Do You Care About The Professionalisation Of Our Industry? - Debi McCormack

don't get clutched before I've done my talk. So that was a nice welcome. Thank you. Um um for that intro, yes, my name is Debbie McCormack and I am communications director and organization called the cyber scheme which I don't expect many of you to have heard of. We're quite a niche player in cyber security market. We have come from a background of assessing and um training pentesters essentially. So defensive security technical cyber security um about 18 months ago we became a licensed body for the UK cyber security council and we've embarked on this journey alongside them to assess and recommend individuals for professional titles and I've been doing a few of these talks now and just trying to raise awareness of

the importance of professionalization and sort of answer any questions that anyone's got about it because I think it's still renew for people. I think this is a new concept. The idea that our cyber security profession, which has been a bit of a a wild west up to now, I think we all would agree, um, needs regulating and it needs professionalizing. There's two main aims for that. One is the fact that we have this huge competency in skills gap. Um, you have lots of people trying to get a job in cyber, maybe well very well qualified for it. they're not finding those roles and that's because a lack of standardized lack of standardization, a lack of definition, a lack understanding

about what practical skills people need to get when they're leaving education. Um, and so one of the ideas is that we regulate the profession and that we start talking the same language and then that should make it easier for teachers for example and universities to talk about cyber security an established and regulated and professional profession. I mean, I don't know about any of you guys, but I think we still have a bit of an image problem in cyber. We've still got this guy in a hoodie sitting in a data center somehow representing what we all do in our jobs. And I think can speak for myself, but that's definitely never been me. So, um, we have a job on

our hands to talk about this industry in a professional way. The other side of it is the regulation side of it. At the moment, there is no real regulation. and anybody can set themselves up as a cyber security professional and damage that can be done those people giving the wrong advice is actually pretty dire. So we need to make sure that the people offering the advice and doing the technical skills and being allowed onto systems that can break and cause lots of damage are actually the people that they say they are. So there is a huge ethics side to becoming a professional cyber security professional as well. So um without further ado, I will just give

you a bit of a background of the cyber scheme because otherwise I'm just um talking and you thinking what the hell do you know? Um we are NCC assured training and assessment provider. I don't know who's heard of the check scheme in here which allows people to um work on very sensitive infrastructure and government projects and you have to be in CSC to do that. We provide the license to operate uh which is essentially a very technical assessment for pentesters and we've been doing that now nearly 10 years. Um we're also one of the first and now the largest body for the UK cyber security council. First have a quick raise of hands. Who's heard

of the council? Have you all heard of it? Okay. So I don't need to explain what the council's aims are necessarily but um they basically have four licensed bodies. There's ourselves, there's crest, there's IC squared and then there's the chartered institute for information security. So um there's four license bodies. We represent what I would call the technical cyber community which is why I think coming to talks like uh like this at B sides is probably a good fit for ourselves. We don't really get involved in the GLC side. Uh that would be SCXO. But I can point you in the direction if that's the specialism that you work in. I can point you in the direction of the right people

to talk to. Um, we are the only UK assessment provider for the Cyber Advisor, Cyber Essentials Scheme. So, I'm assuming you've all heard of Cyber Essentials and Cyber Essentials Plus. Cyber Advisor is scheme where we assess people to be able to offer them assurance. And again, that's an NCSC assured scheme so that people, not just anyone can sit up and say, I I can give you cyber essentials advice. These people are actually assured and they're given the badge from NSC and we assess them for that. uh we provide consultancy and training services for governments worldwide. So we're often asked to go in country where there's a bit of conflict and quickly train up people that need to

be in country need to get those pentesting skills up to speed. We were in um country recently in an area where they realized that most of the men were actually fighting on front line and we needed really upskill women very quickly to get into those technical roles because we had a massive skill shortage there. So, so that sort of thing where we're often consultancy and and helping governments um and and uh regulators make sure that the standards are kept up within um their their official training schemes. Um we work closely with NCSD and DESIT and all of the regulators so offcom GEM NHS uh MOD um and we provide objective voice. So we have a large

community of people that do their exams and training with us. We hear their pain. We hear their problems around recruitment and and standardization and we feed that back into government organization so that we are bit the bridge between industry and and government. Um and we work with academic institutions and industry. Uh again we we don't really call what is known as the skills gap the skills gap anymore. We we've started to call it a competency gap because it is more about being able to prove competent competency. the practical skills that you're able to deliver. Uh skills can be learned and they can be brute forced and they can be forgotten. Competency is about proving those skills.

