Zero Day. For Cyber Security Talent. Summary Sponsorship Prospectus

Transcription

1 Zero Day For Cyber Security Talent Summary Sponsorship Prospectus A call for supporters to undertake a cyber security labour market study for Canada Project Study Leaders Meenakshi Gupta, Senior Director, Policy and Research, Information and Communications Technology Council Katherine Thompson, Vice President, Research, Canadian Advanced Technology Alliance Steve Palmer, Executive Director, Collaborative Centre for Justice and Safety, University of Regina

2 Overview In common cyber security parlance, 'Zero Day' is the day a new vulnerability is made known. In some cases, a 'Zero Day' exploit is referred to as an exploit for which no patch is yet available. In either instance, this term can be applied to describe the intent of this study, which is to provide a better understanding of the state of Canada's Cyber Security pool of highly qualified personnel (HQP). In undertaking this study, the Canadian Advanced Technology Alliance (CATA), the Information Communications Technology Council (ICTC), and the Collaborative Centre for Justice and Safety (CCJS), aim to provide a comprehensive overview of the current gaps in the supply and demand of Cyber Security talent while providing an overview of some of the profession's key attributes and current/future market trends. In September of 2012, ICTC released a report 1 sounding the first alarm for the growing need for cyber security services. In this report, ICTC noted that industry and public sector leaders were already aware of the growing requirements and the emerging shortage of skilled professionals to help combat emerging online threats. The proposed CATA-ICTC study will delve deeper into requirements, gaps and risks of not implementing aggressive training programs. Support for the need of a better understanding of the Canadian ICT labour market as a whole is identified as an urgent need in a report 2 authored by David Ticoll, Executive Director of the Canadian Coalition for Tomorrow's ICT Skills. The report identifies the opportunities for the Canadian economy that would result for creating a more progressive and innovating ICT labour market. As noted in the study, a responsive, 21st century labour market information network could place Canada at the forefront of the global digital economy. It is the belief of many that 1 CYBER SECURITY: Critical ICT Human Resource in the Digital Economy, Information Communications Technology Council, September 2012, 2 Canada's ICT labour market needs a fix, David Ticoll, Canadian Coalition for Tomorrow's ICT Skills, April ZERO DAY - Cyber Security Labour Market Study 2

3 developing those innovations through the cyber security industry could further define Canada as a global leader. To do this, a well-trained labour market is required. In November of 2014, CATA held its first Cyber Security Forum in Ottawa, Canada. The resounding message from senior leaders across multiple sectors was that the labour and skills shortage as it relates to cyber defence is real, it s growing and it s now. This pertains to organizations both public and private sector, emerging enterprise to global leader. A Call to Action was given to CATA to lead an initiative towards more defined and robust skills training programs for cyber professionals to meet the growing national and international requirements. Towards these ends, a better understanding of the current state requirements along with addressing what future need will look like is needed. With this better understanding in place, the cyber security sector will have a sense of where it is most vulnerable, and identify the means by which to best exploit the opportunities for change. ZERO DAY - Cyber Security Labour Market Study 3

4 Study Objectives The main objective of this study is to explore current and future cyber security labour requirements in Canada. While an advisory board will determine priority sectors for closer examination, it is anticipated that three key sectors will be analyzed: Financial Services, Public Sector and Healthcare. The study will examine skills requirements and level of expertise/experience required by each sector in both the current and future state, and offer recommendations on what Canada needs to do to increase skilled labour market to meet these requirements. The study will be designed to provide a labour market information system of the current and future labour supply and demand to assist decision makers in industry, government, and education organizations in planning their human resource strategies accurately and effectively. There are other outcomes which could result from the findings of this study, including: Improving staff development by employers, particularly SMEs Attracting new workers into the sector by creating greater awareness of career and employment opportunities Enhancing the effectiveness of existing education and training programs in preparing workers for industry in the short and long term Increasing recognition of the cyber security sector as an important industry with many high-skilled, high-paying, and interesting job opportunities Facilitating greater labour mobility The development of sound public policy decision-making that can take into account equitable and/or representative allocation of funds/resources The regional targeting of programs/funds to better support strong or fledgling cyber security hot spots in Canada ZERO DAY - Cyber Security Labour Market Study 4

