1 of 53

Why “soft skills” are important:�Defeating Cowboy IT

4 January, 2024

WASTC 9^th annual educators’ conference

For years, now, I’ve heard pundits and presenters state that “soft skills” or “durable skills” are important for IT workers. Yet, I’ve rarely ever heard anyone explain exactly why they have become so important. I’m a root-cause kind of person. So, at CompTIA have leaned into this topic. We’ve conducted extensive research, and talked with practitioners and execs alike about how we can collectively do a bit better. The short answer is, as you might expect: We need better communicators and true process maturity to overcome years of bad IT practices, and implement today’s disruptive, exponential technologies. I call these bad practices, “Cowboy IT.” Getting out of Cowboy IT this isn’t all that simple – one doesn’t simply walk out of the Wild, Wild West. Join me as I discuss the nuances of what “better communication” and “process maturity” means in the face of long-standing worst practices that I call “Cowboy IT.” I’ll discuss the “durable skills” that people need, sure. But (I think) more importantly, I’ll discuss why these skills have become increasingly important in the face of AI-enabled conversations, cybersecurity regulation, and our increasingly deep use of exponential, disruptive technologies. I’ll be ready to listen to you as I relate the experiences, frustrations, and insights that IT pros are doing to counter what I call “cowboy IT” practices, such as ignoring technical debt, enduring shadow IT, and ignoring iterative best practices that result in toxic IT.

On that theme, then, I’ll delve into how Woody’s immortal phrase, “Somebody’s poisoned the waterhole!” in Toy Story helps us understand how to manage supply chain attacks. Why do some IT workers and bosses suddenly turn into Yosemite Sam because of “how things are?” Are some IT environments closer to Cowboy Bebop than the cool, process-based precision that made Annie Oakley a Western legend? If so, mosey on over to my corral and let’s talk before you think about riding off into the sunset. Looking forward to seeing you there!

The conditions where IT efforts can thrive
Why those conditions are sometimes difficult to create
Where AI can – and can’t – help
Real-life, industry-strength examples where AI is used in critical elements of the development and hacker lifecycles

2 of 53

Your presenter

James Stanger, PhD

Chief Technology Evangelist - CompTIA

A+, Network+, Security+, MCSE, LPI LPIC 1, Symantec STA

Technologist, author and educator. Responsible for working with students, IT pros, hiring managers, and helping shape CompTIA educational standards. I have experience in:

Leading organizations (company president)
Security analytics and monitoring
Data analytics
Linux and open source
Cloud security
Pen testing, red teaming
Emerging technology (e.g., blockchain, AI & ML)
Threat hunting
Network administration
Web technologies
Education program development

CompTIA blog page: �https://tinyurl.com/y6pdw72g

LinkedIn: �@jamesstanger

For years, now, I’ve heard pundits and presenters state that “soft skills” or “durable skills” are important for IT workers. Yet, I’ve rarely ever heard anyone explain exactly why they have become so important. I’m a root-cause kind of person. So, at CompTIA have leaned into this topic. We’ve conducted extensive research, and talked with practitioners and execs alike about how we can collectively do a bit better. The short answer is, as you might expect: We need better communicators and true process maturity to overcome years of bad IT practices, and implement today’s disruptive, exponential technologies. I call these bad practices, “Cowboy IT.” Getting out of Cowboy IT this isn’t all that simple – one doesn’t simply walk out of the Wild, Wild West. Join me as I discuss the nuances of what “better communication” and “process maturity” means in the face of long-standing worst practices that I call “Cowboy IT.” I’ll discuss the “durable skills” that people need, sure. But (I think) more importantly, I’ll discuss why these skills have become increasingly important in the face of AI-enabled conversations, cybersecurity regulation, and our increasingly deep use of exponential, disruptive technologies. I’ll be ready to listen to you as I relate the experiences, frustrations, and insights that IT pros are doing to counter what I call “cowboy IT” practices, such as ignoring technical debt, enduring shadow IT, and ignoring iterative best practices that result in toxic IT.

On that theme, then, I’ll delve into how Woody’s immortal phrase, “Somebody’s poisoned the waterhole!” in Toy Story helps us understand how to manage supply chain attacks. Why do some IT workers and bosses suddenly turn into Yosemite Sam because of “how things are?” Are some IT environments closer to Cowboy Bebop than the cool, process-based precision that made Annie Oakley a Western legend? If so, mosey on over to my corral and let’s talk before you think about riding off into the sunset. Looking forward to seeing you there!

