Texas Cybersecurity: Protecting Data SystemsTexans Lose Big to Cybercrime

By Courtney King Published March 2019

Cybercrime — the use of computer technology or the internet to gain unauthorized access to information for exploitative or malicious purposes — is a growing threat to private companies, governments and individual consumers alike.

The internet, arguably one of our most important technologies, wasn’t designed to cope with today’s sheer volume of connectivity. Due to the rise of mobile and “smart” devices as well as wireless technologies, huge amounts of confidential information are regularly transmitted across inadequately defended networks with an ever-increasing number of access points available for attack. To compound matters, many information security and data protection measures, such as firewalls and anti-virus software, are becoming ineffective against sophisticated criminal tactics.

Crime on the internet is soaring, and the reasons are simple. The theft of confidential information or intellectual property is relatively easy and can be highly lucrative; furthermore, it’s largely risk-free — most cybercriminals are never caught or prosecuted. And there’s a constantly growing number of targets, as new internet and mobile users log on worldwide each day.

Yet just as a body’s immune system fights back against disease, economic threats breed economic countermeasures — in this case, the young but burgeoning cybersecurity industry, which already employs thousands of Texans.

The Cost of Cybercrime

It only takes one ill-fated click for an individual or organization to fall prey to a devastating cyberattack. The security software company McAfee estimates (PDF) that of the more than 2 billion people online worldwide, two-thirds have had their personal information stolen or compromised. A 2017 global study (PDF) by consulting firm Accenture found an average of 130 security breaches per company each year.

Based on more than 21,000 interviews with representatives of 254 companies in seven nations, Accenture estimates that cybercrime costs each of these organizations an average of $11.7 million annually. This average includes not only the initial costs incurred from damages — which can range from loss of assets to disruption of business continuity — but the money organizations have to spend to recover from damages and protect themselves against the constant deluge of cyberthreats.

Unsurprisingly, banks are the top targets of cybercriminals. The financial services industry has the highest average cybercrime costs, at nearly $18.3 million per organization (Exhibit 1).

The Federal Bureau of Investigation’s Internet Crime Complaint Center receives more than 800 complaints of criminal activity per day. In 2017, U.S. victims reported losses totaling $1.42 billion.

Given Texas’ population, it’s unsurprising that the state ranks third nationally in its number of cybercrime victims (Exhibit 2). Texas victims reported about $115.7 million in losses in 2017.

Cyberattacks are becoming more common and costlier. In response, organizations are investing in information security capabilities and staff on an unprecedented scale. Inevitably, cybersecurity has become one of the largest and fastest-growing technology needs.

Cybersecurity in Texas

Cybersecurity is a relatively new field — so new it hasn’t yet been defined as an industry by the federal government’s North American Industry Classification System, the standard federal agencies use to collect, analyze and publish statistical data related to the business economy.

Even differentiating cybersecurity jobs from other information technology (IT) positions can be difficult. The Department of Homeland Security recently noted inconsistencies in the way employers define and use the term, which can include a wide range of job functions requiring different qualifications and skillsets. Job descriptions and titles for the same job vary from employer to employer. Some researchers and industry practitioners contend that every IT job is involved in cybersecurity to some extent.

The Comptroller’s office has examined employment statistics for information security analysts, defined by the federal Standard Occupational Classification (SOC) system as workers who “plan, implement, upgrade, or monitor security measures for the protection of computer networks and information … and respond to computer security breaches and viruses.”

In 2017, 8,165 Texans worked as information security analysts in various sectors of the state economy. The largest numbers were employed in professional, scientific and technical services and finance and insurance, with 3,091 and 1,471 jobs, respectively (Exhibit 3). Emsi, a company that provides labor market statistics, expects robust job growth in this field in multiple sectors.

According to Dr. Gregory White, professor of computer science and director of the University of Texas at San Antonio’s (UTSA’s) Center for Infrastructure Assurance and Security, the cybersecurity field faces a bottleneck; the nation simply can’t train enough people to fill all open positions and keep up with growing demand. “We could double the number of people in school now and still not fill all open positions,” White says.

Working Around the Labor Shortage

“Organizations need to truly ask themselves if their positions require a [four-year IT] degree,” White says. “I would guess that a number of vacant positions can be filled by people without a degree.”

In fact, many cybersecurity professionals learned the necessary skills through certificate programs and on-the-job training rather than a degree program. “There are students in the San Antonio area that are obtaining two or three certifications in high school and getting job offers after graduation,” White says.

In 2017, nearly a third of information security analysts employed in Texas held less than a four-year degree (Exhibit 5).