Cyber Crime Competes Against the Good Guys for Talent

The expression, “criminals have to be right only once, while network defenders have to be right all the time” has merit in a digital global environment that favors the attacker over defender.  Cyber crime’s evolution and its increasingly more diverse and organized ecosystem contributes to its success and popularity.  Cyber crime activities cost the global community $600 billion in 2017, with some estimates projecting to impact companies $5.2 trillion over the next five years.

One factor that has benefited cyber crime is the professionalization of the threat space.  Previously more disparate, the underground functions very much like legitimate businesses operating under a “supply and demand” philosophy.  Product/service competition and as-a-service offerings fuels the growth of the maturing marketplace.  This forces developers and sellers to provide quality merchandise at competitive prices.  An aggressive marketing strategy helps gain market share with favorable reviews from customers and forum administrators providing corroboration of production utility and the bona fides of sellers.  It is common for sellers to offer 24×7 help support, as well as customizable features to prospective customers.

Moreover, the goods and services provided in the underground are not exclusively tailored for experienced cyber crime actors.  Some products target inexperienced customers thereby lowering the bar to gain entry into cyber criminal operations.  This allows anyone that can pay the price point to engage in hostile activities, either on their own via user-friendly graphic user interfaces, or just paying for the service, hiring “professionals” to do the job.

Now, it appears that cyber crime finds itself in a similar position to network defenders looking for experienced and capable individuals to support their industry.  In 2018, it became clear that there was a dearth of experience individuals in the cyber arena.  According to a leading research organization for global cyber issues, 3.5 million cybersecurity positions are expected to be unfulfilled by 2021.  The same sentiment has been expressed by some U.S. government entities, indicating that it is not solely a private sector problem.

Cyber crime has thrown its hat into the ring, trying to entice the best and brightest to don a black hat in favor of a white one.  According to a recent report from a computer security vendor, cyber criminals are willing to pay more than a million dollars a year to skilled security professionals.