Wanted: Cybersecurity Experts To Fill Canadian IT Skills Gap

From smart fridges to apps that control your room temperature, connected devices are redefining what’s possible when it comes to home and domestic technology. But they’re also spawning new cybersecurity threats: that same life-improving Internet of Things (IoT) device could turn deadly if taken over by a remote intruder.

It’s a scary reality, but these fears also represent an opportunity for a new generation of computer engineers to tackle emerging security challenges in an ever-changing industry.

Why Connected Devices Are So Exposed

The risk isn’t theoretical. In August 2016, researchers found the Mirai malware, which targets consumer devices such as IP cameras and home routers. It found vulnerable devices by trying a list of more than 60 common factory default usernames and passwords, then used them in some of the largest denial-of-service attacks seen at the time, including the October 2016 attacks on internet infrastructure company Dyn.

Mirai showed the core problem with many IoT products. They’re cheap, they’re rarely updated, and owners often never change the default login. Each one is a small computer on a home network, and a weakness in one model can be copied across millions of homes. Securing that world takes people who understand hardware, networks and software together, and that’s exactly the kind of expert Canada was short of.

Canada’s Skills Gap

However, Canada is facing a severe skills gap in IT-related cybersecurity jobs, especially as the number of job-seekers declines despite an abundance of opportunities. More needs to be done to encourage people to develop these skills, and panelists at the BC Tech Summit offered their thoughts on solutions.

Training

Tyson Macaulay of BAE Systems and Keith Cerny of ACL underlined the need for more post-secondary degree programs with a greater focus on cybersecurity. While some Toronto schools are focused on filling the gap, schools and institutes from across the country are encouraged to follow suit.

Awareness

A significant part of the problem — especially with IoT products — is that not enough people realize the risks of their connected devices, said Absolute Software’s Jo-Ann Smith, another BC Tech panelist. The solution to this problem may start at home, where children could be brought up with a stronger knowledge of online threats.

With a solid understanding in cybersecurity, both kids and parents would be equipped to make better choices about which devices to allow into their homes. Further, fostering an early interest in connected devices with youths could lead to many more IoT and cybersecurity professionals in the future.

With automation — including machine learning and artificial intelligence — the cause of much debate for employment experts, cybersecurity looks to be one field that will need many more human workers long into the future.

What’s Changed Since 2017

Canada’s government has since built more of its own capacity. The Canadian Centre for Cyber Security, part of the Communications Security Establishment, opened in 2018 as a key initiative under Canada’s National Cyber Security Strategy. It describes itself as the single unified source of cyber security advice, guidance and support for government, critical infrastructure, the private sector and the public.

The talent shortage, though, has grown worldwide. The 2024 ISC2 Cybersecurity Workforce Study estimated the global active cybersecurity workforce at 5.5 million, roughly flat on the year, and the workforce gap at 4.8 million, up 19%. There’s a twist, too: 39% of respondents said a lack of budget was now the top reason for staff shortages, replacing a lack of talent. In other words, many organizations need more security people but aren’t funding the roles.

The companies on the 2017 panel have changed as well. Absolute Software, Jo-Ann Smith’s employer, traded on the Toronto Stock Exchange and Nasdaq until it was acquired by Crosspoint Capital Partners in July 2023, and it renamed itself Absolute Security in 2024.

What It Means for Students and Employers

For students, the 2017 advice still holds. Cybersecurity rewards a broad base of skills, from networking to software to an understanding of how people actually use their devices. Programs that blend those skills, along with hands-on practice, are a strong route into a field that keeps needing people.

For employers, the lesson from the latest data is that the gap isn’t only about supply. Training existing staff, hiring people with adjacent skills and budgeting properly for security roles are all part of closing it. And for families, the simplest step from this article remains one of the most useful: change default passwords, keep devices updated, and think twice before connecting something that doesn’t need to be online.