The Canadian cyber security skills framework

3.1 Attributes of a workable skills framework for the Canadian market

By adopting and simplifying the NICE framework for the Canadian labour market and simplifying it, the Canadian framework can be more easily used by businesses and industries who may struggle with interpreting the NICE framework in its original form.

As shown in Figure 3, five key attributes have been identified to be considered when adopting the NICE framework for Canadian use. These attributes were determined based on some criticisms and structural issues of the NICE framework as well as community feedback and consultations.

Figure 3: Desired attributes for the Canadian cyber security skills framework

Specificity and accuracy

While the NICE framework describes the full spectrum of cyber security work roles, there should be a means of focusing on those that are most relevant to addressing the Canadian cyber security skills gap and the Canadian context.

Usability and accessibility

Any framework should allow for ease of use, readability, and accessibility of the content for all potential readers and users. This includes those unfamiliar with cyber security work. More specifically, the framework should not “silo” cyber security, but rather integrate concepts into the broader business/organizational context.

Clarity in constructs

Clarity is required in the constructs used to define cyber security roles and should include not only specialist roles, but generalists, non-technical and cross-disciplinary roles.

Adaptability

To address this dynamic field, there should be a means to rapidly integrate new or emerging roles as a result of technologies such as automation, cloud, artificial intelligence (AI), quantum. Related competencies/KSAs should also be developed to support the breadth of cyber security activities. The framework should be constantly evolving with the work.

Scalability

Any framework should be able to be readily scaled from large to small and medium organizations and different industry contexts. This includes the ability of organizations to identify and develop non-technical talent to support their security needs.

3.2 Adapting the Canadian framework to small and medium organizations

The Canadian framework can be adapted to SMOs. Within cyber security, most SMOs have the following characteristics:

• Lack of in-house cyber security expertise
• “Design and develop” roles are either outsourced or systems and applications are acquired “off-the-shelf”
• Individuals will often fill multiple roles that include cyber security tasks

Consequently, when organizations look at the NICE framework it may be overwhelming. However, there is the potential to identify scenarios or present examples that will help SMOs scale the NICE framework using the Canadian framework. This will also help define role-based KSAs that will support cyber security within organizations.

The following section reviews two common scenarios typically found within SMOs.

1. Medium-sized organization with some in-house IT staff

There remains technical expertise in-house, but several cyber security roles are assumed by those who have other functions. They are not typically cyber security specialists or may have only a small IT section who will be responsible for detection and incident response. In this example, the chief information officer (CIO) would lead the small IT team and assume responsibilities for the technical aspects of the cyber security program while the executive level managers would remain responsible for defining the business priorities and risk landscape. For all “protect and defend” functions, they would likely be assumed by the IT team with specialized activities outsourced to a third party.

Figure 4: Potential technical roles in a medium organization

 

Long description - Potential technical roles in a medium organization

Figure 4 outlines some of the cyber security work roles identified in the Canadian Cyber Security Skills Framework in two of the major work categories and which non-cyber security specialists would likely assume those roles in small or medium sized organizations.

In the Oversee and Govern category:

• The Chief Information Officer, Chief Information Security Officer, and their supporting staff would assume the role of Executive Cyber Leadership, Authorizer, and Cyber Policy and Strategy Planner.
• The Information System Manager would assume the role of Information Systems Security Manager.
• The Program or Business Line Manager would assume the role of Program Manager.
• The Chief Information Officer and their supporting staff would assume the roles of IT Project Manager, Product Support Manager, IT Investment Manager, Portfolio Manager, Procurement Specialist, and Supply Chain Integrity Analyst.
• The Chief Financial Officer would assume the role of financial and financial and risk analysts.
• The Communications Officer would assume the role of Communications Specialist.
• Legal Counsel would assume the role of Legal Advisor, Privacy Officer, and Privacy Compliance Manager.
• The Chief Learning Officer or Human Resources Officer would assume the role of Cyber Instructional Curriculum Developer.