The conditions where IT efforts can thrive
Why those conditions are sometimes difficult to create
Where AI can – and can’t – help
Real-life, industry-strength examples where AI is used in critical elements of the development and hacker lifecycles

3 of 53

www.comptia.org

For years, now, I’ve heard pundits and presenters state that “soft skills” or “durable skills” are important for IT workers. Yet, I’ve rarely ever heard anyone explain exactly why they have become so important. I’m a root-cause kind of person. So, at CompTIA have leaned into this topic. We’ve conducted extensive research, and talked with practitioners and execs alike about how we can collectively do a bit better. The short answer is, as you might expect: We need better communicators and true process maturity to overcome years of bad IT practices, and implement today’s disruptive, exponential technologies. I call these bad practices, “Cowboy IT.” Getting out of Cowboy IT this isn’t all that simple – one doesn’t simply walk out of the Wild, Wild West. Join me as I discuss the nuances of what “better communication” and “process maturity” means in the face of long-standing worst practices that I call “Cowboy IT.” I’ll discuss the “durable skills” that people need, sure. But (I think) more importantly, I’ll discuss why these skills have become increasingly important in the face of AI-enabled conversations, cybersecurity regulation, and our increasingly deep use of exponential, disruptive technologies. I’ll be ready to listen to you as I relate the experiences, frustrations, and insights that IT pros are doing to counter what I call “cowboy IT” practices, such as ignoring technical debt, enduring shadow IT, and ignoring iterative best practices that result in toxic IT.

On that theme, then, I’ll delve into how Woody’s immortal phrase, “Somebody’s poisoned the waterhole!” in Toy Story helps us understand how to manage supply chain attacks. Why do some IT workers and bosses suddenly turn into Yosemite Sam because of “how things are?” Are some IT environments closer to Cowboy Bebop than the cool, process-based precision that made Annie Oakley a Western legend? If so, mosey on over to my corral and let’s talk before you think about riding off into the sunset. Looking forward to seeing you there!

The conditions where IT efforts can thrive
Why those conditions are sometimes difficult to create
Where AI can – and can’t – help
Real-life, industry-strength examples where AI is used in critical elements of the development and hacker lifecycles

4 of 53

Agenda

Let’s get past the typical “soft skills” nonsense
Conditions where IT efforts can thrive
Why those conditions are sometimes difficult to create
Typical IT conditions – what I call “Cowboy IT”
Industry-strength examples of how to overcome cowboy IT
Why “soft skills” really are so important

For years, now, I’ve heard pundits and presenters state that “soft skills” or “durable skills” are important for IT workers. Yet, I’ve rarely ever heard anyone explain exactly why they have become so important. I’m a root-cause kind of person. So, at CompTIA have leaned into this topic. We’ve conducted extensive research, and talked with practitioners and execs alike about how we can collectively do a bit better. The short answer is, as you might expect: We need better communicators and true process maturity to overcome years of bad IT practices, and implement today’s disruptive, exponential technologies. I call these bad practices, “Cowboy IT.” Getting out of Cowboy IT this isn’t all that simple – one doesn’t simply walk out of the Wild, Wild West. Join me as I discuss the nuances of what “better communication” and “process maturity” means in the face of long-standing worst practices that I call “Cowboy IT.” I’ll discuss the “durable skills” that people need, sure. But (I think) more importantly, I’ll discuss why these skills have become increasingly important in the face of AI-enabled conversations, cybersecurity regulation, and our increasingly deep use of exponential, disruptive technologies. I’ll be ready to listen to you as I relate the experiences, frustrations, and insights that IT pros are doing to counter what I call “cowboy IT” practices, such as ignoring technical debt, enduring shadow IT, and ignoring iterative best practices that result in toxic IT.

On that theme, then, I’ll delve into how Woody’s immortal phrase, “Somebody’s poisoned the waterhole!” in Toy Story helps us understand how to manage supply chain attacks. Why do some IT workers and bosses suddenly turn into Yosemite Sam because of “how things are?” Are some IT environments closer to Cowboy Bebop than the cool, process-based precision that made Annie Oakley a Western legend? If so, mosey on over to my corral and let’s talk before you think about riding off into the sunset. Looking forward to seeing you there!

