By Rick Rogers, Area Manager for Africa at Check Point Technologies

So many people have written so much about the ‘skills shortage’ from so many different angles. It’s a complex situation with several different layers, and there have been many initiatives that have aimed to address it. So why write yet another column?

So much thought and effort has been poured into this topic, and yet the reality on the ground is only getting worse.

In order to better understand the skills gap, Check Point recently surveyed 450 IT professionals across the world, asking them questions about their challenges in managing their organisations’ security.

The results were startling. We found that 77% of all respondents were concerned with their security teams’ capabilities to deal with current and future cyber security challenges. When asked for the reasons for these concerns, 67% expressed that their teams lack the cyber-security knowledge and expertise required to handle the current level of cyber-attacks.

In Africa, the skills crisis is continent-wide. The security industry here is thriving – Check Point alone has more than doubled its workforce over the last three years. But as the market grows so the demand for scarce cyber-security skills increases.

Indeed, 67% of cyber-security professionals in the Middle East and Africa, feel they don’t have the skills to combat the increasing sophistication of cyber-attacks.

I can’t shake the sense that there’s a major element of this situation that isn’t being addressed, an element equally critical as repairing the talent pipeline.

Is it a people problem?

The cyber-security industry is booming with new technologies and products. These products or solutions vary from technologies that assess an organisation’s risk and vulnerability levels, to tools that monitor and analyse a current attack surface and report back when it is under attack, and countless other products that remediate, confront or prevent attacks as fast as possible.

From the vast amount of meetings with our customers around the globe, we’ve noticed that CISOs (Chief Information and Security Officers) tend to manage around ten to fifteen completely separate solutions for their security. Given the sheer number of technologies that each professional needs to handle, it doesn’t come as a surprise that our survey found that 64 percent of the respondents’ teams expressed difficulty in managing their security workload.

Trying to manage an overload of non-integrated, disparate point products is tying teams up in knots, requiring talent and experience beyond what is currently available in the workforce.

Consolidating to cut complexity

As part of our survey, we asked IT professionals about their experiences using multiple point security solutions versus using a consolidated solution from a single vendor.

Survey results revealed that a consolidated security approach leads to significantly lower staffing challenges.

Only 38% of respondents in the point solution group felt like they had enough resources to manage their workloads, while more than half of the consolidated security strategy group felt prepared.

Even more remarkably, 61% of the ‘point security’ solution group identified their staff’s lack of security expertise as the main culprit. Meanwhile, nearly two-thirds of the ‘consolidated’ group felt like their staff had the expertise to manage their security solutions.

On the surface, a point solution strategy has some appeal – by mixing and matching your favorite products from different vendors, you can employ a diverse, versatile security strategy. Dig deeper however, and the data tells a different story: any benefit from this solution diversity is overshadowed by the increased cost of solution complexity.

Managing complex threats with simple products

We, the cyber security industry, need to recalibrate our efforts away from complexity toward simplicity. Educational programmes and initiatives to provide highly trained individuals are welcome and needed. Check Point conducts a number of solution-specific training sessions and seminars in Africa, and has also launched an intern programme to transform young IT individuals with potential into seasoned security professionals.

But I think we also need to take a long hard look at ourselves and examine the ease of implementation and use of technologies that we are delivering to the market.

Make no mistake: today’s era of cyber-attacks is on a completely different scale. These attacks, referred to as Gen V, require sophisticated, innovative products that react fast and prevent, or block attacks as soon as they happen.

However, this increase in sophistication cannot be at the expense of simplicity and efficiency.

We need to place a much stronger focus on consolidating our solutions to deliver consistent and unified management, so that learning curves are minimised. We must simplify our products, so that high-level analysis of their output by senior engineering talent is not necessary.

And is complex… managing your security solutions shouldn’t be. And when our industry provides simpler, more consolidated solutions, we will also have come closer to reducing the cyber–security skills gap.