5 Study Partners For Information and Communications Technology Council Meenakshi Gupta, Senior Director, Policy and Research Meenakshi Gupta works with stakeholders across the country to ensure Canadian leaders are making informed decisions when developing the ICT talent of tomorrow. Meenakshi is responsible for overseeing ICTC s research and policy development including the principal elements of the labour market and its operations, and development of competencies for the new and emerging occupations within the ICT sector. During her time with ICTC she has focused on reporting on the current trends within the digital economy as well as forecasting the future requirements of the ICT talent base that will allow Canada to reach its economic potential. Formerly Senior Program Officer for Association of Canadian Community Colleges (ACCC), she focussed on international development and immigration. Meenakshi also has over 15 years of experience in Canada and overseas, including China, India and Mexico. Meenakshi has also prepared a Toolkit for the Internationalization of Educational Programs, published articles, and presented at a number of national and international conferences. Meenakshi pursued her undergraduate degree in French Major from Concordia University; her Master s in Quebec Studies from Université du Québec and received her doctoral degree in Education from McGill University with a specialization in Comparative Education and Gender Studies. Sam Bourgi, Senior Analyst, Research and Policy Development Sam Bourgi leads economic research and report writing at ICTC in collaboration with industry, government, and academic stakeholders. Sam is responsible for developing ICTC s sub-sector studies, which examine the horizontal impact of emerging technologies on the Canadian economy, as well as developing regular labour market publications, policy papers, and whitepapers on the digital economy. During his time at ICTC Sam s research has focused on ZERO DAY - Cyber Security Labour Market Study 5

6 the supply/demand balance for ICT professionals, innovation and productivity in the Canadian economy, and international competition. His latest research publications have focused on cloud computing, industrial automation, financial technology, and cyber security. Sam has five years of progressive experience spanning the government, private, and not-forprofit sectors. A published author in both peer-reviewed and industry research, Sam has presented his findings at several regional and national conferences across Canada. Sam completed his undergraduate degree at the University of Windsor before pursuing a Master s degree in Economic Policy from McMaster University. His research interests include global political economy, trade, and the financial markets. For Canadian Advanced Technology Alliance Kevin Wennekes, Chief Business Officer Kevin Wennekes is responsible for identifying new business opportunities and driving business growth through the design and development of research initiatives, advocacy campaigns, issues identification/management, and new product/service development, that further grows and retains CATA s membership base. Kevin was CATA s VP, Research, beginning in 2002 where he was responsible for developing and executing impact research projects for the advancement of the technology industry and Canadian economic growth. In his twelve years with CATA, Kevin has led over 40 different studies and personally published over a dozen research papers on topics including public safety and emergency response, IT security, communications interoperability, global sourcing, high performance computing, performance management, talent acquisition, and procurement practices and reform. Katherine Thompson, Vice President-Research Katherine Thompson recently joined CATA as Vice-President, Research and brings an extensive background in the IT and Communications industries. Katherine is responsible for overseeing and expanding CATA's research and intelligence repository working with a cross- ZERO DAY - Cyber Security Labour Market Study 6

7 section of CATA community leaders along with senior leadership within CATA's national and international membership base. Katherine was instrumental in developing CATA's first Cyber Security forum held recently in Ottawa, Canada and is now spearheading the development of the proposed national Cyber Security Council along with various national and international initiatives designed to increase awareness, collaboration and security intelligence for CATA members. An experienced entrepreneur, Katherine has extensive experience in the media and public affairs arenas speaking with some of Canada's most respected and regarded business leaders. Her background in the IT and technology outsourcing fields led her to first collaborate with CATA on the need to develop a unified brand in the global sourcing industry. Katherine delivered a series of cross-canada roundtable sessions resulting in (2) white papers analyzing and addressing gaps in the market along with recommendations for future economic development. Katherine has a degree in Advertising and Public Relations from St. Lawrence College in Kingston, Ontario along with a certification in Media and Public Affairs from Ryerson University. Katherine is currently completing her PMP certification along with her C.I.M designation from the Canadian Institute of Management. For the Collaborative Centre for Justice and Safety Steve Palmer, Executive Director Steve Palmer is a professional Engineer and the Executive Director of the Canadian Centre for Public Safety and First Responders at the University of Regina where he is bringing together a critical mass of leading edge research and education to focus on the requirements of the public safety and the responder communities. Steve is also an Executive in Residence at the Canadian Advanced Technology Alliance where his work will focus on building the public safety program with a focus on the Economics of Community Safety and Emerging Technologies. He is the former Director of Science & Technology Transition for the Canadian Safety and Security Program (CSSP), a federally-funded program, where he was responsible for the Emergency Responder Test and Evaluation Establishment in Regina and the Science and ZERO DAY - Cyber Security Labour Market Study 7