The conditions where IT efforts can thrive
Why those conditions are sometimes difficult to create
Where AI can – and can’t – help
Real-life, industry-strength examples where AI is used in critical elements of the development and hacker lifecycles

5 of 53

A common phrase I hear among CISOs, CIOs, and hiring managers

Tim Crothers, Google (formerly Target)
Illya Ortsman, Global Head of Tech, Christie’s

We’re not there, yet!
We can’t get there �by working individually

“How do we get to minimum viability?”

6 of 53

Involving IT from the beginning
Less clean-up, more proactive behavior
Reduce gap between business and IT decisions
Great work/life balance

Ideal conditions

https://www.comptia.org/content/research/using-strategic-it-for-competitive-advantage

7 of 53

Just using the next, cool term for soft skills

Power skills
Durable skills

Not being able to explain why they’re important

Soft skills nonsense

8 of 53

“Cloud-smart” choices – the trifecta

Cloud – virtualized services
Data center
On-premise

Increasing need for automation
Using tech more deeply than ever before to:

Stay relevant in the market
Improve Customer experience (CX)
Obtain data information and act on it

Consider the following trends

Installed / Enterprise

Cloud

Data center

Hybrid

9 of 53

why it’s difficult to find ideal conditions

10 of 53

Characterized by:

The underutilization of modern practices
Over-reliance on old ones
Immature processes

Cowboy IT

In other words, what IT departments and organizations worldwide have been doing for nearly 30 years!

11 of 53

Primary cowboy IT varmints

Technical debt

What happens when you skip essential development or deployment steps
The implied cost, or “debt” created when you choose an “easy” solution

Shadow IT

Sourcing solutions independent �of the IT department – Unauthorized IT
Much more common today

Lack of proper communication

Cowboy IT

Lack of communication

Shadow IT

Technical debt

12 of 53

Lack of quality C-level communication
Poor trust environment – silos
Pressure to deploy technology rapidly
Few available, talented IT workers
Lack of interest in training workers
Converging of Information Technology (IT) and Operational Technology (OT)
Combination of information and IT

The causes/results of “cowboy IT”

“For the first time in 22 years, I now actually lead an Information Technology department!”

-- CIO, Manhattan bank

13 of 53

Ways of talking about “cowboy IT”

“We apply a lot of Band-Aids as we go along, you know.”

-- Network Engineer, Oregon ISP

“There’s more than a little magic in what we do.”

-- Cloud Architect, AWS

“You call them shortcuts, James. I call it getting things done.”

-- Data Systems Engineer, Wells Fargo

“We make do and mend more than most would like to think.” � -- AI engineer, Sweden

14 of 53

A borrowed term from coding
Leftovers from previous work and processes
Result of poor (or non-existent) iteration practices

Cruft

James, I’m dealing with decisions �made five years ago

-- CISO from Australia

15 of 53

Cowboy IT

End user training

Sheriff

Manager

Desperado

Hacker

Cattle drive

IT project

16 of 53

Cowboy IT

Software update

Range war

Exec / staff / management conflict

Standoff

Personnel conflict

Stampede

Security Incident

17 of 53

Cowboy IT

IT employee

Corral

IT department

City slicker

New director

Snake oil sales-person

Vendor

18 of 53

Cowboy IT

Code of the west

Unwritten policies

Greenhorn

New IT employee

High noon

Project deadline

19 of 53

Cowboy IT

IT employees

Oregon trail

Career pathway

Varmint

Hacker

Homesteaders

Customers

20 of 53

Worst forms of technical debt – and root causes

21 of 53

A negative example of the 80% / 20 rule?

22 of 53

Organizations receiving – and not monitoring / analyzing / validating – uncontrolled data
Poor data handling practices
Rapid deployment of new technologies workers don’t fully understand
Lack of education
Lack of inclusion

Additional varmints

23 of 53

It can defeat the best:

tech in the world
IT workers in the world
training in the world

Why cowboy IT is a problem

You’re going to lose more to Cowboy IT than to AI . . .

24 of 53

Less than you’d think
Let’s talk about why it happens

How much “cowboy IT” can we tolerate?

25 of 53

The result(s) of cowboy IT?

What happens when you play a country record backward?

26 of 53

Primary challenges

Competing priorities across various business units

Managing shortcomings from previous decision and tech solutions

Lack of defined processes

Skills gaps among technical staff

Technical skills gaps among business staff

Communication issues between business units and technical leaders

27 of 53

IT, CX, and cybersecurity compete with each other – why?

