Upload
others
View
0
Download
0
Embed Size (px)
Citation preview
CYBERSECURITY
OPPORTUNITIES IN VIRGINIA
December 4, 2019
TOPICS FOR TODAY’S DISCUSSION
Overview of employment and growth in the cybersecurity sector
Opportunities to strengthen Virginia’s position in the cybersecurity industry
VEDP’s current business development efforts for cybersecurity
Next steps
3
TECH SECTOR GROWTH IN THE US HAS BEEN STRONG AND IS PROJECTED TO BE THE HIGHEST-GROWTH VS. OTHER SECTORS
Source: BLS, QCEW
US Employment CAGR
2014-2019, %
US Projected employment CAGR
2019-2024, %
1.1%
2.0%
2.6%
2.0%
1.7%
1.1%
0.9%
1.5%
0.2%
0.3%
0.1%
Total, US
Supply Chain
Information Technology
Data Centers
Life Sciences
Automotive
Food & Beverage
Corporate Services
Advanced Materials
Aerospace
Wood products
1.4%
4.1%
3.9%
3.9%
2.8%
2.7%
2.2%
1.7%
1.4%
0.9%
0.9%
Total, US
Supply Chain
Information Technology
Data Centers
Life Sciences
Automotive
Food & Beverage
Corporate Services
Advanced Materials
Aerospace
Wood products
NO
TE
S
CYBERSECURITY IS A PILLAR OF THE TECH SECTOR AND HAS HAD STRONG GROWTH ITSELF, ESPECIALLY IN THE EARLY 2010S
1 Cybersecurity industry includes: Computer Programming Services (541511) and Computer Systems Design Services (541512). Tech industry includes cybersecurity, as well as Other Computer Related Services (541519) and Software Publishers (511210)
Source: Emsi 2019.44
0
500,000
1,000,000
1,500,000
2,000,000
2,500,000
2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019
Growth in cybersecurity industry1 employment
United states, payroll jobs, 2009 – 2019; Percent of total IT employment
Note: There are limitations to the data available for the cybersecurity sector, as it does not have its own industry or
occupational codes. Often, the data we pull for the cybersecurity sector can include data for other subsectors of the tech
industry – e.g., software development – that is closely tied to the cybersecurity industry and its skills.
> 60%of the tech industry1
is part of the
cybersecurity sector
or leverages
cybersecurity in
some way
NO
TE
S
VIRGINIA HAS CAPITALIZED ON THE CYBER BOOM, WITH THE THIRD LARGEST CYBERSECURITY INDUSTRY IN THE COUNTRY
1 NAICS: Custom Computer Programming Services (541511) and Computer Systems Design Services (541512)Source: Emsi 2019.4 5
65,861
66,936
73,711
78,260
79,425
85,743
110,325
153,641
183,292
303,355
Pennsylvania
New Jersey
Maryland
Massachusetts
Illinois
Florida
New York
Virginia
Texas
California
Employment in cybersecurity industry1
Payroll jobs, 2019
Note: There are limitations to the data available for the cybersecurity sector, as it does not have its own industry or
occupational codes. Often, the data we pull for the cybersecurity sector can include data for other subsectors of the tech
industry – e.g., software development – that is closely tied to the cybersecurity industry and its skills.
NO
TE
S
MOST IMPRESSIVE, VIRGINIA HAS THE LARGEST CREDENTIALED CYBER WORKFORCE IN THE COUNTRY
6
6,117
8,767
9,566
10,743
11,060
21,484
28,490
29,856
31,536
44,402
Massachusetts
New Jersey
Pennsylvania
New York
Illinois
Florida
Maryland
Texas
California
Virginia
CompTIA Security+
Certified Information Privacy Professional (CIPP)
Global Information Assurance (GIAC)
Certified Information Systems Security Professional (CISSP)
Certified Information Systems Auditor (CISA)
Certified Information Security Manager (CISM)
Cybersecurity credential holders
Number of workers holding select credentials, 2017
Source: Cyberseek.org
NO
TE
S
THE COMMONWEALTH HAS COMMITTED TO INVESTMENTS IN CYBER, NAMELY WITH THE COMMONWEALTH CYBER INITIATIVE
7
Faculty members
320Universities
21
Annual state
investment
$20M
Sponsored research
$99M+The Commonwealth
Cyber Initiative
supports research,
talent development,
and innovation at
the intersection of
data, autonomy and
security.
