Increasingly, large businesses are growing and developing their own senior security managers rather than hiring in from outside according to security chiefs taking part in a recent tISS online workshop. The workshop, Structuring and Staffing the IT Security Depertment, revealed that CSOs struggle to find security managers who can ‘take the decisions needed’ about how security works in a business context. Whilst the skills market appears abundant with people who understand the security bits and bytes, far more scarce are those who understand how security as a concept and process can be applied within a specific business environment - and where they can be found, they’re very expensive.

As a result, many businesses are re-training and re-skilling their own people to have the right security skills and qualities.  Many security officers are taking people with a non-security background - but with a strong understanding of either business or technology - and supplying the missing skills. This way, they say, they can meet the business’ growing need for security/business expertise without having to resort to highly expensive specialist agencies and suppliers.