8 Technology Transition and Project Management offices for the program in Ottawa. Steve was Director of the Canadian Police Research Centre (CPRC) until the creation of the CSSP when CPRC and the other programs within Defence Research Development Canada's Centre for Security Science were combined. He worked for NRC's prestigious Industrial Research Assistance Program (IRAP) as Director of National Initiatives prior to joining CPRC. He graduated from the University of Waterloo's program of Systems Design Engineering, and has a Master's of Business Administration from York University. Steve volunteers as a Director for The Society for the Policing of Cyberspace and is also a dedicated member of the Women in Defence and Security's Advisory Board. He received the Queen's Diamond Jubilee Medal in In 2011 he was awarded the prestigious CATA Alliance award for Public Sector Innovation and Leadership in Advanced Technology. In 2011 he was also recognized for Leadership that Made a Difference by the Communications Interoperability Technology Interest Group, CITIG, for his role in building and growing CITIG. ZERO DAY - Cyber Security Labour Market Study 8

9 Funding Partners Opportunities While the study team will be proceeding to work on these subjects under the auspices of our current research efforts (albeit in a more limited fashion without further funding support) the study team is seeking corporate and government participation and support for a much broader initiative. Only in this way does the study team believe that the relevancy of the work can be optimized. We are looking for those providing support funding to participate in the development and coordination of this initial survey subsequently to continue to be involved in the quality analysis of the findings and their public dissemination. Supporters will be invited to participate on an ongoing basis in shaping follow-on programs of CATA aimed at enhancing the cyber security labour market in Canada. Towards these ends, collaboration with public and private sector organizations will be required and would result in the following dividends commensurate with contribution levels. Significant International Branding Opportunities Increased Profile Logo inclusion in all news releases and announcements, the online assessment, and final report Dissemination of research announcement issued throughout CATA s extensive networks (CATA counts 22 thousand Twitter Followers, 14 thousand op in executives in moderated Linked in Groups, 5000 executives in the Google + CATA Circle, 32 thousand CATAnet TV video views, a 2 million executive audience on social media groups that CATA has permission to post to in Canada and major Global markets, and direct databases of 15 thousand executives.) ICTC outreach is compounded by a network of educators, industry and policy makers reaching to approximately 16,000 Twitter followers, 8,000 Linked in followers, and over 500 you tube followers Long-term web page placement (news releases typically archived only after 2 years) Logo inclusion and executive leader participation and positioning at selected report release roundtables ZERO DAY - Cyber Security Labour Market Study 9

10 Working with a recognized university and national not-for-profit association will provide further credibility and validity to the results and avoid perceptions/suspicions that the exercise will result in a vendor-biased business development/marketing tool Key executives provided opportunity to participate in CATA Video shoots, national conference calls, and pre- and post-study media campaigns Strategic Intelligence Participation in Advisory Board and consultation in the questionnaire and communication tools design stages to ensure strategic intelligence needs are met. The right to include a number of specific questions into the questionnaire Responses provided in real-time in an Excel spreadsheet upon completion of the assessment Right to participate in round-table discussions of survey results Provide input into and interpretation of results in final report Request a special cut of the data for comparative results i.e. region, occupation, sector Future Research and Events Advantage Research typically leads to the need for more research. As such, sponsors will clearly be advantageously positioned to capitalize on future research or consultative efforts arising from this study. ZERO DAY - Cyber Security Labour Market Study 10

