In a domain traditionally lauded for its technical prowess, the emergence of soft skills as a critical factor might seem counterintuitive. Yet, as cyber threats continue to evolve in sophistication, industry experts are acknowledging the indispensable role these skills play.
Cybersecurity is no longer solely about firewalls and encryption. It’s a critical defense against sophisticated attacks that exploit human vulnerabilities. As technology intertwines more deeply with daily life, the interconnectedness of systems amplifies the impact of such attacks.
Protecting against these threats demands a comprehensive approach that includes not only technical measures but also education, awareness, and the development of strong human-centric security practices.
Let’s lay the groundwork with a simple hypothetical scenario.
Adam, a cybersecurity analyst with impressive technical expertise, found a vulnerability in the company’s network infrastructure with the potential to expose sensitive client data if exploited.
However, Adam struggled to streamline his technical findings into a non-technical format. His inability to convey the severity of the vulnerability to key decision-makers led to the dismissal of the issue as a routine technical glitch, assuming it could wait for a more convenient time to address.
In the following weeks, the overlooked security flaw was exploited by a cyber adversary, resulting in a data breach that compromised sensitive customer information. The fallout was immediate and damaging loss of customer trust, legal repercussions, and a significant blow to the company’s reputation.
A cybersecurity analyst, brilliant with code but lacking in communication skills, failed to effectively explain a critical security update to key decision-makers. His lack of effective communication and soft skills hindered his ability to convey the urgency of the situation, leading to dire consequences that could have been mitigated with clearer, more persuasive communication.
While the above example might slightly overstate the situation, it does reflect a significant transformation in the cybersecurity sector. Although technical skills are indispensable for the protection of digital systems, they alone are increasingly inadequate to address the complexities of modern cyber threats.
What are Soft Skills in Cybersecurity?
Soft skills, also known as interpersonal or people skills, encompass a collection of personal attributes and qualities that empower individuals to engage effectively in various personal and professional scenarios.
Unlike technical or hard skills, which are specific to a particular job and often tied to one’s expertise in a particular domain, soft skills have gained increasing importance in cybersecurity. They work in tandem with technical proficiency to establish more robust defenses and responses to cyber threats.
Field Chief Information Security Officer (CISO) for the Public Sector at Presidio, Dan Lohrmann, stressed to The Cyber Express the pivotal role of soft skills in cybersecurity. According to him, strong soft skills play a crucial role in facilitating effective teamwork and coordinated communication during emergency incidents.
“In an emergency incident, strong soft skills enable a team to work together well and communicate in coordinated ways. You don’t want to be meeting someone in person for the first time during a major incident or misunderstand directions, expected actions, etc. Strong soft skills build trust and better outcomes,” stated Lohrmann.
However, before diving into why soft skills are essential in cybersecurity it is essential to understand the key soft skills for cybersecurity professionals and what they are.
Communication Skills
In cybersecurity, the ability to convey complex technical concepts in clear, understandable language is crucial. Professionals must translate jargon-heavy security information into layman’s terms for non-technical stakeholders, enabling informed decision-making and support.
Communication is key, and this principle is equally important in cyberspace.
The Equifax data breach in 2017, a significant event in cybersecurity history, highlights the critical importance of communication in cyberspace. This breach exposed the personal information of nearly 150 million Americans, primarily due to the failure to patch a known software vulnerability. Despite the availability of a patch, internal miscommunication and bureaucratic delays between IT and security teams led to its non-implementation.
“Ability to communicate technical details in a clear and concise manner is a critical communication skill that should be innate. Comprehension of problem statements and addressing those for easily understandable solutions is important to team success,” Senior Research and Intelligence Manager at Cyble told The Cyber Express
Critical Thinking
The capacity to analyze, evaluate, and solve complex problems or challenges by using logical and creative thinking. Critical thinking skills are vital for making informed decisions and adapting to various situations.
Cybersecurity experts must possess acute critical thinking skills to recognize and analyze potential threats. This includes identifying subtle indicators of phishing attempts, assessing risk scenarios, and swiftly making informed decisions under pressure. Critical thinking allows professionals to anticipate vulnerabilities and proactively implement security measures to mitigate risks.
