign and in 2 months got 200 people on board.”

What does it take to be able to respond so quickly? “Routine communication and relationships are critical so different business elements know each other and how to work together,” Blight added. “Treat everyone as equal partners and have routine working sessions. If a crisis happens, form a cross-disciplinary tiger team, usher proof of concept ideas through to a pilot, then either evaluate and revise or formalize the improvement to scale across the enterprise.” 

Learn more about cybersecurity and intelligence work at Booz Allen, and careers in these fields at Booz Allen.