11 Funding Levels Funding will assist the study partners in offsetting the significant hard costs that are to be expected in a collaboration of this nature (survey tools, communications, marketing costs, translation) and assist the research team in raising funds to supplement the methodology and enables the assignment of dedicated interviewers and support staff. If the full amount cannot be raised, then certain elements may have to be amended i.e., number of interviews completed, post-study information sessions, marketing efforts, etc. Diamond Platinum Gold Silver Bronze Supporter $55,000 $27,500 $18,500 $7,500 $5,000 <$5,000 Logo placement all materials In line and of equal size to that of current partners Underneath and of equal size to that of current partners Underneath and of equal size to that of current partners Underneath and of smaller size to that of current partners Underneath and of smaller size to that of current partners Underneath and of smaller size to that of current partners Quote inclusion in media materials Advisory Board membership Consultation in survey design Advance access to results Included Included Included Not included Not included Not included Yes Yes Yes Yes No No Yes Yes Yes Yes Review only Review only Yes Yes Yes Yes Yes Yes Video Interview Yes Yes Yes Yes Yes Yes Lead table representation of formal report Invites to formal release session Request Data Cut Report Yes Yes Yes No No No Yes Yes Yes No No No ZERO DAY - Cyber Security Labour Market Study 11

12 Approach and Methodology The proposed process will provide the following deliverables. 1. A fully integrated project management function involving the project team at the critical design, implementation and monitoring phases; 2. A literature review assessing existing published works for relevant cyber security labour market information and other data sources such as StatsCan 3. A representative Board of Advisors fully integrated in project team activities. 4. A sound distribution and communications strategy which will not be a standalone event, but rather a continuous effort throughout the implementation; 5. Questionnaires designed to ensure respondents can relate to questions and can see the pertinence of the assessment and its anticipated outcomes; 6. An effective, user-friendly, online questionnaire and its seamless operation ensuring a state-of-the-art process while also allowing for alternative means for completion; and 7. The delivery of a final report that summarizes the results of the assessment. Project Advisory Board - January 2015 An advisory board will be established consisting of approximately 15 senior, recognized thought leaders whose roles will be to help advise the team in many key areas, including but not limited to: stakeholder survey development, validation, and testing communications strategy validation and support identifying sources of relevant secondary research acting as project champions and ambassadors The advisory board will be formed both through personal invitation and through an open call of interest. It is anticipated that Board members will be made up of: Project Team executives and staff University & College Professors, Research Chairs, etc. Cyber Security Industry and Government leaders ZERO DAY - Cyber Security Labour Market Study 12

13 NGO and non-profit executives Official Supporters Distribution and Communication Strategy - Throughout Study A distribution and communication strategy as well as the required boilerplate materials and templates will concurrently be developed in close consultation with the Board. Distribution Hubs While the project team have extensive national networks between them, they will identify a comprehensive list of organizations that can assist in the distribution of the online assessment to the appropriate respondent pools. These could include, but are not limited to: Regional technology associations Business associations i.e. retail, financial, etc. Government departments Research institutes Hospitals In order to facilitate the promotion of the assessment through third-party mediums, i.e. partnering organization s web sites, newsletters, subscriber/membership mail-outs, etc. the project team will create and make available boilerplate and template materials such as overview of assessment goals/objectives, call to action, contact information, assessment hyperlink, etc. for their ease of use. Distribution Hub partners are offered recognition for their support in the final report and all respondents will receive a complimentary copy in exchange for their participation in the assessment. The majority of this work will be done in the development and early launch stages of this assessment, however new invitations could be offered throughout the process as awareness of the assessment grows and other respondent pools indicate a desire to participate. ZERO DAY - Cyber Security Labour Market Study 13

14 Survey Referral Mechanism Peer-to-peer network The survey can be built to ask respondents to provide the name and contact information for any other individual(s) they feel should complete it. The project team will monitor the responses to this query and follow-up accordingly. Questionnaire Design February 2015 The project team will develop the stakeholder questionnaire after extensive consultation with the advisory board. While the final survey will only be developed after these consultations, it is anticipated to contain questions that will help to determine: No. of cyber security employees employed Job status: FTE/PTE/Contract Salary ranges Job location Current and projected demand Required skills and capabilities Satisfaction levels with quantity and quality of existing HQP Special perks, incentives or other recruitment techniques An area for respondents to identify a desire to be interviewed to elaborate on their responses Draft Online Assessment - March 2015 The design and technological/logistical preparations for all elements of the assessment process will be done in close consultation with the project team and Board. Pilot Test and Adjustments A pilot test of the online questionnaire will be administered in the week before the date of launch in order to fully test the assessment s validity and ensure satisfaction with the process and data results. ZERO DAY - Cyber Security Labour Market Study 14