NO
TE
S
THE RECENT TECH TALENT INVESTMENT PROGRAM COMMITMENT BY THE COMMONWEALTH ALSO DIRECTLY SUPPORTS CYBER
1 Custom Computer Programming Services (541511) and Computer Systems Design Services (541512)Source: Emsi 2019.4 8
… Aligning with top degrees held by employees in the
cybersecurity industry1
Terminal degree programs for profiles in cybersecurity
industry, N = 1.96 million
Degree fields Number of
degrees
Computer Science, Computer Engineering 153,796
Business Administration, Management and
Operations135,700
Marketing 41,164
Communication and Media Studies 37,814
Electrical, Electronics and Communications
Engineering31,302
Business/Commerce, General 31,238
Engineering, General 28,591
The Commonwealth’s TTIP commitment directly
supports computer science and computer engineering
talent development….
At least 31K additional tech grads
by 2040 above baseline 34K tech grads
K-12 STEM & computer science experience for students
Growth of Bachelor’s and Master’s in computer science,
computer engineering and software development
Community college tech degrees and transfers
Virginia’s $1.1B tech talent investment fund will support:
Expanded tech industry internships for all students
NO
TE
S
CIT’S MACH37™, A CYBERSECURITY-FOCUSED ACCELERATOR, SUPPORTS YOUNG CYBER COMPANIES IN THE COMMONWEALTH
9
Since its first cohort in Fall 2013, the
MACH37™ Accelerator has supported 57
innovative cyber start-ups in areas including:
cybersecurity, autonomous vehicles, artificial
intelligence, cyber-physical systems, IoT and
industrial control systems
Of all MACH37™ graduates, 73% are still in
business and 60% have raised follow-on
investment, further establishing Virginia as a
hub for cyber start-ups
VEDP works with MACH37™ on a variety of
lead generation activities, such as RSA, Black
Hat, and Collision, to encourage increased
investment in Virginia’s cybersecurity industry
NO
TE
S
GROWTH OF PURE CYBER EMPLOYMENT IS PROJECTED TO SLOW DOWN NATIONALLY…
10
500,000
700,000
900,000
1,100,000
1,300,000
1,500,000
1,700,000
2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024
Growth in cybersecurity occupational1 employment
United States, jobs, 2009 - 2024
1 Six occupations, including: Computer and Information Systems Managers, Information Security Analysts, Database Administrators, Network and Computer Systems Administrators, Computer Network Architects, and Computer Network Support Specialists
Source: Emsi 2019.4
2009-2014 CAGR: 4.0%
2014-2019 CAGR: 2.0%
2019-2024 CAGR: 1.4%
Note: There are limitations to the data available for the cybersecurity sector, as it does not have its own industry or
occupational codes. Often, the data we pull for the cybersecurity sector can include data for other subsectors of the tech
industry – e.g., software development – that is closely tied to the cybersecurity industry and its skills.
NO
TE
S
… BUT CYBER IS BECOMING MORE INTERDISCIPLINARY WITHIN COMPANIES, PROVING THE IMPORTANCE AND PERMANANCE OF CYBERSECURITY NOW AND IN THE FUTURE
11
Cybersecurity is now the responsibility of
everyone in your organization, not just
your information technology department.
Tom Relihan, MIT Sloan’s Ideas Made to
Matter, 2019
Cybersecurity should no longer be viewed as a
function of IT… It needs to form an integral part
of culture and strategy [and] should be reflected
in each and every facet of the organization…
Cybersecurity for Industry 4.0, Ernst & Young, 2018
We’re now beyond
cybersecurity’s “whack-
a-mole” past of
addressing one-off
vulnerabilities. The
function can — and
should — be an
essential ingredient to
business success.