Uh we've introduced entry level training uh in 2024 because we've recognized that uh there is a massive gap between academic institutions teaching theoretical cyber and those industries that actually need those people to be on the uh on day one being able to actually develop and and and offer those practical skills and um yeah we're totally committed to professionalizing this industry which is why I'm here today to try and bring on that journey with us. So, professional registration, do do you care yet? And and I'm I'm hoping that by the end of this talk, a few more of you will say yes than maybe at the beginning of it. Um it have funded the UK cyber

security council and will continue to do so until the council is able to fund itself uh in order to to be able to um achieve the remit of professionalizing the cyber security industry. And what I mean by that is um if you think of law or finance or medicine, they have they're very well reggulated industries. You can become a chartered accountant. You can become a chartered lawyer. You have to sign up certain codes in order to be able to become one of those and you have to maintain your professionalization throughout your career with regular assessment, regular um touch bases of making sure that you're doing what you say you're doing. We have we don't have that in cyber

security at the moment. So this is where the council is coming in. and they are they have this remit completely professionalized the industry within the next I would say 5 years I think in 5 years time we'll be looking at people understanding the routine and saying I want to become a chartered cyber security professional and then we get the equivalency there between those people that are lawyers accountants architects or or all those other professional um industries that people heard more of there's four titles within council and they go from associate which is nonspecialism specific. So if you've decided you want to get into cyber but that's kind of where your knowledge finishes. Associate is the title where

you start exploring. You start learning the different specialisms, the different disciplines. You actually start looking at your own attitude and your own skill set because there are people who are going to be very technical and they love coding and they love gaming and there are people that can't think that that there's nothing worse than than being stuck trying to trying to crack codes. So um associate is very much a bit of a sort of beginner version if you like. Practitioner is someone that's been working in a specialism. You specialist you specialized in the field that you're in for maybe one or two years. Uh principal is where you are a senior, you are a team leader, you've started to

manage other people, you started to mentor people, you started to give back to industry. Um this is where we would be looking at people actually creating original thinking of their own. Maybe they're producing white papers. Maybe they're coming and doing talks at places like this and they're giving uh talks about new technology. It's very much at the edge of um the way that the technology and the industry is expanding. And then Charted is is at the very top. These are the people that you expect to have been in top of their game for many years. And they're probably those names that if you're in the specialism that they work in that you will have heard of. And one of the

things about chering is that you are expected to really be at the forefront of development at that point in your career. Um and as I mentioned earlier, we are um one of the organizations that can assure for the check scheme and that is one of the first schemes that has actually mandated professional titles. So in order to work on check contracts which are um CNI uh very very sensitive MOD that sort of contract you have to have from April next year a professional title. So we've got a lot of people that we're working with at the moment who are having to basically figure out how to how to get that roof become um a practitioner at least as a professional

title in order to continue to work on the schemes that they work on. Um so I think the the the message that I'm trying to to give you today is that um there is a a movement here. There's there is a shift and an intention to professionalize this industry that will start with government contracts like the check schemes but it will trickle down. And we've also we've already been seeing large organizations, large consultancies, the primes, the NCC's of this world, the bigger organizations saying, "Well, we need professionalized our industry cuz we're not providing those titles." When government does say, "Oh, actually that person needs to have a professional title to work on this contract." I they're not ready. So we

need to get um ahead of the curve so that when those people are mandated to have professional title they already have one or at least they understand what they need to do to gain one. Um this is not just me sitting here saying come and be a professional. This has actually been built into the uh all of the frameworks the digital um uh capability frameworks that have been completed by um NCSC and GCHQ and within government itself. So this is this very much an intention um and it is part of that government cyber security strategy that was uh written a couple of years ago and gets updated. So I think you know this is this is definitely

something that's coming from above rather than something that industry is driving. It's definitely a government-driven um initiative and actually with the change government with uh that we had last year they have given us indication that they are going to be taking this even more seriously. So this isn't going to go away anytime soon. These are the specialisms that are currently recognized by the UK cyber security council and um this is an an evolving landscape. If you think about where the council was 2 years ago, it hadn't even considered AI for being specialism on its own. OT and IoT is not something that's considered either and quantum is still not on anyone's uh radar yet. So, this is going to evolve.

