Within the last five years there has been a widespread drumbeat of concern about the perceived difficulty of finding qualified people to defend the nation’s networks, currently under assault by terrorists, spies, and criminals.

According to a 2010 story on NPR, “There may be no country on the planet more vulnerable to a massive cyberattack than the United States, where financial, transportation, telecommunications and even military operations are now deeply dependent on data networking. U.S. industry, government and military operations are all at risk of an attack on complex computer systems, analysts warn. What’s worse: U.S. security officials say the...

When demand rises sharply and supply is relatively unresponsive, the result is usually higher prices. In markets where prices are constrained—for example, the market for oil in the 1970s—shortages are another consequence. Within the last five years, the demand for cybersecurity experts has risen substantially, while the mechanisms for raising the supply of such experts—education, recruitment, training, accession decisions—take time to reach fruition.

As a result, those who have such perceived cybersecurity skills benefit from a seller’s market. Those who need people with cybersecurity skills pay higher prices or have unfilled positions. Within the U.S. federal...

Although the current straits of the market for cybersecurity professionals did not arise the day the computer was invented, they were not newly discovered in 2014 either. Concerns that the nation would not be able to find enough people to protect its systems (and intrude upon those of its enemies) date back at least five years, to President Bush’s Comprehensive National Cybersecurity Initiative (CNCI). Its eighth (unclassified) initiative out of 12 called to:

Expand cyber education.While billions of dollars are being spent on new technologies to secure the U.S. Government in cyberspace, it is the people with the right...

To build up an empirical record in furtherance of prior studies and in support of theoretical considerations, we carried out semi-structured interviews with representatives of five U.S. government organizations, five education institutions, two security companies, one defense firm, and one outside expert.¹ What follows is based on these interviews, supplemented as necessary by other material and coupled with analysis as needed to address particular issues.

This section is organized into three topic areas: the experience of large employers of cybersecurity professionals, the perspective from the schoolhouse, and a treatment of particular issues and related policy options.

Organizations, particularly large ones,...

In this chapter, we review some of the insights from the fields of labor economics and personnel economics, to shed light on facts we observe in the labor market for cybersecurity professionals.¹ We begin with a simplified view of how fundamental market forces may explain recent empirical observations about the cybersecurity workforce. We then turn to a number of important factors that complicate this simplified view, including differences in human capital and constraints on the federal government’s ability to raise wages.

Figure 4.1 presents a simplified view of the labor market for cybersecurity professionals. In the recent past—2007 is...

This chapter has two parts. In the first, we address the usefulness of differentiating the market for upper-tier cybersecurity professionals, where the labor conditions are particularly tight, from the market for other cybersecurity professionals. In the second part, we explore approaches that may be considered and have been advocated as ways to address the current difficulty of finding qualified cybersecurity professionals.

Even if the supply of most cybersecurity professionals can be satisfied by the systematic application of well-understood techniques for acquiring people and moving them through training, the same cannot be said for upper-tier cybersecurity professionals, of whom there is...

Early in our work we discovered that there was a broad consensus on a perceived shortage of cybersecurity professionals. The argument goes as follows. Everyone wants better protectors in cyberspace. Good people are snapped up quickly, and the best people tend to jump from employer to employer, with each move bringing an upward ratchet in compensation. As a result, the national security establishment in particular, and the country—perhaps world—as a whole is far more vulnerable to cyberattack than it thinks it should be. This is a crisis that requires an urgent remedy.

Our assessment does not refute this...