In the Protect and Defend category:

• The IT Manager, Systems Manager, Chief Information Officer, or Chief Information Security Officer would assume the role of Information Systems Security Manager for Cyber Defence Operations.
• IT help desk, Client Services, and Systems or Network Administrators often have cyber defence tasks, and would assume the role Cyber Defence Analyst, Cyber Defence Infrastructure Support, Cyber Defence Incident Responder, Vulnerability Assessor and Digital Forensics Analyst.

2. Small organization with limited IT dependence and no IT staff

Most technical work roles would be outsourced, but the primary “oversee and govern” cyber security functions would remain within the organization. This individual would effectively be fulfilling the role of the ”security generalist.”

Figure 5: Potential outsourced technical roles in a small organization

 

Long description - Potential outsourced technical roles in a small organization

As shown in Figure 5, the Security Generalist in a small or medium organization would assume the Oversee and Govern cyber security functions, such as identifying their organization’s cyber security requirements and priorities. However, the technical work roles from the Design and Develop, Operate and Maintain, and Protect and Defend work categories would likely be outsourced to a third party. This includes IT and cyber security products, services and expertise.

3.3 Cyber security generalist

Within many SMOs and even within larger organizations that are not heavily reliant on Internet-based activities, there are individuals tasked with cyber security responsibilities who may not have any IT or cyber security background.

Given the number of SMOs within the Canadian business landscape, this represents a very large cadre of individuals within the Canadian labour market that have primary responsibility for establishing and managing cyber security within their organizations but may not have any of the discrete roles as defined in the NICE or the Canadian framework. Typically, they:

• perform cyber security functions on a part-time basis in conjunction with other responsibilities
• only require cyber security KSAs to correspond to their business, technical, and threat context
• are not considered cyber security professionals and do not have a cyber security career trajectory

In absence of a term, this framework uses “security generalist” to differentiate them from cyber security specialists identified within the core roles. The security generalist within an organizational setting is typically not a specialist in any security area, but is often responsible for personnel, physical, contract, and loss prevention security activities as well as cyber security. It’s not uncommon, for example, for the chief executive officer (CEO), chief information officer (CIO), chief financial officer (CFO), corporate security officer, human resources manager, or senior administrative official to assume such a role.

Common tasks include:

• Assessing the organization’s cyber security posture
• Facilitating identification of organizational cyber risks
• Identifying non-technical cyber security controls
• Identifying and liaising with technical experts, internal or external, on technical controls
• Developing organizational cyber security plans and policies
• Advising leadership on security awareness and training
• Monitoring and support technical experts, whether in-house or outsourced, in their cyber security functions
• Coordinating cyber security incident response
• Monitoring and reporting on response and mitigation actions and recommend courses of action based on technical advice
• Coordinating post-mortem activities on events and incidents, integrating lessons learned into organizational policies and procedures

For many of these tasks, there are ample online resources available to guide the security generalists in their duties. Underpinning effectiveness in these tasks, however, are KSAs needed to support decision making and action. It’s unlikely that they will have any extensive cyber security training or education. Accordingly, they should be offered sufficient learning opportunities to attain the required competencies required for their roles as well as the potential threats, necessary technical skills, and business requirements. As shown in the examples in Figure 6, this typically requires competencies borrowed from some of the work roles within each major work category.

Figure 6: Security generalist functions

 

Long description - Cyber security generalist functions

Figures 6 outlines the competencies from each major work category required for a Security Generalist in a business-oriented role.

Oversee and Govern: Risk Policy and Program Management

Design and Develop: Requirements and Project Oversight

Operate and Maintain: Monitoring and Control Management

Protect and Defend: Vulnerability Management and Incident Response

Basic knowledge

• Technical context (e.g. organizational IT infrastructure, software, devices, and policies)
• Cyber threat context (including deliberate, accidental, natural hazards)
• Business context (priorities, objectives, market, trends)
• Legal, policy, and ethical context for security
• Cyber security risk management as part of organizational risk
• Cyber security incident management (domain-specific)
• Cyber security processes, technology, trends, and emerging issues
• Sources of cyber security expertise and resources

Basic skills and abilities

• Providing business advice within the legal and policy cyber security context
• Exercising foresight and security planning to support digital business activities and growth
• Translating cyber risk to corporate risk
• Differentiating between compliance and risk
• Interpreting threat and risk assessments for the business context
• Assessing effectiveness of security controls against organizational security objectives