This is going to be an ever evolving landscape, but we are hoping to be able to stand up um uh specialisms on a fairly regular basis and the ones that are in the brighter colors there are the ones that have already been stood up and that you can go and get a professional title in right now. If you decide that you're ready uh and that you've got the experience, you can you can go and get recognized in one of those areas. Um security testing as I say that is linked to uh being mandated by government organizations and that's the one that we are seeing most most people come through and get titles with with us at the

moment but we are also able to assess incident response secure ops cyber security management is a new one as well which is for more sort of CISOs and managers and those people that are coming up with strategic defenses. Um so that one is being looked at at the moment. The rest of them are on a road map that will probably take the next 2 or 3 years to complete all being well. But um as I say, it's evolving and changing at a huge pace. So it's about making sure that we get our priorities right and we're professionalizing people in the right areas. Um these are the five sort of pillars if you like of competence that someone

that's decided that they need a professional title will need to be able to demonstrate. um that first one knowledge understanding and experience that's where your yours are going to sit. So if you've got SIP, if you've got a CRT, if you've got cyber scheme team member, that's where you demonstrate your technical process. Um the other ones are what we call the soft skills. Although I I don't like the term soft skills. I think that's a bit letting them off the hook a little bit. is where you need to prove that you are uh educating mentoring teaching also learning and that you are standing up to a very strong ethical code working within the law. Obviously hackers they

have to really understand the difference between the good and and not so good uh when they when they break into stuff. Um so they have to have a very clear understanding and that is assessed that you make sure that you stay on the right side of the law at all times. Uh integrity is about making sure that uh if you are working on sensitive projects, you don't go around telling anyone about it. A lot of the um assessments that we have are completely redacted. You know, people are giving us experience and they're not actually telling us what the organization was, what the software was that they were working on. And that's fine because you can still talk about the knowledge that

you've gained from that project without actually having to give us any s sensitive information. And then that final and personal commitment is about you essentially deciding that you want to be a professional in this industry. And that that means that you have to commit to it. You have to give back. You have to be able to prove that you are doing stuff to help those people, you know, put the ladder down and bring those people up underneath you. Share your technical knowledge. Share whatever you found that you think might be of interest to this industry. is I think we're very good at working in silos as an industry. We're very good at sort of keeping stuff close to our chest and we

we can't do that. We have to be able to share look at the the local the the recent hacks. I mean, you know, it looks like JLR have been have been hacked by the same organization that got M&S. You would hope that there is some collaboration going on there because if there isn't, they're just going to do it again. So, um that's sort of where the commitment comes into. I'm going to I'm going to impart my knowledge and I'm going to continually learn. Um, on the subject of learning CBD, I imagine if I ask you what you think you know about CPD, you're all going to say you understand what it is. That's one of

the reasons why some people will be here today, right? Sitting here going, I get CPD for going to um, conferences. I think one of the things that we're going to have to change about CPD is is people's understanding of it being something that is a nice to have and it's great if you get your certificate. Uh it doesn't really matter cuz no one's holding you up to account. No one really cares whether I'm doing a CPD. If you've got a personal title, they will they will care very much and you can actually be struck off for not maintaining CPD. And one of the biggest challenges that we're facing um a licensed body is how do you actually align what someone says

that they've done for CBD and what they've actually learned from it. So that's great. You went to infoset Europe. Did you sit at the bar the whole time or did you actually go and listen to something and learn about it? Write a report about what you'd learned. Did you actually contribute? Did you did you uh ask to be a speaker? Do you have something that you would like to impart? That sort of CPD that actually counts. Um at the cyber scheme, we're um actually developing a program which we're calling assured CPD on behalf of the council where you get assessed for CPD. It's not just about ticking a box and saying, "Yes, I went to that

