Surveillance Is Deterring Would-Be Security Experts in Hong Kong, Black Hat Asia 2021 Hears

Organisations need more cybersecurity specialists as threat actors turn to increasingly advanced methods. People in that line of work, though, need room to operate online with few or no restrictions from the authorities, and where that room is missing, fewer people may be willing to join.

Mika Devonshire, who specialises in digital forensics and incident response, saw this while teaching students in Hong Kong. She found that surveillance was shaping whether they would consider information security as a career.

Speaking at Black Hat Asia 2021, Devonshire presented testimonials from those students. She explained that in Hong Kong the subject is closely bound up with data, privacy and data security, because the city is influenced by the People's Republic of China, which is known for keeping its citizens under surveillance. As she put it, the students are "just afraid of being involved in this subject at all due to political circumstances".

Devonshire believes the issue has to be discussed openly, not least because of the size of the talent gap. By some estimates, as many as 4 million jobs worldwide, 2.4 million of them in Asia, are going unfilled because there are not enough trained and skilled information security practitioners.

According to Devonshire, students worry about what joining the field could mean for them. They do not want to be drawn into anything illicit, or even into grey areas, and they see that as part of what becoming an ethical hacker involves. She said this contributes to the shortage of professionals, particularly across Asia Pacific.

Fear was not the only factor. Devonshire also noticed that many students simply lacked interest, not seeing security as a career that would support them over the long term. Fields such as AI, data science, coding or development tend to attract them more.

Prestige was the third reason students gave. Some felt that ethical hacking would not earn them the respect they could get from what they consider more prestigious roles, such as IT administration at a bank or designing large networks.

Devonshire sees instructors and mentors as having an important part to play in steering potential experts towards the field. She urged mentors to look for young people nearby, whether down the street or inside their own company, who show an interest in information security and to encourage them to try it. Such people, she said, may be held back for the wrong reasons discussed in her talk, or may lack the information they need to decide. She also asked the audience to send their interns to the following year's Black Hat Asia, describing it as a way of paying it forward to the next generation of cybersecurity experts.