Problem-solving
The skill of identifying issues, evaluating possible solutions, and selecting the most appropriate course of action to resolve problems or overcome obstacles. Problem-solving skills can play a crucial role in resolving cybersecurity incidents efficiently.
The cybersecurity space is dynamic and constantly evolving. Strong problem-solving skills enable professionals to adapt to emerging threats, devise innovative strategies, and respond effectively to security breaches. This involves thinking on one’s feet, creatively finding solutions, and implementing measures to contain and resolve incidents efficiently.
Having individuals on the team who possess not only technical expertise but also the ability to extract valuable insights from past incidents and apply them to current situations is of great importance. It highlights that safeguarding the future is as crucial as defending against present threats.
Cyble Senior Reseracher also highlighted the importance of Conflict Resolution Skills. “In a cybersecurity environment, conflicts may arise, the skill to mitigate the conflicts and come to a resolution is a skill that can be developed through experience and practice under good mentors in an organization,” he told The Cyber Express.
Active Listening
Lack of active listening can lead to ignoring critical feedback from team members, as seen in various incidents where employee concerns about security vulnerabilities were overlooked.
Building trust and rapport with stakeholders—whether they’re clients, colleagues, or end-users—is facilitated through active listening. Understanding their concerns, challenges, and security needs helps in tailoring solutions that address specific vulnerabilities.
By actively listening to feedback and concerns, cybersecurity professionals can effectively align security measures with organizational goals and user requirements.
Empathy
Empathy in cybersecurity refers to the ability of cybersecurity professionals to understand and consider the perspectives, emotions, and experiences of both colleagues and end-users affected by security measures or incidents.
While empathy may not be the first trait that comes to mind in the context of cybersecurity, it plays a vital role in various aspects of the field.
Professionals who practice empathy are better equipped to create user-friendly security solutions, provide support during incidents, and foster a culture of security awareness and cooperation.
Teamwork and Collaboration
This skill involves the ability to work effectively with others, both within and outside the organization, to achieve common goals. It includes communicating clearly, sharing responsibilities, and integrating diverse perspectives and skills. Teamwork is paramount in cybersecurity, and its effectiveness in preventing cyberattacks.
Adaptability and Flexibility
The rapid shift to remote work, especially post 2020 led to increased phishing attacks, showing the need for adaptable security strategies. Being flexible in security strategies is crucial to staying ahead of cybercriminals.
Every organization’s security posture is different, and professionals may require coaching on adaptability to perform their roles optimally in a new environment.
Attention to Detail
Minor oversights in code or security protocols have led to numerous breaches. A prime example of this is the Heartbleed bug discovered in 2014. This bug was a security flaw in the OpenSSL cryptography library, which is widely used for the SSL/TLS protocol to secure internet communication.
The oversight in OpenSSL allowed attackers to read sensitive information from the memory of systems protected by the vulnerable versions of OpenSSL, leading to the exposure of private keys, usernames, passwords, and other sensitive data.
Attention to detail is essential in code development and security protocols to prevent such vulnerabilities.
Leadership and Management Skills
Leadership plays a pivotal role in establishing a security-focused culture. Failures in this aspect have been at the root of many data breaches, emphasizing the need for strong leadership and management in cybersecurity teams.
Emotional Intelligence
Ransomware attacks often rely on psychological tactics. Having emotional intelligence enables professionals to better understand and defend against these tactics, enhancing cybersecurity resilience.
In the context of ransomware, attackers frequently use tactics designed to create urgency, fear, or confusion, prompting victims to act impulsively, such as by paying a ransom.
In such situations, cybersecurity professionals with high EI can better understand these manipulative tactics, allowing them to educate and prepare users and organizations to respond appropriately.
Ethical Judgment and Integrity
Insider threats, often stemming from ethical lapses, have been responsible for corporate espionage cases. Ethical judgment and integrity are critical in maintaining trust and security within organizations.
Honesty towards designated portfolio stakeholders and maintaining highest moral standards is critical to securing any enterprise.
Continuous Learning and Curiosity
The evolving nature of cyber threats necessitates continuous learning and curiosity among cybersecurity experts. Staying updated and adaptive is essential to effectively combat emerging risks.
Emphasizing the importance of staying informed and adaptable in the field of cybersecurity, Lohrmann stressed the need for a proactive approach in keeping abreast of the latest technological advancements and hacker tactics.
