Cybersecurity teams will be facing much bigger challenges in the coming months and years. Breaches and new strains of malware are growing exponentially. The new generation of cyberattacks includes multi-vector threats that move laterally from the IT networks to the physical realm of OT. Time sensitive malware like ransomware crank the pressure up further. New tools are being introduced at a dizzying pace. Regulation and increased executive involvement require more transparency and well-defined processes.

CISOs and SOC managers are working hard to procure the most advanced defense tools available. These tools require substantial expertise, but the teams who use these tools are understaffed and underqualified. Most SOC staff members will experience a major incident for the first time on the job. Nevertheless, they will be expected to understand the situation in a split second and manage it flawlessly.

What good is an arsenal of fancy cyber weapons if your team members haven’t mastered them and never even practiced the relevant playbooks? And how can we expect our SOC teams to identify and respond to an incident which they’ve never seen before? To defend against the flood of sophisticated cyber threats we should invest in cyber security training so every security analyst, from fresh recruits to senior aces, is prepared in advance for the attack. This is, in my view, the most troubling cybersecurity gap today.

We Should Learn from the Best
These exact challenges are the ones experienced by pilots, air traffic controllers or doctors every day. These professionals are required to assess situations in real-time, make split second decisions under time pressure, and use sophisticated technologies in highly distracting environments. The cost of error is high and there is often no second chance to fix it. Therefore, these industries use hands-on training and simulation to minimize errors and ensure their experts are at their top performance before they even get to see a patient, aircraft, or a control tower. They simulate day-to-day scenarios and crisis scenarios repeatedly, correct errors and improve their performance, so when an actual crisis occurs it is handled efficiently.

Students Train in University Cyber Range Simulator

I believe this is where cybersecurity is heading. In the new realm, security teams will not just memorize their playbooks, they will experience them hands-on in advance. The new training environment will be a complete and accurate reproduction of their network architecture, traffic, and attacks. Incident responders will experience real-life attacks in a safe environment using their day-to-day tools. Sooner rather than later we will not send our SOC analysts to battle before passing a simulated training program successfully.

This approach will not only be used to certify and train cybersecurity experts but also to validate our operational procedures and technologies. For example, we will not approve a new incident response playbook before running it in a simulated environment. Just as no aircraft completes production before passing wind-tunnel testing, so will security technologies. Simulation will become the gold standard for validating and certifying new security products and assessing network resilience.

In every other industry – from commercial aviation to medical and defense – simulators are used to train professionals to be ready for action, ready for any possible scenario. We need to bring this same standard of training and preparedness to cybersecurity.  Today, when skills and experience are the bottlenecks, simulation training becomes the most effective and cost-efficient way to improve security and may be your best next spend for your cybersecurity budget.

Adi Dar is CEO of Cyberbit