15 Official Launch - April 2015 The online assessment is launched. In cases where individual names and s are provided, the project team will generate an to the respondent directly with information on how to complete the assessment online. Distribution Hub partners will be notified that the assessment is live and formally invited to notify their networks as arranged. Progress Reporting Data Analyzing Real-time The survey provider s programming allows for instant analysis of the data in real time. Simple multiple-choice, yes/no, and levels of satisfaction questions can be demonstrated in either pieand bar-chart fashions. More complex grid question results are revealed through aggregates in tabular format. Conduct Telephone Interviews - March-April 2015 For the purposes of costing, we are anticipating that approximately 30 interviews will be required. These interviews will be conducted with key stakeholders representing a broad crosssection of private and public organizations. The advisory board will help identify those considered of critical importance to include, while some will be expected to result from those who request one through their online survey submission. A telephone interview questionnaire will be developed that will consist of multiple probing-like questions that can be asked to start the conversation while also allowing for stream of consciousness discussion. They are expected to last between minutes. Some interviews may be conducted in person where proximity and interests align. Responses will be summarized into an executive summary report and these reports will be assessed for recurring trends/themes for inclusion in the final report. ZERO DAY - Cyber Security Labour Market Study 15

16 Final Report - June 2015 The report will provide information on the assessment methodology and the preliminary sets of findings. These findings will include graphical representations (pie charts, bar charts, etc.) and tables as appropriate. It will also include an Executive Summary, Introduction, summary of results, and appendices including the full questionnaire and comprehensive distribution tables. It is anticipated that the report will also provide comparative results by geographic region and potentially explore trends/gaps etc. among various demographic tabulations such as company size or industry sector. Report Launch Roundtable - June 2015 Upon finalization of the report, a roundtable will be held to review and further validate the study findings. These are normally half-day sessions and involve a combined roundtable/workshop methodology. Participants at the discussion leader table will consist of representatives from a cross-section of government, industry, association and academia who are recognized for their knowledge and expertise in cyber security. The discussion leaders will share their experiences, their opinions on how companies can better position themselves for the future and engage the audience in conversation to assist in the building of consensus and a plan of action for the future. Ample networking opportunities are afforded and offered through designated breaks and breakfast/lunch periods. Study supporters would help lead discussion, receive branding opportunities in all stages of its delivery, and be able to provide exclusive invitations to the roundtable for their strategic use. ZERO DAY - Cyber Security Labour Market Study 16

17 Anticipated Costs Phase 1 Preparation Project Team and Advisory Board Planning Create and meet with Advisory Board Project planning $35K Phase 2 Methodology and Research Tool Design Step 1 Draft Outline of Methodology and Tools Project team meeting Develop communications strategy Develop communications templates Develop online assessment Develop interview questionnaire $47.5K Step 2 Validation of Research Tools Pilot test and evaluate instruments Phase 3 Delivery Implementation Engage in communication/awareness raising strategies Roll out e-survey commence interviews (approx 30) $15.5K Phase 4 Analysis & Interpretation Data management and interpretation Create data charts and tables for analysis Create individual & aggregate interview reports $15K Build report framework Phase5 Reporting Reporting Create draft report Finalize report $12K Phase 6 Promotion Outreach Awareness raising and advocacy Roundtable session $20K With administrative, project management, and translation fees, a total of $160,000 is required to undertake the entire study. A minimum of $75,000 is required to be raised in order to conduct a baseline study: the difference in funding would impact in areas such as paid advertising, number of interviews conducted, roundtables, etc. ZERO DAY - Cyber Security Labour Market Study 17

18 Contact Us To confirm your interest as a potential supporter of this study, please contact any of the following project leaders. Katherine Thompson for the Canadian Advanced Technology Alliance kthompson@cata.ca or (416) Meenakshi Gupta for the Information and Communications Technology Council m.gupta@ictc-ctic.ca or ext. 132 Steve Palmer for the Collaborative Centre for Justice and Safety steve.palmer@uregina.ca or (306) ZERO DAY - Cyber Security Labour Market Study 18