“Being curious with a thirst for knowledge and hunger to learn more. We need to be life-long learners with tech changing so rapidly. Also, good communicator – with the more modes the better (writing, speaking, listening). Also, humble but bold at the same time. Don’t be afraid to ask questions,” he said.
Decoding Cybersecurity Decisions
Tim Pappa, a certified former FBI profiler with expertise in cyber deception and online influence from the Behavioral Analysis Unit, highlighted the importance of naturalistic decision-making in cybersecurity during his discussion with The Cyber Express. He drew upon Gary Klein’s research to emphasize his points.
“There have been a few researchers over the past several decades who have developed various models of naturalistic decision making. Gary Klein, for instance, explored how fire commanders make crisis decisions, uncovering that many rely on what he termed the ‘recognition-primed model.’ This approach is rooted in experiential learning, allowing for quick decisions that seem instinctive but are actually informed by past experience and an understanding of what’s likely to succeed,” Pappa said.
Gary Klein’s study, titled “Rapid Decision Making on the Fire Ground,” investigates how fire commanders make quick decisions during emergencies. The research introduces the “Recognition-Primed Decision” (RPD) model, demonstrating that these rapid decisions are informed by commanders’ extensive experience and knowledge.
This study significantly contributes to the understanding of naturalistic decision-making in critical situations. This is particularly relevant to the cybersecurity sector, which frequently demands rapid and high-pressure decision-making.
Pappa suggests that this model can be applied to cybersecurity, considering the dynamic nature of human lives and the complex variables influencing decision-making.
“Naturalistic decision-making challenges traditional models by recognizing the dynamic nature of human lives and decisions. It understands that decisions are influenced by various unknown factors in a person’s life, like relationships and organizational constraints, and these factors can change over time,” he added.
“In criminology and cybersecurity, the distinction isn’t always black and white. It raises questions about whether automated software can identify and follow patterns in a cyber threat actor’s campaign over time and if threat actors consider these factors when exploiting vulnerabilities in network defense, he added further.
Pappa argues for a focus on soft skills, recognizing the necessity for a more humanistic model in cybersecurity. This approach acknowledges the diverse motivations and circumstances of individuals, including cybercriminals.
Bridging the Soft Skills Gap in Cybersecurity
The recognition of soft skills’ significance in cybersecurity is on the rise within the cyber sector. According to the ISACA’s State of Cybersecurity 2023 report, soft skills have emerged as a significant gap in the cybersecurity field, highlighting that 54% of cybersecurity professionals rated soft skills as the greatest skills gap.
These skills are not merely additional qualities but are becoming central in the complex digital space, especially with the advent of AI and evolving global regulations.
The top soft skills identified as crucial for security professionals include communication, critical thinking, problem-solving, teamwork, and attention to detail.
The rise of social engineering attacks—a tactic that preys on human psychology and exploits interpersonal vulnerabilities rather than technical weaknesses is a growing concern. With AI playing a bigger role, these attacks are only going to get harder to detect.
These attacks often leverage trust, persuasion, and psychological manipulation to bypass traditional security measures. Phishing emails, pretexting phone calls, and impersonation scams are common examples of social engineering techniques.
According to the 2023 Ponemon Institute’s Cost of Phishing Study, a staggering 83% of organizations experienced a phishing attack in the past year. A key finding of this study is the identification of poor employee awareness and training as a major contributing factor to these incidents.
No firewall or encryption can fully protect against an unsuspecting employee falling victim to a well-crafted phishing email or a convincing social engineering ploy.
Cyber defenders now need a holistic skill set that includes not just technical prowess but also strong communication, critical thinking, and awareness of human behavior.
Identifying and Cultivating Soft Skills Challenges
The challenges in identifying and developing soft skills within the cybersecurity workforce are multifaceted, as highlighted by both industry insights and academic research.
Cyble’s Senior Researcher observations align closely with findings from broader industry studies, shedding light on the nuanced difficulties organizations face in this area.
He points out that the common assessment criteria in cybersecurity hirings are heavily focused towards technical skills, often based on certifications.
This approach leaves the assessment of soft skills to team leads or managers, which can burden the organizational structure. The need for a more comprehensive and trait-specific soft skills hiring assessment model is crucial for organizational success.
