Cybersecurity sounds all cool and sexy, but really to be a meaningful defender in the networked world, you have to get good at the most boring and pedantic parts of the computer world first.
Systems administration and cybersecurity isn’t invested in properly by industry, it doesn’t make the company money, it costs the company money, so as a liability on the budget line it often gets stuck under the CFO’s duties where technology investment and workforce training are also treated as liabilities.
It’s often seen as a waste to pay a college graduate when you can get some guy with a junior college degree to wire up the computers and college grads in buzzword-heavy cyber programs get shuffled off to management positions where they never learn how to actually “do” the things they supposedly learned in school. The managers see the writing on the wall and they invest not in training their workforce, but buying buzzword-laden services that frequently do nothing but look great on paper. They don’t build out capacity, plan past the end of the fiscal year, and they don’t create career on ramps for other skilled IT people to get smart on cybersecurity, and because they aren’t accountants themselves, so long as they are stuck under the CFO, they have a cap on their own career advancement.
I think the only way things effectively get fixed is for government to step in, which I know isn’t a popular statement in this forum. The SEC proposed cybersecurity rules this year, but they’re mostly focused on reporting incidents and surface level CYA stuff, not enforcing best practices and strategic investment in cybersecurity for publicly traded companies. IT auditing is big business, but it frequently looks at the wrong stuff.
Absolute TRUTH!