Why agility is vital for security professionals

DWP, Network Rail and more on how to build a security team

Agility is an essential skill for security workers, according to cyber security chiefs from the likes of Skyscanner and Network Rail speaking at Infosecurity Europe 2017 today.

The term 'agility' can mean being flexible about the nature of their daily task as well as the method of working, according to Vicki Gavin, The Economist Group's head of continuity and information security.

She said: "Just because you're hired to be a security operations centre [SOC] analyst does not mean you will always be a SOC analyst. Being able to duck and dive pertains to what we do."

Mahbubul Islam, head of secure design at the Department for Work and Pensions (DWP), agreed and highlighted how a team should be ready to react to what a business needs as necessary.

Advertisement
Advertisement - Article continues below

"I would say it's a more disciplined, self-organising team who work together in various activities," he said.

For Stuart Hirst, head of IT security at Skyscanner, agility means doing things at pace and experimenting. He also underlined the importance of "failing forward, failing fast" where individuals learn to prevent the same mistake happening in the future.

Network Rail CISO Paul Watts identified an important factor as empowering security staff "who aren't asking for permission" who work with the business, not just for the business.

Gavin underlined how one of the backbones of agility is resilience "It's the unexpected we have to deal with and the only way to deal with that is being agile." She added: "It's the stuff you can't imagine that you have to respond to. From the top down they need to expect things to go wrong".

Watts agreed with this, and added that an agile security team sits everywhere within a business, saying: "Security is a collective responsibility; we are providing capabilities and education to bring the entire business in."

Skyscanner's Hirst added: "Everyone in security has the autonomy to pick up pieces of work and drive them".

How to hire a security staffer

Hirst looks for people who are experimentational and "ready to take on some chaos", saying this means people who are flexible enough to react to different situations.

On the other hand, Gavin said that often it's important to develop the individuals in your team from scratch, admitting: "One of the tricks we often miss is not developing people once we have someone on board."

DWP's Islam said that you have to give individuals the opportunity to develop based on the skills they have, while Network Rail's Watts highlighted that even if a candidate has the right technical skills, they need soft skills too. "I would bring someone like that into my team and develop them," he said.

Advertisement
Advertisement - Article continues below

Do companies need to change their hiring methods?

"Rethinking needs to happen" Gavin argued, adding that The Economist Group develops a list of must-have qualifications, while keeping an open mind if an exciting candidate has an unusual background.

In order to attract more people to the industry, Skyscanner has tried to embed itself in groups that exist in Scotland to try and attract people to the job specification, said Hirst. He also highlighted that there was a distinct lack of young girls going into security, and the sector as a whole, questioning why they aren't being encouraged to enter. "I dont have the answer" he said, "but we are trying to change things in the UK."

Gavin added: "We need to make sure that young people understand that the jobs of tomorrow will not exist today. When I joined the workforce, cyber security did not exist."

Picture: Bigstock

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/government-it-strategy/28305/ir35-news
Policy & legislation

Businesses urged to continue IR35 preparations despite Conservative review pledge

3 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
Visit/careers/28929/data-scientist-jobs-where-does-the-big-data-talent-gap-lie
Careers & training

Data scientist jobs: Where does the big data talent gap lie?

17 Sep 2019
Visit/strategy/29521/three-tips-for-effective-business-collaboration
Business strategy

Four tips for effective business collaboration

27 Aug 2019

Most Popular

Visit/operating-systems/microsoft-windows/354297/this-exploit-could-give-users-free-windows-7-updates
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019
Visit/business/business-strategy/354304/ex-apple-cpu-architect-accuses-the-firm-of-invading-privacy
Business strategy

Ex-Apple CPU architect accuses the firm of invading privacy

10 Dec 2019
Visit/security/vulnerability/354309/patch-issued-for-critical-windows-bug
vulnerability

Patch issued for critical Windows bug

11 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019