This observation is substantiated by an ISACA report, which shows that while technical skills like identity and access management and cloud computing are heavily sought after, soft skills such as communication and critical thinking are not emphasized to the same extent, despite their recognized importance.
According to the report, the most significant skill gaps identified in today’s cybersecurity professionals include soft skills (55%), followed by cloud computing expertise (47%), knowledge in security controls (35%), and abilities in coding (30%) and software development (30%).
Additionally, Cyble’s Senior Researcher discusses the ‘Talent Crunch & Skill Combo’ issue, highlighting the rarity of finding cybersecurity professionals with both technical and soft skills.
“The industry as it is having a critical shortage of skilled cybersecurity professionals and its rare to find both technical and soft skills, hence organizations have to make do by compromising on either of them and more so on soft skills to keep up with business operations pressure,” he told The Cyber Express.
This forces organizations to compromise, often on soft skills, to maintain business operations. This is echoed in the broader industry context where 59% of cybersecurity leaders say their teams are understaffed, leading to a focus on filling roles with a primary emphasis on technical skills.
The impact of strong soft skills on cybersecurity risk management and incident response efforts is significant. Cyble’s Senior Researcher mention of the need for cybersecurity professionals to evolve their focus beyond IT security to encompass risk management, governance, and compliance is particularly relevant.
As cybersecurity challenges intensify, effective collaboration with various stakeholders becomes critical for audits, legal compliance, business risk assessments, and business continuity planning, necessitating strong soft skills.
Dan Lohrmann, addressing challenges in the modern work environment, particularly emphasizes the difficulties posed by a shift to a largely virtual setting.
Speaking to The Cyber Express, he notes, “Moving meetings and so much conversation online makes it hard to really know someone well. We used to be almost 100% in-person, and we are not going back to those days, but it is harder than ever to learn by osmosis (just being around people).”
This shift has particularly affected the learning and development of younger workers. Lohrmann highlights their unique challenge, stating, “Younger workers can’t see their senior colleagues ‘in-action’ as much – unless the inclusion is very intentional, which is much harder to do consistently on a wide scale.”
His observations point to the need for more deliberate and structured approaches to mentoring and knowledge sharing in remote or hybrid work environments. This is crucial for fostering the same level of learning and professional development that was more naturally facilitated in traditional, in-person settings.
Soft Skills in the Future of Cybersecurity
The future of cybersecurity is increasingly recognizing the vital role of soft skills. As noted by experts, these skills are becoming crucial due to the evolving nature of cyber threats and the integration of technologies like AI and GenAI.
“As cybersecurity challenges intensify, so would the collaboration with various stakeholder to maintain flow of information for audits, legal, Business Risk Assessment, and BCP planning and management. Hence, the soft skills will be more than ever essential for maintaining team collaborations and high level of security in the organization,” Cyble Senior Researcher adds.
While technical skills remain a cornerstone in cybersecurity, the development and integration of soft skills into the workforce are vital for addressing current and future challenges in the field. The concept of ‘human-centric AI’ highlights the need for skills that distinguish humans from machines.
“The ‘human-centric’ part is all about building those soft skills that differentiate humans from robots and machines. I only see the importance of building stronger soft skills growing in the years ahead within cybersecurity,” concluded Lohrmann while stressing upon the need for soft skiils, especially with the way AI is being integrated in day-to-day life, and the tasks involving cybersecurity.
Moreover, organizations need to adapt their hiring and training strategies to create a more balanced skill set in their cybersecurity teams. This balanced approach is essential for the overall effectiveness and resilience of cybersecurity operations within organizations.
Professionals with strong interpersonal skills can play a pivotal role in educating and empowering teams to recognize and resist these attacks. Training programs focused on cybersecurity awareness, incident response, and social engineering simulations can significantly reduce the susceptibility of individuals within an organization.
Furthermore, cybersecurity professional’s adept at understanding and communicating across departments—bridging the gap between technical teams, management, and end-users—can implement comprehensive security protocols and create a culture of vigilance against social engineering attacks.
In essence, the evolution of cybersecurity demands a shift towards recognizing the human element as a critical factor in defense. Combining technical expertise with strong interpersonal skills is the new frontier in fortifying organizations against the ever-growing sophistication of social engineering threats.
