The Cyber Calamity Forecaster reveals overlooked possibilities and exposes unexamined assumptions about the cyber world. The ideal candidate will provide analytical, advisory, and technical expertise and analysis related to global cyber activities by assessing the current and predicted cyber environments and geopolitical developments. It issues cyber products, alert bulletins, and forecasts. But this calamity forecaster requires that three significant new capabilities are combined into one role.

In current network security, vigilance in relation to new threats and attack vectors is becoming increasingly critical. Rapid detection, risk assessment, and preventive or mitigating measures are gaining prominence.

Issues when dealing with threats at – a larger – scale

To face this problem, cyberthreat agents or Security Operations Centers (SOCs) rely on a vast body of reports of newly detected (or suspected) threat avenues that are reported in public sources: newsfeeds, mailing lists, Twitter streams, forums, etc. Many non-public sources are also offered: like paid vendor threat bulletins and announcements in closed channels. This forms a growing challenge, which is a specific instance of the ‘firehose’ data problem. A lot of data is available. Beforehand, its veracity is never beyond doubt. Moreover, it is not guaranteed to be structured so that automated or emi-automated processing is easily enabled. And, with many data sources potentially shedding light (potentially from different perspectives) on issues that share underlying coherence, discovering the relationship between reports from various sources is a critical enterprise. Also of note is that data sources are linguistic, with a wide range of potential source languages. Many are in English (of varying quality), but far from all, and one should never exclude the possibility that a highly relevant and urgent report could be published in Russian, Korean, Chinese, German, French (etc.) first.

Given the data stream’s size (‘firehose’), the scalability problem arises; a high level of automation is called for. With this problem in mind, we define three related capabilities:

1. Assessing Data Source Quality
2. Intelligent Correlation, Relevance, and Risk Determination
3. Automating Data Source Handling Process Flow and directing that to target audiences in a presentable and actionable format.

Based on the threat data, the calamity forecaster can carry out trend analysis on sectors (finance, retail, manufacturing), countries, platforms (Microsoft, Oracle, etc.), environments (Industrial plants), etc. This role is becoming more and more critical since the majority of the people do not see the trees in the wood anymore and need somebody to translate calamity information into possible decisions.

New Roles in Digital Security

Unlike the role of a security analyst, the Cyberdata Analyst is not concerned with operational cybersecurity issues. Instead, the Cyberdata Analyst examines on a tactical and strategic level how to predict upcoming threats based on the organization’s data. These predictions serve as a compass for correctly prioritizing cybersecurity efforts.

The role of the Machine Risk Officer will be essential in developing new trust mechanisms and imagining new risk-benefit approaches for working with intelligent machines. The employee in this position will define roles and responsibilities between humans and machines and set the rules for how human counterparts should handle machine-based wrongdoing.

The role of the Cyber Diplomat will be essential for managing stakeholders and regulators and finding collaboration and allies with other public and private companies and governments. The reason why wars are won is by having the right allies – and enough – allies. Going to war without them is a receipt for failure, as history teaches us (ref. Napoleon and Hitler). 

The employee in this position will form solid alliances and influence the external world about the entity’s opinion. 

As a Cyber Attack Agent/SEAL, you’ll form part of a new Special Operations division within the SOC, tasked with developing, undertaking, and leading the cyber deterrent program. As a key member of this team, you will assist in developing and, in wartime (e.g. currently in Ukraine), delivering strategic cyber offenses against adversaries’ infrastructure and public and private sector systems. To be considered for this critical role, you must display an excellent track record of cyber hacking, “gray-hat-focused” software development, or distributed denial of service attack experience. Cyber attack agents/seals will need to operate as an effective and highly nimble team, collaborating closely with each other and the National Cybersecurity Centers (NCSC) cybersecurity teams.

In the role of Data Trash Engineer, you’ll apply analytical rigor and statistical methods to data trash to guide decision-making, product development, and strategic initiatives. This will be done by creating a “data trash nutrition labeling” system that will rate the quality of waste datasets and manage the “data-growth-data-trash” ratio. This role is needed to avoid ‘obese’ data collection by organizations and to adhere to GDPR regulatory requirements such as data retention schemes.

The Cyber Philosopher will keep the discussion about the balance between humanity and machines alive to prevent “Judgment Day” from happening.

The AI Auditor will form an independent opinion about the integrity of the AI. This auditor will be a member of a governmental institute that audits without asking and without any financial incentives. As we will see below, the Auditor can not be part of a commercial organization.

The Security User Experience (SUX) Designer is an expert in building security within products and services and not giving them an unfriendly experience. This is caused by the way security has been designed as an integral part of the product or service, resulting in a perfect balance between ease of use and a secure and safe experience. In a world where it is unknown who can be trusted, trust will become essential for business strategy.

The role of Permanent Education

For these future roles, you need educated talent. Many learning and certification programs that have already been developed are a complete forest of trees for many HR professionals or recruiters. For the HR professional, it is becoming more and more complex to distinguish talent from amateurs. You simply cannot judge on certification alone; one needs to look deeper into intrinsic motivations and personal capabilities. This seems obvious, but in Information security, it is not easy for an HR professional to see how good someone is in a particular domain.

Lee proposes in the article “Seeking the Purple Squirrel” to opt for an open job description named “Desired Experience”: “Security is a rapidly evolving space, made up of numerous different technologies, and no single person is expected to possess every characteristic in this list. A curious mind, an ability to think about the rules and how to break them, and a willingness to learn are the most important traits we look for. If you have some of the following and are willing to learn more of them, we want to hear from you.”[13]

Despite great progress in the industry, the race for talent, and the search for the Purple Squirrel^, data and information inaccuracy remain a considerable challenge for many organizations. Inadequate detection rates and slow response to attacks are evidence of this. The lack of craftsmanship is the leading root cause for these insufficiently configured security tools and the many-point solution. But the stakes are high. An inadequate and seemingly weak response to breaches can negatively impact a company’s perceived value and potentially its share price. This information rarely trickles down to operational teams. There is a task here for all security professionals to communicate “fact-based data” upstream and downstream. The Executive Master’s program in Cybersecurity at Antwerp Management School focuses on many aspects, such as Cybereconomics and decision-making, Security in distributed environments, API security, Leadership, Data Security, Incident Response, and HR.

About the authors

• Yuri Bobbert is Academic Director for Antwerp Management School’s Executive Master’s program in IT and Cybersecurity.
• Vincent van Dijk, MSc is the Founder of Security Scientist and a researcher at Antwerp Management School.

Sources Used