Common competencies

For all core cyber security roles regardless of activity area/work category, there are a number of common competencies that are applied at the basic, intermediate, or advanced level depending on the role. All cyber security professionals, regardless of role, should have a basic ability to apply the following in their work domain/context:

• IT systems and networking
• Systems architecture and models
• Internet protocols, systems and devices
• Cyber security foundations
  • Integrated security framework
  • Cyber security strategies and approaches
  • Threat landscape and common threat surfaces (personnel, physical, IT/logical, supply chain)
  • Cyber threat intelligence process and sources
  • Cyber security analytics
  • Cyber security management policies, processes, and best practices
  • Cyber security systems, tools, and applications
  • Legislation and compliance (e.g. privacy, information sharing, reporting, mandatory standards, etc.)
  • National and industry standards
• Problem-solving and complex thinking in dynamic environments
• Maintaining broader security situational awareness
• Self-awareness regarding knowledge, skills, and abilities required to respond to business, threat, and technical changes

3.4 Core cyber security roles

Recognizing that cyber security is a shared responsibility, this publication describes the cyber security occupation in terms of work that is typically conducted full-time and requires unique KSAs relative to other occupations. Moreover, as per the Canadian Cyber Security Skills Framework, the cyber security occupation is further defined in terms of titles/work roles that are relevant to the Canadian labour market and broader business community. These fall within four major cyber security activity areas or work categories: oversee and govern, design and develop, operate and maintain, and protect and defend. These activity areas/work categories and the inherent work roles are further defined in Annexes A, B, C and D (available upon request).

The core cyber security roles are divided into major work categories/occupational sub-groups similar to those established in the NICE framework ^{Footnote 4}.

• Oversee and govern: Overarching responsibility for this occupational sub-group is leadership and management of the cyber security program. This includes technical and non-technical roles.
• Design and develop (securely provision in the NICE): This occupational sub-group supports design and development of the digital infrastructure, systems and software. This includes largely technical roles.
• Operate and maintain: The primary responsibility of this occupational sub-group is ensuring secure operations of the digital systems and data management. All roles within this sub-group are technical roles.
• Protect and defend: This occupational sub-group is focused on cyber security operations. All roles within this occupational sub-group are technical roles.

Common competencies (cyber security professional foundations)

For all the core cyber security roles regardless of activity area/work category, there are a number of common competencies that are applied at the basic, intermediate, or advanced level depending on the role (as listed in Section 3.2). All cyber security professionals, regardless of role, should have a basic ability to apply the following additional competencies in their work domain/context:

• Continuous learning to support currency in knowledge of emerging threats, technological innovations in security, and the changing cyber security landscape
• Communications (oral and verbal) suited to organizational context including drafting and writing technical reports
• Strategic thinking and business acumen to include understanding the business and risk context for cyber security
• Teamwork/collaborating with others including non-cyber security professionals
• Ethics and professional responsibilities
• Cyber security training and awareness within their domain

3.5 Cyber security adjacent roles

There are also numerous roles associated with other organizational functions that typically contribute to organizational cyber security outcomes on a part-time or ad hoc basis ^{Footnote 5}. These are cyber security adjacent roles where some cyber security KSAs are required, but they are not typically considered cyber security specialists ^{Footnote 6}. For example, in most organizations, a business or policy analyst will likely be employed on a broad range of issues, only some of which will be in support of organizational cyber security. This is not to detract from their role in supporting organizational cyber security, but only to suggest that their work involves often much more than strictly cyber security.

Similarly, executives, program managers, policy analysts, financial analysts, communications specialists, enterprise architects, IT technicians, etc., may have cyber security responsibilities but do not have full time cyber security functions and are not considered core cyber security roles in this publication. These roles are identified in Annex E (available upon request). A sampling of typical cyber security adjacent work roles is provided in Table 1 below. While they have cyber security responsibilities and require specific cyber security knowledge, skills, and abilities, their primary responsibilities are often either broader or focused on other activities that are not directed towards cyber security. Note that the “protect and defend” category is not included in the figure as that activity area or work category is exclusively employed in cyber security.

Table 1: Sampling of typical cyber security adjacent work roles