February, 2019

Shortfall of Human Resources in Information Security and its Solutions:
Plus (+) Security Human Resources (SUMMARY)

Human resources in the area of information security can be largely classified into two types: security
specialists, who belong to IT vendors/Security-related companies and are mainly engaged in security issues,and plus (+) security human resources, whose members require security skills for application of IT in theirprimary tasks. This report illustrates the major shortage found in the area of plus security human resources
and suggests appropriate measures to be taken. The objective of the report is to facilitate an understanding
among IT vendors/Security-related companies, relevant government agencies, and the management ofbusiness operations, general affairs divisions, andHR divisions of ICT user companies regarding the“necessity of plus security human resources for their respective organizations. In addition, measures such as
the cultivation of human resources based on the full use of Japanese corporate culture are suggested.

I. Human resources in the area of security must be understood as consisting of security
specialists and plus security human resources
A large portion of the current shortage in human resources in the security area is attributed to a shortageof people who belong to ICT user companies and have the skills to secure and manage the information
security of their individual companies. Such individuals are not necessarily specialists of such security. A
report by the Ministry of Economy, Trade, and Industry (METI) in 2016 also indicated a shortage of workers(approximately 124,000) who are acquainted with information security for the daily use of IT in ICT usercompanies (see the figure in the red box of Chart 1). However, the total shortage of human resources in thesecurity area for IT vendors/ Security-related companies and the section of information systems of ICT usercompanies (or security specialist resources as defined in this report) remains relatively mild at approximately
9,000 (see the figures in the blue box of Chart 1).

Page 1

The cultivation of security specialists has traditionally been considered an urgent issue in easing theshortage of human resources in the security area. However, recent reports have indicated that such
shortages are more serious among the wholesale, retail, medical, and welfare industries, among others, ascompared to the information services and telecommunication industries. Human resources in the area ofsecurity required by the former industries are not necessarily security specialists such as white hackers.
Despite this, it is still widely believed that society is lacking human resources such as white hackers, withgovernment measures also placing an emphasis on technical elements. In reality, however, in ICT user
companies requiring security skills regarding the use of IT in their primary tasks, the category of humanresources that is currently facing a significant shortfall is plus security human resources. For this reason, thecultivation of human resources in this category remains an urgent issue.

II. Periodic personnel transfer is a good opportunity to cultivate plus security humanresources
The Japanese style of frequent personnel transfer every few years is thought to be a negative in terms ofthe cultivation of specialists. However, a type of rotation cycle where a company staff member is assigned to
an information security section to learn relevant skills before returning to the business field while anotherstaff member is concurrently assigned to the same security section extremely favors the cultivation of plus
security human resources, of which there is currently a shortage of more than 124,000. In other words, sucha cycle will facilitate the formation of a “local fire brigade of information security” in the business sector ofvarious companies, namely, a group of staff members who, while typically engaged in their own tasks, also
gather as a response to deal with security incidents that occur in their company. For this purpose, it is also
important for individual ICT user companies to visualize the career paths of those staff members who haveacquired the relevant security skills and experience.

Page 2III. There is no way to determine the areas of scarce human resources in the area of
information security in Japan. Visualization of human resources is criticalAn

articleappearingin

NikkeiBusiness Daily on August 28, 2018
titled “Security Human Resources:
Disappeared the crisis of ʻShortageof 190,000ʼ” reported that against
the many voices pointing out ashortage

in

information

humansecurity resources, a number ofindividuals in the cyber defense
field have stated that no such
shortage exists. The reason for thisdiscrepancy

maybethatthehuman resources needed in thefield of cyber defense are security
specialists. In contrast, the sense of
shortage in plus security humanresources still remains strong. Why does this type of argument, regarding whether Japan is faced with ashortage of human resources in information security, continue? One reason may be that the visualization ofhuman resources has yet to be established in Japan. The Information Security Education Providers
Association, a subordinate organization of the NPO Japan Network Security Association (JNSA), haspromoted the visualization of human resources and the introduction of a human resource accreditation
system. The chart shows an example of the visualization of security skills. This type of effort in visualizing
human resources will help clarify the degree of sufficiency of security specialist resources as well as thedegree of shortage in plus security human resources for a more objective determination of the current
situation. For this reason, visualizing security human resources is an essential part of solving this problem.

IV. Conclusion
This report illustrated that the often claimed shortage of human resources in the area of information
security is not one of security specialists but rather plus security human resources (people who know about
information security in addition to their primary tasks). This report also suggested new measures forcultivating plus security human resources, such as making use of personnel rotations, which are different
from traditional methods in the cultivating of security specialists. The cultivation of plus security humanresources in Japan, which is currently faced with a substantial shortage of such professionals, is an urgent
task. To create a safe and secure society, personnel in charge of security in government agencies, as well as
those in charge of building security teams at ICT user companies, are expected to change their mindsets
regarding the cultivation of the much wanted plus security human resources and implement the measuressuggested in this report.

Page 3

[Contacts]
Toshihiro Hirayama, Senior Fellow
Kanji Uesugi, Senior Fellow

hirayama@j-cic.com
uesugi@j-cic.com－ Legal Notice －The JCIC does not take responsibility for the accuracy, up-to-datedness, or quality of the information provided in any report.
The permission of the copyright owner must be obtained, in principle, provided that such permission is not required under certain
circumstances permitted by law. When reusing a JCIC report, please identify the source, such as [Source: JCIC].

JCIC contact information: info@j-cic.com

Page 4