conference. Yes, I've read that book. Yes, I've spoken to that expert." is actually about having an interview and being able to demonstrate that you've learned over the course of a year that you've been you're being um assessed for CPD. I think there is a commitment of about 75 hours over a 3year period. Um but we are saying that we are going to stop recognizing time as being something that you can um that you can uh give because we don't really you know someone could sit and learn something and take them 12 hours somebody else it could take them half an hour. We're actually going to start looking up points and your assessment is based on the sort of

technical assessments that you might have to pass to to get that CPD. So uh within the cyber scheme obviously we do have an offensive security background. So these are sort of uh assessments that we will be offering people and they can learn and they can say so I already work as a pentester but I don't really have to work in the cloud at all in the job that I currently have. I know I need to learn about cloud security. I know that's a skill I'm going to have to be able to demonstrate at some point in my future career. So we would say go and learn about cloud security. Come and have an hour's interview with us. Tell

us what you've learned. tell us what you still figure out you need to know because acknowledging knowledge gaps is as important as the knowledge that you've already got. Um and that's how we can assess your journey and align DPD points what you've learned. Um some of these um subjects will be uh exam driven. Obviously security testers are very very used to having exams and they and they very much identify as being uh needing to have the exams to progress. So that's that that's very much the environment that we come from. But we do believe that we need to draw a line under CBD just being CBD that you can gain and CPD that you can actually

properly professionally be assessed for. And I think that's going to be a learning journey that we're all going to be on together because this is not some this is a a fairly new concept. If you think about medicine or um we actually use the um the analogy of pilots actually every year a pilot has to sit in a flight simulator to make sure that they understand the engineering behind the flight the plane that they're flying. Uh if they don't do that they they lose their license to fly. So that's not just about saying oh I went and um sat in a bar at Pilots International and and met someone that works for EasyJet. it's actually being

technically tested and that's the environment that we are um working the council on to to bring in over the next year. So, uh watch this base cuz I think CPD is going to be something that is going to be a bit of a um I think initially we'll probably find some resistance to it. I think people will be saying, "Hang on, you so you're asking me to prove that I've got technical skills. Prove that I've got soft skills. Prove that I've got reporting skills. Prove that I've got communication skills. And now you're asking me to learn something new every year and prove I can do that." And and the answer is yes. Cuz we're not going to get

equivalency with law or accountancy or medicine if we say it's okay to just turn up at infosc. You know, we have to be serious about this. And this is this is a journey that we're all going to be on together. We have um recently had to take some people off the council's register um and say you've got to come back and show us that you've actually learned something over the last year. Um and we we will we support people. We show them where they should go for to fill those fill that learning journey, but it's it's not something that's going to be um a given. um intrinsic part of that CPD journey is what we're calling reflection

statements. This is basically an annual statement. So your CPD you have to revalidate for a professional title every 3 years but your CPD you're basically having to not having to. we're encouraging people to um do every year and submit every year because then you're not trying to do all of your CPD in the last month before your registration um is is set to expire, which is going to be bit of a hard ask, especially if you're having to learn completely new topics. So, we're asking people to fill in what we call a reflection statement. And there's three there's three components to that. The first one is that person's got integrity and ethics. That's really important. um

and actually you can't maintain your place on um on the register unless you signed a declaration to say that you're working ethically. The second one is I am aware of the need to revalidate my professional title and I'm compiling evidence to support that. So that's where the CPD comes in. And in some specialisms, you will be expected to take a three-year exam on top of the um CPD security testing being you need to take an exam with either ourselves or or with Crest to be able to maintain your place on the register. Um I think other specialisms are going to follow suit. Uh especially those ones that have got technical component. And in fact, I I