Companies Need To Rethink
What Cybersecurity
Leadership Is, Harvard
Business Review, 2019
NO
TE
S
CYBER GROWTH IN VIRGINIA IS EXPECTED TO BE MORE STAGNANT THAN OUR TOP COMPETITORS, CA AND TX
12
0
50,000
100,000
150,000
200,000
250,000
300,000
350,000
2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024
1 Custom Computer Programming Services (541511) and Computer Systems Design Services (541512)Source: Emsi 2019.4
Growth in cybersecurity industry1 employment
Top ten states by employment, payroll jobs, 2009 - 2024
VA
CA
TX
NY
MD
Note: There are limitations to the data available for the cybersecurity sector, as it does not have its own industry or
occupational codes. Often, the data we pull for the cybersecurity sector can include data for other subsectors of the tech
industry – e.g., software development – that is closely tied to the cybersecurity industry and its skills.
13
VEDP HAS IDENTIFIED TWO KEY OPPORTUNITES FOR VA IN CYBER
1. Geographic diversity
Concentrated efforts to grow
Virginia’s cybersecurity industry
outside of Northern Virginia
2. Private sector growth
An expansion of focus to private
sector-focused cyber
companies, vs. the public sector
industry and its contractors
MITRE, Fairfax County
NO
TE
S
1. UNDERSTANDABLY, CYBERSECURITY OCCUPATIONAL EMPLOYMENT IS HIGHLY CONCENTRATED IN NORTHERN VIRGINIA
14
66
91
94
244
295
324
338
418
422
485
571
729
802
931
1,499
1,817
6,173
7,286
42,293
Northern Neck
Middle Peninsula
Eastern Shore
South Central Virginia (Virginia's Growth Alliance)
Southwest Virginia’s e-Region
I-81 I-77 Crossroads
Southern VA
Greater Williamsburg
I-95 I-85 Intersection (Virginia's Gateway Region)
New River Valley
Northern Shenandoah Valley
Lynchburg Region
Shenandoah Valley
Roanoke Region
Central Virginia
Greater Fredericksburg
Hampton Roads
Greater Richmond
Northern Virginia
Cybersecurity industry1 employment by region
Payroll jobs, 2019
1 Custom Computer Programming Services (541511) and Computer Systems Design Services (541512)Source: Emsi 2019.4
NO
TE
S
1. EDUCATIONAL INSTITUTIONS ACROSS VIRGINIA PRODUCE CYBER TALENT THAT CAN FULFILL THE NEEDS OF POTENTIAL COMPANIES
*Multiple Virginia campus locations shown**School with cybersecurity degree and computer science/engineering degree
Source: NSA, SCHEV, VEDP analysis of institution websites 15
16
2. VIRGINIA’S CYBER INDUSTRY IS KNOWN FOR FEDERAL CONTRACTING
14.2
14.5
16.7
19.6
22.6
23.8
31.7
57.2
89.7
$818.8
Arizona
West Virginia
North Carolina
Michigan
Mississippi
Colorado
South Carolina
California
Maryland
Virginia
Federal spending on cybersecurity services
M$, FY2019, Cybersecurity and Data Backup Services1
1 Product Service Code D310Source: USASpending.gov
17
2. MEANWHILE, VIRGINIA EASILY MEETS PRIVATE SECTOR-FOCUSED CYBER COMPANIES’ KEY LOCATION DECISION DRIVERS
Primary driver of location decisions for
cyber projects
Require an existing, credentialed cyber
workforce
Value veteran workforce given exposure to
cybersecurity issues and training
Need a nearby pipeline of talent for
cybersecurity credentials and degrees, for
new hires and upskilling
Skilled workforce and
talent pipeline
Broadband/ Fiber
Key trends in cyber location decisions Details Current Virginia context
Research and
partnerships
3rd largest base of cybersecurity
employees in the country
Largest pool of credentialed cyber workers
in the country
4th largest population of veterans
nationally, with pecific programs like Cyber
Vets Virginia and NVTC Veterans
Employment Initiative to help match
veterans with cyber jobs
Cyber programs across the state at the
credential, 2-year and 4-year level
Strong, fast, and secure digital connectivity
is a minimum requirement
Strong connectivity for commercial
broadband backbones
92% broadband access across Virginia
Value partnerships to utilize cyber-specific
research assets for training and upskilling
employees
Utilize testing facilities and work with
university teams to research and test
product capabilities
$4M investment in the Virginia Cyber
Range to support cyber education across
the state
GoVirginia investment in the Cyber Arena
to test and evaluate cyber technologies
Investments in cybersecurity from top
Virginia schools, including Tech, UVA, GMU
18
Pivoted to sector-focused business development efforts, of which cybersecurity is a key target
