Cybersecurity talent gap leaves Singapore firms exposed

Singapore

THE digitalisation train is speeding ahead, but a shortage of talent is exposing Singapore businesses increasingly to cyber and data privacy threats.

And recent high-profile breaches and regulatory changes are further fuelling demand for digital security staff.

There have been about 1,100 cybersecurity-related job postings in Singapore this year (according to data from analytics firm Burning Glass Technologies). And in the Asia-Pacific, there is an estimated 2.6 million cybersecurity workforce gap, based on research by the International Information System Security Certification Consortium..

Professionals in the business and headhunters point to several factors contributing to the demand-supply mismatch.

For one, schools have previously not emphasised cybersecurity education much, said Sheralynn Tjioe, who heads up cybersecurity recruitment at Hays Singapore.

In addition, cybersecurity roles can be very niche, which makes it difficult to find suitable people in a small country like Singapore. Some hiring processes can even take up to a year.

In a similar vein, Singapore also faces a crunch in personnel trained in data protection, said Kevin Shepherdson, CEO of data protection specialist Straits Interactive. While cybersecurity focuses more on IT systems, data protection covers the handling of personal data end-to-end - from creation to disposal - at the policy, people and processes level.

Under the Personal Data Protection Act (PDPA), companies must appoint a data protection officer (DPO) tasked with ensuring compliance with the PDPA. But in a 2019 survey by the Personal Data Protection Commission (PDPC), only 66 per cent of businesses said they have appointed a DPO.

While Straits Interactive has seen the number of individuals attending its certification courses jumping ten times from 2016 to 2019, "Singapore still has fewer than 1,000 certified privacy managers, which is the worldwide benchmark for a qualified data protection officer," Mr Shepherdson said.

A study conducted this year by the Data Protection Excellence (DPEX) Network found that only 12 per cent of DPOs are dedicated ones, while a majority take on "double-hat" roles.

While this could be due to both a shortage of talent and a motivation for cost-savings, the consequences are the same - the most common challenge faced by DPOs is the insufficient bandwidth to do a proper job, the survey showed.

Cybersecurity and data protection have been in the spotlight as more worrying cases of breaches emerge globally. In Singapore, 9,430 cases of cyber crime were reported in 2019, marking a 51.7 per cent increase from the year before. The same year, the number of data breaches globally rose almost four times, a report from the Cyber Security Agency of Singapore (CSA) said.

But help is on the way: public agencies, private companies and academia are quickly joining forces to address the talent issue.

Singapore recently passed amendments to its data protection laws to keep up with the evolving digital economy. Among the changes were stiffer penalties for organisations that flout the rules, compulsory reporting of severe breaches and being able to use data without consent for more legitimate reasons.

This comes as more businesses are forced into the digital sphere amid the pandemic.

CSA told The Business Times that cybersecurity hiring has not let-up since the onset of Covid-19.

"The top skills in demand... include cyber forensics, cyber risk management, security assessment and testing. Emerging skills such as cloud security and IoT security are also experiencing increasing demand as more devices are connected to the internet and more people work remotely," the agency said.

CSA leads the national SG Cyber Talent initiative that aims to reach out to at least 20,000 individuals over the next three years. For instance, it has partnered the Infocomm Media Development Authority to help fresh and mid-career professionals learn through on-the-job training.

Under the SG Cyber Olympians programme, CSA works with partners to spot top young talents and train them in advanced skills.

Meanwhile, the PDPC works with data protection service providers to offer organisations the alternative of outsourcing the data protection function.

Though efforts to help workers upskill or transition into cybersecurity roles are underway, it will likely be some time before the supply of talent can adequately meet the demand.

Specifically, there is a shortage of people with "skill sets involving things like encryption, managing data in transit, data at rest, and network/firewall/authentication setup and management" said Willson Deng, whose company Arcstone builds software to monitor and control manufacturing processes.

And among those with training, Vesta Matveeva, head of cybersecurity firm Group-IB's Asia-Pacific cyber investigations team, said most specialists lack practical skills and real-world attack management experience.

For example, the company is now looking for malware gene analysts, capable of classifying new types of malicious code in the wild and attributing them to known adversaries or tools. "Such professions are not taught at universities and require real-life incident experience above all," said Ms Matveeva.

To bridge the gap, the company is partnering three universities, the Institute of Technical Education and Ngee Ann Polytechnic to develop curriculums in cybersecurity. It also offers internships and provides students with access to Group-IB's solutions and monitoring systems to study real cases.

"This strategy is already gaining traction. Our first interns from Singapore universities have recently become Group-IB's full-time team members," she said.

Read more:

Singapore faces talent crunch as tech giants scale up