Unless you have been living under a rock for the past two years, I’m sure you’ve heard of a little something called Brexit. HFS has certainly been keen to point out the impact that uncertainty alone is having on the UK’s business environment. But, an often-overlooked area is cybersecurity; after a sobering review, it’s clear that security leaders must put the groundwork in now if they want to weather the impending Brexit talent crisis.
A talent shortage is already an issue for cybersecurity; reducing freedom of movement isn’t a solution!
There is currently an undeniable talent shortage in the cybersecurity realm and enterprise is struggling to fill the gap. Attracting new talent is challenging enough in a competitive labor market, but it becomes undeniably more challenging when the UK looks less like a safe harbor. We’re facing the very likely reality that talented individuals from across the EU will start leaving the UK or won’t move over in the first place because there are more stable positions for them to take elsewhere. The impact to the business reputation of the UK stretches far beyond the EU, however.
Laura Jones, a senior cyber intelligence analyst at Barclays and a native New Zealander, spoke at the TEISS 2018 security conference in London. She explained that it was not only difficult to find qualified staff but that she also was questioning whether she even wanted to remain in the UK. Importantly, she highlighted that she is far from alone, and many foreign nationals aren’t sure whether or not they will feel welcome in the UK. Laura explained, after mentioning that half her team is from continental Europe, “There's an aura around that is certainly discouraging people from coming to the UK.”
Laura mentioned that she bought a one-way ticket to the UK before Brexit, but if she had known the result beforehand, she might have chosen to work elsewhere.
Post-Brexit, enterprises should be looking for new ways to attract the world's best cybersecurity talent. Laurie Mercer, another talented security professional, explained, “The majority of people with cybersecurity skills do not reside in the UK.” Mercer states that of the $38.2 million HackerOne has paid out in vulnerability hunting bounties, only 4% has made its way to British security researchers.
Enterprises are going to need new strategies for retention and recruitment of talented staff, but all is not bad news for the UK
Ultimately, the evidence suggests that it’s already difficult to get skilled and qualified staff to work in the UK, and we can expect this problem to increase post-Brexit. Simply put, reducing freedom of movement and increasing the volume of administrivia involved in working abroad won’t facilitate talent as easily as it might have done before.
It is now more important than ever for enterprises and security officers to retain the talent they have within their teams. They are going to have to make a concerted effort to not only make staff positions more attractive but also assist in any post-Brexit citizenship or visa requirements.
Arguably, the talent deficit has been in place for some time, and a strategy change is required. Brexit will be a disruption to staff recruitment for enterprise, although we must acknowledge that this is not the only recruitment pool and it hasn’t been filling the current requirements. Strategies must change; UK enterprises must encourage homegrown talent and must work to win back the UK’s reputation as a stable business environment.
Encouragingly, Tom Huckle, head of cybersecurity and development at Crucial Group, explained that he believed that Brexit would initially lead to the UK losing several experts, but that effect could encourage UK talent to fill the gap.
The international effect on cybersecurity is unclear, and this is a danger you should prepare for!
Internationally, the cybersecurity situation is unclear; the level of cooperation that the UK and the EU will retain when dealing with organized crime and cyber warfare has yet to be revealed. This outcome will directly affect enterprises because of the international defense that nations provide their population.
The UK is currently a member of two organizations that will enable continued international cooperation, NATO and Five Eyes. The North Atlantic Treaty Organization (NATO) is a defensive military pact that connects 29 different countries from Europe and elsewhere. Five Eyes is an intelligence agreement between Canada, the UK, the US, Australia, and New Zealand. This indicates that there will be some level of cooperation between the UK and further afield in some form or another. In addition, the UK’s share of military capabilities accounts for almost 30% of the overall EU arsenal, indicating that the EU won’t be too quick to sever all ties because of their dependency on the UK.
Despite these overarching security agreements, it is unclear on what level of cooperation the UK will have with Europol, the EU’s cyber intelligence organization. By reducing cooperation, both parties would find themselves in a weaker position, unable to gain or contribute vital information in the fight against cybercrime, leaving the enterprises they protect in a more vulnerable position.
The Bottom Line: Brexit has bred a feeling of uncertainty; cybersecurity could both suffer and improve in different sectors, but it is up to security officers to prepare their organizations adequately.
It’s pretty clear that Brexit has led to a lot of uncertainty over a multitude of things and cybersecurity is definitely one of them. Initially, enterprises prepare for a possible exodus of talented staff or the new reality that their UK business just may not be that attractive. Setting the groundwork now with a comprehensive recruitment and retention strategy is not just essential, but a matter of national security.
"If you want peace, prepare for war."— Epitoma Rei Militaris.