I'm thinking that G uh is going to go that way as well. Actually, um eventually that you will have to go through a three yearly assessment to be able to prove that you know what you say you know. Um and I'm developing a plan for my development over the next year. So you reflected on what you learned over the past year. You've uploaded your evidence. You've shown us what you've done. You've shown us what you've learned. But you've identified knowledge gaps. You've figured out, oh, I don't know everything that I thought I knew about Active Directory. So I'm going to go and do that modular course and I'm going to make sure that over the next

year I fill in those knowledge gaps and I understand more than I do today. It's a very much a personal journey. Umization is an individual career path. A lot of organizations will encourage encourage push mandate that that their their staff have a professional title. But this is something that you're in control of yourself. It's not something that an organization can can uh tell you exactly what's there to go and get or exactly what you need to learn. It's a very individual journey that you're you're all going to go on. Um and part of that is as I say acknowledging that you don't know everything about a certain subject and thinking I'm going to go away and learn about that. One of

the things that we assess when we um look at someone's application form when they're coming through us for a professional title, we call it a sort of a T frame of knowledge. You got a very deep level of understanding in the discipline that you work in. So, you know, example being obviously someone that is a jobbing pen tester is going to know everything about security testing. They may not know very much at all about GRC. So we are asking them to create a shallow um depth of knowledge across many different areas. So they've got that deep depth of knowledge of the field they're working in, but they are able to demonstrate that they understand different disciplines. Because as I'm as

I was talking about with collaboration, it's really important that we stop looking at ourselves as being these sort of independent bodies that you're you're either technical or you're not or you're you've got your soft skills or you haven't. we're all in this together and and being able to demonstrate knowledge across other disciplines is a good way of being able to show that you care about the industry as a whole. Um so you've got your reflection statement that links into what we're calling a future plan which is basically identifying the knowledge gap that you may have um figured out that you need to fill and that will evolve with emerging technology with emerging threat you know

that something that I won't even mention today will be a a key word in 6 months time we all know how fast this industry progresses and changes so um that's going to be about acknowledging that maybe a thought has come along that you don't know anything about and you need to figure out how you can help uh mitigate against that because this is an ever evolving landscape that we're in. So, I think the biggest um message I can give to you today is is to start planning ahead because um even if CPD at the moment is something that's just in the back of your mind and you know that you're supposed to demonstrate it and

that you're supposed to be able to do it and and I'm sure there are people here that are already within professional organizations that will ask you to demonstrate it. um if you've got an IST squared certificate for example you will be asked to show that you are continually learning um but there is going to be a change in the amount of work that you are expected to do to to produce sufficient CP for it to make sure that you you gain professional title and more importantly that you maintain that professional title because once you've got it at whatever level you're at associate practitioner principal or or chartered you need to maintain it and especially at those

lower levels you need to be seeing progression. So you need to be able to say that you are an associate and that maybe in a year's time you've got the confidence to to go for the practitioner title which is going to have all those implications with promotions job roles being able to be taken more seriously in industry. So that progression is now very much uh aligned with with professional titles and CPD is an intrinsic part of maintaining your your place on that register. Um, so engaging in activities to meet the needs that you've identified and you know that that could be different thing for every single person in this room depending on what role you're in, what disciplines

you work in but making sure that you are keeping evidence that's going to be really vital and that can be as simple as keeping an Excel spreadsheet. We are developing for our registrants a portal where they're able to upload evidence and it automatically align points depending on how technical or how difficult it is. And we also have a a sort of a tiered structure. So if you do an exam with us and you get a pass, you get so many CPD points. If you get a distinction, you get more. And that means basically you've got less points to have to prove yourself with. So um the idea is that we're encouraging people to do as well as they can do the

best job that they can. most CPD points and then you're high and dry. So uploading that evidence is really is really uh intrinsic to to your continuing journey as a professional and uh demonstrating learning outcomes and I think that sort of we we get this sort of complete circle then what you're learning and then you are demonstrating what you've learned and you might doing that by having group discussions in your workplace you might do it by have writing a white paper that you want to get published you might have found an exploit that you want to talk about it's it it could anything to to anyone but it's about proving that you've learned something and that that has basically

made the industry better because if we were all demonstrating learning we're all demonstrating improving our knowledge then collectively the idea is the why the reason why DC are funding us to the extent that they are the reason the government is so behind it is because we're all trying to improve our security posture against what is a hugely growing threat from from nation states especially um as you will all undoubtedly be aware. Um and then it's rinse and repeat. This is a repeat cycle. So once you've started on this journey, it's not just a case of being assessed by a licensed body, getting that lovely certificate and the t-shirt that we give to people. It's about

