As published on Computing
For years, the IT skills gap - the shortfall between jobs and the skilled workers to fill them - has challenged companies in the UK. Despite, or maybe because of, its position as a fast-growing sector, there simply aren't an adequate number of applicants.
Earlier this year, the chief executive of the National Cyber Security Centre said that the NCSC finds it a "constant and difficult challenge" to recruit the expertise it needs. Private companies also struggle to fill their technical roles, with cyber defence being among the most in-demand but hard-to-find skills.
Karl Greenfield, head of cyber security at Capital Network Solutions, has been in the industry for 30 years and has led firms in London, Bristol and, now, Cardiff. He believes that the ease with which hackers can pull off attacks, with tools like exploit kits, bears a large part of the blame for the skills gap:
"It's mostly down to the fact that cyber attacks have got extremely easy now… You can watch a 40-second video on YouTube and pretty much anyone can do it… [Combined with] Google-type databases like Shodan, which will actually report people that are vulnerable - that's all meant that you're far more likely to have been hit over the last 10 years."
Greenfield points out that concentrating the UK's cyber industry in one city isn't helping matters. Even if many cyber experts move to London, the pool of available people is much smaller than it is across the country as a whole.
"I set up the first UK Cyber Academy [PGI Cyber Academy], and we were recruiting in London. We had extreme difficulty getting anyone at all, let alone being able to separate the wheat from the chaff… The quality was quite inconsistent.
"In Wales it's a totally different story. I could have filled the last role that we advertised with eight additional people, and we weren't paying anywhere near as much money as I would have had to eight years ago in my previous life.
"[Wales] is bucking the trend somewhat in that we've got this huge capability and I don't think we have enough jobs to go around."
New institutions like the National Cyber Security Academy, part of the University of South Wales (USW), are helping to close the skills gap. Greenfield was involved in establishing the Academy and has recruited multiple graduates from USW - some of whom have returned to teach there.
The Academy, which began running its first full-year course in September 2017, offers courses accredited by both the National Police Chiefs Council and the NCSC. The aim is to prepare graduates for work in a more practical way.
USW has run traditional Bachelors and Masters courses from its Treforest campus for several years, but recently opened the Academy at its Newport campus. Students here have half of the formal teaching input, and use the rest of their time to work on industry projects.
"In the Academy, the idea is that students are working with the people that are going to employ them, right from the outset," says Clare Johnson, who leads the academic cyber security programmes at USW. "We've built it as a workplace environment: the students have their own desks, their own computer, they can put up posters in their bays and fill their drawers with whatever they want, just as if they were going to work…
"The Academy model is very practical; it's much more work-focused; and when [the students] leave at the end of three years, they'll already know how to do a presentation to a company, how to write a report and how to project manage."
These are important skills for modern IT workers, which a traditional degree programme would often skip.
Cyber security is such an area of growth that it has exceeded the ability of existing workers to fill the gaps - similar to web developers in the early days of the internet. Johnson sees the work of the Academy as critical to changing that.
While a traditional graduate might leave university with an impressive degree and a huge knowledge base, they lack practical workplace skills
"That's what we're trying to do at the Academy; at the end of their degree, we can literally deliver graduates who know all those processes, how business works, how to talk to the CEO and how to talk to a customer."
The close community of the South Wales Cyber Cluster ("I think we've got the biggest Cyber Cluster in the whole of the UK aside from London," says Johnson) has helped in setting up the Academy.
"There's a really good community network. We all sort of know each other, we all know who to go if we've got any specific needs; and we try to complement each other rather than compete with each other too much… Everyone is there [in the Cluster] to develop the skill sector in Wales even further and build on what we've already got."
For his part, Greenfield is thrilled with the work that USW is doing at the Academy and the people he has recruited.
"[USW] has been absolutely invaluable, otherwise it would just be one or two old guys like myself [at the company]...
"At different parts of your life you have different capabilities and different strengths. 30 years ago, concentrating on a particular piece of code for days on end was well within my capabilities. Now the micro-focus capability is starting to go, but the holistic knowledge of how the industry works and conveying ideas to other people - my capabilities in those areas have grown.
"The fact that we've got diversity of ages, sexes and abilities helps. It's always good to have different people bring different strengths to the team."
The Cyber Academy is now in its second full year, with a fresh intake of 40 students - more than double those in the first year. For the sake of security, may the growth continue.