By Ron Schlecht, BTB Security
The threat of increasing cyberattacks has driven up demand for talented and experienced security professionals. By next year, PwC predicts there will be 1.5 million unfilled job openings.
Companies know they need to hire more security experts, but there aren’t enough experienced prospects in the pipeline. To change course, security organizations need to find faster training and better education programs.
Augmented reality (AR) could be the answer. Already used to train employees in the manufacturing and medical industries, AR systems are a natural fit for cybersecurity training. Augmented reality enables a level of visualization and information sharing that can accelerate the synthesis of information. In addition, AR opens up new opportunities to gamify training and education programs. By breaking down discrete but common tasks and rewarding fast responses, we can reduce complexity and accelerate learning.
The AR advantage
AR involves the overlay of digital information onto the real world. If you’ve ever seen Pokemon Go, you’ve seen AR, but it won’t be confined to your smartphone.
AR’s ability to aid visualization is its real advantage. Imagine a new employee sitting at her regular workstation. A training system throws various scenarios at her, with smart glasses that help her identify an anomaly and quickly fix it.
Because AR systems could deploy on the actual work stations of cybersecurity professionals, colleagues could share visual data or highlight important insights. The question “are you seeing what I’m seeing?” will never be asked again. In fact, augmented reality glasses could help companies leverage the skills of the company’s most seasoned employees, allowing them to supervise employees and solve their thorniest problems.
What’s going on now, and what that tells us
Current AR applications in the workplace can tell us a lot about how it will be used in cybersecurity. Here is a sample of how AR is being used in the real world and how that might translate in cybersecurity:
AR systems are used by technicians who assemble complex wiring harnesses in the construction of jet aircraft. The smart glasses keep instructions right in the workers’ field of view. Think of any situation where a cybersecurity professional refers to a tablet or a smartphone for instructions. AR could heighten response time and improve collaboration.
In construction, architects are using AR to review blueprints. There’s no reason AR couldn’t be used to visualize complex network architectures, giving new security professionals a more tactile way to look at intricate infrastructure.
In schools, there have been demonstrations showing that AR has successfully helped grade-school children learn basic coding syntax. The difficulty of learning to code is one of the biggest barriers to entry in this field, and AR can help get the next generation of cybersecurity professionals involved and educated early on.
Beyond these examples, smart glasses are worn in warehouses, in flight simulators, and in the hospitality industry. Right now, AR’s applications in cybersecurity haven’t even scratched the surface.
A minor threat
AR’s impact on cybersecurity training isn’t all positive. We’ve seen malicious hackers adopt the tools of cybersecurity professionals in the past. Metasploit, for example, is commonly used by penetration testers to find vulnerabilities in networks, and hackers have repurposed it. AR training systems, which might take the form of games, won’t be any different.
What remains to be seen is whether AR will exacerbate the talent gap. Will hackers learn how to be better criminals with AR? Will gamified AR allow criminals to learn faster? What’s going to happen when 9-year-old kids get to walk into a virtual room and pick exploits off of a shelf, not fully understanding that the attacks are very real?
Is this science fiction?
AR will be used to train in just about every industry. Cybersecurity is no different.
But the threat of hackers, and the widespread damage they can do, is only growing. The industry is going to need people from a broad range of backgrounds if it is going to meet demands, and those backgrounds might not always be indicative of talent with computers. With AR, we might be able to help law enforcement officers learn basic forensics. We can help unemployed workers or new graduates find new careers and accelerate their training.
Solving the cybersecurity challenge isn’t going to be easy, and AR isn’t a cure-all, but it can be a vital tool. The industry needs to speed adoption of these systems so we can train faster.