maintaining that for the rest of your career. And um even if you're at the chartered level, it's not a given. You don't you don't get to just stay there. you need to prove that you are able to stay there and able to um mentor people, give back, be be a real thought leader um because that's the way that we are going to gain recognition. That's the way that we're going to get standardization. So if you've got chartered cyber security professional in security testing, you know, they are they are going to be equivalent to a heart surgeon. So um we need that equivalency to be more understood so that we we're all in an industry that we're proud to say that

we're in rather than you know those kids that are telling the parents that they want to become hackers and the first reaction from the parents is oh no don't do that we've got to change that narrative to being so that this is a professional industry that that we're all in so um that's about it for me next steps I would recommend is that you learn about the regulation road map from the council all of those specialisms that I I demonstrated earlier on are all on the council website and they've all got aligned job definitions and job roles so You may not have seen your job role in that specialism road map at the moment, but there will be um research

that you can do to make sure that you are looking at a title that that most closely aligns with what you do for your day job. Prioritize CPD and and as I said, start recording your achievements from today. whatever you've learned from being at Bsides, write it down, reflect on it, think about it, and and and keep it as evidence because that will count when you make that decision to come get a professional title. Um, and get involved and give back. As I say, as you move up from associate to practitioner to principal, one of the things that you're assessed most on is what you've done to actually help the industry. how you've imparted your knowledge, how

you've shared that knowledge with other people, how you've maybe um persuaded someone that was, you know, going down the wrong side of ethical hacking. You know, you found them in Discord and they've suddenly managed to hack into a game. Talk about professionalizing. Talk about a standardization and maybe get them think about this being an ethical career choice rather than one that's going to get that knock on the door and then trouble. Um, and yeah, my my parting um message is I I think I personally think I mean I live, breathe, and eat this stuff, so I'm going to say this, but I personally think this is a real positive move for the industry. I think it's great that we

are going to be in a few years seen as equivalent to those professions that have been around for hundreds of years. This is such a new industry still. We've got a long way to go to actually see that equivalency so that the careers advisers and the universities and the teachers and and the young people themselves and ourselves as well are seeing our own jobs and our own career paths being equivalent to those people that have studied for years and years and years in other fields that are more recognized and more established. I think if we could say in four or five years that um you've spoken to someone and you say you're a chartered cyber security

professional and they're like wow then a lot of this work will have been achieved. So that's that's where we're aiming for. So um that's it from me. Um thank you for your time. I hope that was interesting. Um I got I think some some time to answer any questions. Um but I have put my email address up there. I'm more than happy to engage with anyone that's got that's got questions as well outside of outside of here. So I think maybe there is >> I think you hand up first. >> Yeah. Hi. I actually used to be in here doing very much. Um why this is asking for annual reflection and the amount of CPD in

there 75 hours is quite a lot. If I as a woman decide to go off and have a baby year out, how is that going to then impact with regard to to revalidating essentially within that profession? You have to do an annual reflection. I'm taking a year out at the end of those years not have paper for that year and that's not just for women. you know time as well but is that going to impact our going forwards hold back potentially lose our profession because we decided to have family >> it's a really good question I I think one of the things I would say is that the annual the annual um reflection statements aren't mandated there's a

threeearly cycle of which is mandated which is your revalidation um so I think it is one of those things where if you know that you're going to be taking a time out of the indust indry, you're going to have to cram you inside a bit. Realistically, it's very similar to someone having to maintain their uh surgery skills, for example. You know, they take some time out of injury, but they wouldn't be expected to just come back in and do an operation on day one after 18 months out. And I think we do need to start seeing our profession in a line with those very highly skilled and highly professional industries. But there is no mandation

every year. It's what we would recommend because it's easier. you know, we don't really want people to be cramming their CPD. Um, if you were to take longer out of the industry, there is an acceptance that you come off the register and you go back on again. That that that is um a possibility. I think because this industry is so new, we're still figuring out what might we're only now seeing those people that are coming through for their renewals of for the first year. So, we we're not actually seeing anyone having to revalidate yet. So I think my other message would be bear with us because this is all new. This is all there's a lot of work going on behind