Developed industry strategies focused on tactical high-yield lead generation efforts for the cybersecurity sector, including how to focus our efforts on high value targets
VEDP’s Rural and Small Metro Tech Center Initiative will focus on cybersecurity in one of its next phases
VEDP HAS TAKEN STEPS TO EXPLORE CYBER OPPORTUNITIES AND PRIORITIZE THE CYBERSECURITY INDUSTRY AT LARGE IN OUR BUSINESS DEVELOPMENT EFFORTS (1/2)
Designated a Business Investment Manager to lead the cybersecurity industry effort
Business development efforts supported by a Research Manager who is focusing on key economic trends, current news, and potential business development opportunities in the cybersecurity sector
Business development efforts supported by Economic Competitiveness Manager executing a corporate intelligence program to identify cybersecurity companies that are best positioned to expand in the near team that VEDP should target
Launched a Business Retention & Expansion team, that in part targets Virginia’s key cybersecurity companies for retention, as well as expansion opportunities
Strategic
Organi-
zational
Type of change or action Select examples
19
Tactical
Type of change or action
Prioritized the cybersecurity sector for a new corporate intelligence effort led by the Economic Competitiveness team, in which VEDP takes a data-oriented approach to identifying companies in our target sectors
Executed 10 lead generation activities targeting the cybersecurity sector in FY18 and FY19, and will execute 12 cybersecurity lead generation activities in FY20
Enhanced new VEDP website that includes comprehensive information promoting Virginia’s cybersecurity assets
Developed new marketing collateral for cybersecurity sector, including promoting largest cyber workforce in Eastern U.S., recent investments in tech talent pipeline, Centers of Academic Excellence in Cyber Operations and Defense, Commonwealth Cyber Initiative, and proximity to federal cybersecurity assets, among others
Business Retention and Expansion program targeting high-value companies
Select examples
Partnership
VEDP has active partnerships with the following allies in Virginia:
− Northern Virginia Technology Council (NVTC): Hosted international delegations of
cybersecurity companies interested in U.S. expansion, resulting in several project
opportunities for VA
− Commonwealth Cyber Initiative: VEDP has introduced CCI to Virginia companies interested in
research partnerships with nodes across the state
− CIT: Continuing discussions to leverage Mach37 funding for statewide cybersecurity
entrepreneurship and collaboration on lead generation activities
VEDP HAS TAKEN STEPS TO EXPLORE CYBER OPPORTUNITIES AND PRIORITIZE THE CYBERSECURITY INDUSTRY AT LARGE IN OUR BUSINESS DEVELOPMENT EFFORTS (2/2)
20
15% OF VEDP’S LEAD GEN ACTIVITIES ARE FOCUSED ON THE CYBERSECURITY SECTOR, AND ~80% OF GOVERNOR’S MISSIONS, OUR HIGHEST PROFILE ACTIVITY, INVOLVE CYBER ACTIVITY
1 Reflects activities from July 2018 to Dec. 2019, with Governor’s Missions reflected from Jan. 2018 to Dec. 2019
7
21
17
16
Prospect Meetings
Governor’s Missions
Lead Gen Activities
Leads generated
Project pipeline
179
78
15
11
3
3
Cybersecurity-related VEDP
activity1 % of total VEDP activity1
21
THE COMMONWEALTH CAN CONTINUE TO STRENGTHEN ECONOMIC DEVELOPMENT IN THE CYBERSECURITY INDUSTRY
How Virginia can continue to capitalize on cybersecurity
Support and grow cybersecurity degree and certification programs across the Commonwealth
Support and grow all four-year technology degree programs across the Commonwealth (e.g. through TTIP), knowing that this is a foundation for cybersecurity employees
Identify intersections of cybersecurity and other key Virginia sectors (e.g., unmanned systems), and provide resources/ access to research assets for companies at those intersections
Next steps for VEDP
Target opportunities related to cybersecurity trends and existing Virginia sectors (e.g., cybersecurity for unmanned systems)
Execute a corporate intelligence strategy to identify and target high potential cybersecurity companies, including a specific effort around private sector-serving cybersecurity
Successfully complete a Rural and Small Metro Tech Centers effort for cybersecurity to create more activity in cyber beyond Northern Virginia
Market key Virginia cyber assets to attract opportunities (e.g., existing cyber workforce, Virginia Cyber Range, etc.)
