Cyber Strategy and Talent

Editor's note: This article is part of a series of short articles by analysts involved in the Cyberspace Solarium Commission, among others, highlighting and commenting upon aspects of the commission's findings and conclusion.

Central to the 2018 National Cyber Strategy and the 2018 Department of Defense Cyberspace Strategy is how to recruit, retain and utilize a talented cyber workforce. Both strategies tackle talent head-on, calling for programs that streamline hiring, create rotational work opportunities, institutionalize cyber talent as core competencies within the U.S. government, and outline short-term training and long-term educational investments to create, develop and sustain the cyber workforce. Despite these initiatives, the U.S. will have a long way to go to compete (both at home and abroad) to harness and retain cyber talent.

Why is cyber talent such an important and yet challenging obstacle for U.S. cyber strategy? First, there is a limited supply for this talent and a lot of commercial and foreign competition. This problem is exacerbated for the U.S. government because its recruitable talent pool excludes foreigners, individuals with a past history of drug use, those with significant foreign contacts, or (for the military) the ability to pass physical fitness standards.

The U.S. has not helped itself solve this problem, with significant security clearance backlogs as well as antiquated information technology interfaces for job applications and day-to-day administration. Military recruiting presents additional challenges with arcane health barriers for entrance. Top cybersecurity professionals with asthma, some dental implants, IBS, or problems with the arches in their feet may not be medically qualified to serve in the armed forces (as well as those who have suffered from depression within three years or who have allergic reactions to fish, insects or nuts). Finally, the federal government lags behind the civilian sectors in nonsalary benefits like high-quality child care, flexible hours or workspaces, or nonlinear career progression models.

To tackle these challenges and find strategic success will require cultural, organizational and technological changes for the U.S. government.

One of the major barriers to successfully recruiting and retaining cyber talent is cultural. For government civilians as well as military professionals, there is a large divide between technology hubs and U.S. government workers. During the post-Cold War years, the U.S. government retreated from pricey tech areas, abandoning military and government installations and focusing on states with heavy congressional representation (and often cheaper property). Further, as the military became a smaller and smaller percentage of the overall U.S. population, the divide between civilians and military personnel became a significant challenge to successfully attracting top talent.

The U.S. government needs to reinvigorate its presence in high-tech areas like Silicon Valley, Boston, Austin and North Carolina (some of this is already underway). It can also be done by engaging with academics at research universities and in graduate education. Finally, the U.S. needs to build on initial moves for creative career progression opportunities, including fellowships in the civilian sector, normalized transitions between the reserves or National Guard and active duty, or sabbatical periods.

In examining cultural barriers to recruiting talent, the armed forces may need to evaluate standards for grooming and physical fitness, especially what requirements are necessary for the warrior of the future. Technologists embedded within combat units may need to follow the same physical standards as other combat specialties, but others further away from the line of fire may be top contributors even with poor fitness scores. Further, many of the ailments that disqualify individuals from military service need to be reevaluated, especially for cybersecurity direct accessions.

Organizational solutions are also important. Initial efforts to streamline hiring for cybersecurity professionals, test for technological skill sets, identify programming capabilities, and invest in scholarships and reskilling academies are strong first steps. However, without complementary changes in promotion structures, any steps toward recruitment might not solve retention problems in the long term. Additional focus on providing certifications, unique training on emerging technologies, and opportunities to employ or experiment with innovative technologies can help with retention.

The reserves and National Guard also provide a potential solution to cyber talent within the armed forces. Because these forces are often employed in the civilian sector, they benefit from cutting-edge training and experience. There are, however, significant caveats about using the reserves and National Guard as the primary solution to a technological talent gap in the active duty. Over the past 15 years, the reserve and National Guard force has become more like the active duty, deploying in place of active-duty units and prioritizing the growth of full-time personnel. While that has solved many of the difficulties of fighting multiple wars with an all-volunteer active-duty force, it has also made the reserves and National Guard less useful as an outlet to attract nontraditional talent. Highly successful talent is less likely to opt for these active-duty lite reserve and guard billets. To solve these issues, the U.S. should explore a strategic cyber reserve that maintains nontraditional cyber talent in true reserve and provides project- or situation-based orders when necessary and based on strategic reserve members’ talents.

Technological solutions are also available. Many of the challenges faced by the U.S. government can be solved with investment in better information technologies, especially IT that streamlines personnel actions, travel and training. If the U.S. government wants to retain top talent—across capabilities and skills—it must see investment in IT administration as a priority as high as acquiring new missiles or radars. Further, investment in IT for human resources can create databases of special skills, align those skills with appropriate jobs, and track successes and problems in talent recruitment, use and retention.

This is just the first stage in implementing the U.S. cyber strategies. The next stage and the real linchpin to ultimate success is in understanding how we will prioritize the resources required to recruit and retain cyber talent and ultimately determining how to know investments we are making in talent are worthwhile. This is especially difficult for the investments in long-term talent. Finally, there is an increasingly complex relationship between civilian and uniformed cyber talent. While many of the solutions to the talent shortage are to leverage civilian training and talent resources, the question remains which of the tasks must be handled by armed service members and which by civilians.