How To Upskill Yourself (Or Your Team) In Cybersecurity

The old joke goes like this: "How do you get to Carnegie Hall?" "Practice, practice, practice." Speaking of, the great pianist Vladimir Horowitz -- who played Tchaikovky's Piano Concerto #1 at Carnegie Hall in April 1943 as a WWII bond fundraiser, a performance that is still a masterpiece -- once said that if he didn't practice for one day, he would know it, and if he didn't practice for two days the whole world would know it.

How about you? 

Be honest in answering this question: how have you improved yourself as a cybersecurity professional in the past year?

To get ahead of things, the wrong answer is along the lines of "I listened to some podcasts" or "I attended an industry event."

The challenge in answering this question is that you had to change something. If you do not now do things differently than you did before, you did not develop yourself as a cybersecurity professional no matter what you think.

Disclaimer: connecting with people via conferences or expanding your thought basis via certificates or podcasts or, um, blog posts is very important. These activities are necessary for development but they are not themselves developmental.

The only way you're going to become better at cybersecurity is through deliberate, effortful practice that results in changed behavior. 

Context:

There is a decades-long argument in applied behavioral science about skill development. The two key questions include the following: Do people who are better at something such as math accelerate their skills by being tracked into intensive environments that accelerate that skill? How long does it take to achieve expertise? (which led to the unfortunate and wrong "10,000 hours rule") There was a movement in the 1990s through the early 2010s led by Anders Ericsson which fought for deliberate practice as the path to expertise. But soon more research showed that while deliberate practice plays a role in expertise, so does intelligence -- in fact intelligence plays a much larger role than practice.

This left us two problems. First, sure -- smart people develop expertise...how? Second, is there no hope for people with less than the highest levels of intelligence?

A newly published study in Psychological Science, "Not All Practice Is Created Equal: Longitudinal Evidence From Over 40,000 Chess Players" (doi:https://doi.org/10.1177/09567976261452568), examines data from Chess.Com. Data consisted of results from users who played games versus those who used the platform for training. The top-line take-away is that users who engaged in training were 3.61 times more efficient and effective after deliberate practice versus game-play.

Here is their Figure 2: this is pretty good:

Advice for cyber-defenders:

Going to work each day is not deliberate practice. You need to -- note the imperative, not a suggestion here -- get an AI platform simulation to help you run through scenarios, what-ifs, procedures, etc.  

Advice for managers:

You need to -- note the imperative, not a suggestion here -- get a team table-top exercise going at the very least. Through in prizes or recognitions to make it fun. Do the drills now so that you don't get drilled later.

Ask us how you can implement a super-effective upskilling program that works.

(Image credit: Scanning Dmitry Makeev, scan date - 2018 year., Public domain, via Wikimedia Commons)