Continuing to build relationships with and support key stakeholders and industry leaders that help Virginia navigate related opportunities
22
APPENDIX
NO
TE
S
Cybersecurity is notoriously difficult to pin down. There are three (imperfect) was to measure its size and characteristics:
THREE (IMPERFECT) WAYS TO MEASURE THE CYBERSECURITY WORKFORCE
23
Cybersecurity industry employment: Cybersecurity firms are primarily classified under two different industry codes in the North American Industry Classification (NAICS) system: Custom Computer Programming Services (541511) and Computer Systems Design Services (541512). However, these industries also include a broad range of other types of IT firms and thus overstate the true extent of cybersecurity employment. Industry employment also includes people in cybersecurity firms who are not cybersecurity professionals (e.g. accountants).
Cybersecurity occupational employment: Cybersecurity occupations are primarily covered by six different Standard Occupational Classification (SOC) groups, including Computer and Information Systems Managers, Information Security Analysts, Database Administrators, Network and Computer Systems Administrators, Computer Network Architects, and Computer Network Support Specialists. While most people working in these occupation have various cybersecurity skills, many would not be considered cybersecurity professionals.
Cybersecurity skills: Powerful, new analytical tools allow researchers to look beyond employers and job titles and measure the prevalence of specific cybersecurity skills. This provides the most granular picture of the cybersecurity workforce, but is subject to some important limitations – e.g. based on what people report on social media profiles.
NO
TE
S
ACROSS ALL TOP CYBERSECURITY STATES, INDUSTRY EMPLOYMENT GROWTH IS EXPECTED TO SLOW OVER NEXT 5 YEARS
1 Custom Computer Programming Services (541511) and Computer Systems Design Services (541512)Source: Emsi 2019.4 24
1.1%
1.8%
2.0%
1.7%
2.0%
2.3%
2.1%
3.0%
2.8%
4.0%
1.8%
1.9%
2.7%
3.4%
4.1%
4.4%
4.4%
4.8%
4.9%
7.1%
New Jersey
Virginia
Maryland
Pennsylvania
Massachusetts
New York
Illinois
Florida
California
Texas
2009 - 2019
2019 - 2024
Cybersecurity industry1 employment CAGR
Payroll jobs, 2009 – 2019 & 2019 - 2024
U.S. Average
2019 - 2024U.S. Average
2009 - 2019
NO
TE
S
VIRGINIA IS HOME TO THE FOURTH HIGHEST LEVEL OF EMPLOYMENT IN CORE CYBERSECURITY OCCUPATIONS
1 Six occupations, including: Computer and Information Systems Managers, Information Security Analysts, Database Administrators, Network and Computer Systems Administrators, Computer Network Architects, and Computer Network Support Specialists
Source: Emsi 2019.4 25
46,076
46,666
49,110
49,789
53,081
69,198
70,625
90,452
110,007
160,637
New Jersey
Ohio
Pennsylvania
Maryland
Illinois
Florida
Virginia
New York
Texas
California
Employment in cybersecurity Occupations1
Jobs, 2019
NO
TE
S
VIRGINIA UNDERPERFORMS WITH REGARD TO CYBERSECURITY CREDENTIAL PRODUCTION
26
2
4
15
36
30
2
132
107
99
62
6
38
51
44
100
129
85
126
214
300
Virginia
Massachusetts
Florida
New York
Maryland
Pennsylvania
New Jersey
Illinois
Texas
California
7
57
113
155
89
176
231
152
280
172
31
58
86
103
281
219
193
346
241
471
New Jersey
Massachusetts
Illinois
Florida
Maryland
Virginia
Texas
New York
California
Pennsylvania
2018
2013
Cybersecurity certificates1
Certificates awarded, 2013 & 2018
1 CIP code 11.1003, non-distance programs onlySource: Emsi Profile Analytics, profiles updated since 2017
Cybersecurity degrees1
Degrees awarded, 2013 & 2018