the scenes to make sure that this stands up in the way that everyone's happy with. But there will be individual cases where it will quite work for as it would be if you decided to become a surgeon and and you took time out. It's going to be equivalent. Consider the failure of professionalism within the IT industry and how it hasn't managed to bring professionalism in there. Does it you really believe that cyber is going to succeed? >> Oh goodness. That's a yes. Um I what I can tell you is that the amount of um backpedaling and change of direction and strate strategic changes that are being made on a weekly basis by the council and by D and by GCQ reflect the fact

that we don't quite know what we're doing yet. Um and every week there's a light bulb moment and it's like a situation like that lady said, "Oh, hang on. What happens if someone takes them out? >> So it's new enough that the changes and get them in. >> It's new enough that we're making changes and it's very very malleable and if anybody wants to be part of the change by the way the council have about eight technical advisory panels that they ask for people's input into. So please contact the council if you want to and say I want to be involved in this because they are asking for involvement. But I would say bear with us. Message

number one. And number two, I do think that the the government are totally committed to professionalizing the cyber security industry. So um it's kind of being mandated by by government. So I would hope that we manage to do it. >> Hi. >> Hi. Um given that the cyber school industry is notoriously bad at page, don't you think this is going to have negative consequence and creating people who don't school well who haveable skills when it comes to techility? For example, I've been working with a 19year-old my son who was tech certified genius yet was picked out school was branded a bad boy because he couldn't sit in the class for two hours at the time. he, you know,

doesn't have any of those social skills that has the ability to cope with this. How can they get on the train actually self inverse engineering by watching YouTube videos and experiments? We is this not going to grind those people into like everything else? I'm pretty sure a none of them have got CS. >> I think I think that's a really good point and I think the intention is that we don't gateep. So our assessment methods at the cyber scheme allow for a huge range of diversity. If you can't engage with someone as a face to face, that's fine. If you rather write everything down and send it to us by post, that's fine. We do not mandate how

you engage with us to show to demonstrate the evidence that you can provide. Um, and we are we have a hugely neurodeiverse um contingent of people that come and do security testing. I think it is probably one of the most neurodyivergent areas of cyber. So we're very used to dealing with people that have got what it doesn't matter that you know everyone's different right we treat everyone as an individual. So I'd say that that's very much being encouraged is that we will um assess people based on this the way that they would like to be assessed. That's that's number one. Um from the perspective of this cutting off channels to people. We're very very aware of that. But I think that you have

to draw a line in the sand. Essentially, we can't regulate this profession without giving people benchmarks to work do. And if we don't benchmark people, then we will continue to see this totally regulated industry where people do go over to the dark side because there's there's they don't see any value in being ethically um assessed. So I I I I'm with you. I and there is a a huge um awareness of being very very open from an assessment perspective and and and and taking on board everybody's differences. But I think we do have to also acknowledge that there are some people who can't communicate and actually one of the key skills in cyber security is to be able to communicate

your findings and that might actually mean that they can't gain a professional title and that's okay. We're not suggesting that every cyber security person in this country needs a professional title. We're suggesting that if it's the right route for certain people and if if there's certain industry and certain career structures that they want to go down that this is something that they can choose. >> It's kind of dangerous. >> They're outside the system. outside the system effectively saying, "Oh, he'd really like a manager millionaire." >> Yeah. Yeah. I There is no those people are going to fall outside of uh what you would see as the norm of um employment anyway. They're always going to be

people on Discord that have got no intention of becoming ethical hackers. Doesn't that's fine. That's that's not who we're we're talking to. I think we just we have to acknowledge that there are people out there I mean I think if you again if you look at medicine as an equivalency um there's probably lots of people out there that would quite fancy someone up but they can't because they don't have the right license for it and that's just the way >> they definitely can't earn large income from what renegade

>> renegade surgery I'm definitely going to use that Folks, I'm really sorry to cut the uh discussion short, but we are out of time. That has been a really really interesting and thoughtprovoking discussion. >> Thank you. Can we have a massive round of