Mapping business goals to tech

Improving CX

(AI, data analytics)

Additional security controls

Automating repetitive tasks

Creating a practical incident response policy

Improving security analytics

All require effective communication

28 of 53

PhilHealth: An instance of “Cowboy IT”

Ransomware attack
Poorly-mapped business processes
Doxing victim
Silver lining

Didn’t pay ransom
Quick response
Using a third party cleanup service

29 of 53

The Philippine Statistics Authority (PSA)

Data breach
Not ransomware (not the same as PhilHealth)
Response highlights:

Filed a report
Shut down affected systems
Lateral movement warnings

Finance and Banks
Personal Information Controllers (PIC)
Personal Information Processor (PIP

Warning about financial fraud as well as money laundering

30 of 53

The effect of AI on problems

31 of 53

Analyze datasets at scale

Voice conversations
Pictures (from drones)
Video
Music
Packets / Data streams

Accelerate brute force activities

Discover patterns in large datasets
Model data
Create somewhat convincing fakes

What AI can do right now

32 of 53

Inability to think laterally and proactively
The gold rush / “startup moonshot” mentality
Poor processes

Bad information
Lack of training
Technical debt
Shadow IT
The “we need it yesterday” syndrome

Technology that has no business purpose
Lack of foundational IT and security knowledge

What AI can’t fix

33 of 53

skills that lasso cowboy IT

34 of 53

Most-prized skills for overcoming “cowboy IT” challenges

Ability to explain tech relevance to overall business picture

Discussing security impact of a particular issue

Documenting issues to improve future performance

Identifying concerns around data privacy

Building a schedule / budget that meets both technical requirements and business needs

Leading a cross-functional team

35 of 53

Why are soft skills important? It’s all about maturity!

What will help us create a more mature IT environment?
Notice:

Communication
Policy
Process
Alignment

36 of 53

Maturing operations

What single activity would you choose as a focal point for cybersecurity for your organization?

What are your greatest concerns?

37 of 53

Cybersecurity: What one thing?

+

38 of 53

Analytics and visibility
Pattern recognition
Automation and �orchestration
The “three C” approach

Contingency
Context
Correlation

Unique cybersecurity skills

+

39 of 53

Skills that help lasso cowboy IT

Cooperating with the inevitable

Lateral thinking

Iteration

Process automation

Dialogue

(with AI and everyone else!)

Process improvement

Transforming data into actionable information

Curation

Project management

40 of 53

Beyond Cowboy IT: Iteration – done right

“Aim at a high mark and you'll hit it. No, not the first time, nor the second time. Maybe not the third. But keep on aiming and keep on shooting for only practice will make you perfect.”

-- Annie Oakley

“When a man hits a target, they call him a marksman. When I hit a target, they call it a trick. Never did like that much.”

-- Annie Oakley

41 of 53

pathways to unique skills

42 of 53

Job roles currently in great demand

Network engineer

Project Manager

Cloud architect / engineer

IT / OT solutions architect

DevOps engineer

Security analyst

AI engineer

IT support specialist

Developer – front-end to full stack

43 of 53

Career pathways

44 of 53

staying off the cowboy IT trail: some CompTIA research

45 of 53

CompTIA IT Industry �Outlook 2024

URL: https://connect.comptia.org/content/research/it-industry-trends-analysis s

46 of 53

Impact of AI
The “T-Shaped worker”
Data-driven talent development
Take active role in development

Workforce and Learning Trends 2024

URL: https://www.comptia.org/content/research/workforce-and-learning-trends-2024

DEIB / ESG momentum
Workforce flexibility?
Staff retention / talent mobility
Need for valid training frameworks

47 of 53

Morphing attack surface
Addressing security issue root causes
People, policy, process – and product

State of cybersecurity 2024

Morphing solutions
Data and cybersecurity
AI and cybersecurity

URL: https://www.comptia.org/content/research/cybersecurity-trends-research

48 of 53

CompTIA tech jobs report (updated monthly)

https://www.comptia.org/content/tech-jobs-report

49 of 53

Cyberseek – visualizing cybersecurity worker supply and demand

www.cyberseek.org

50 of 53

CompTIA tech jobs report (updated monthly)

https://www.comptia.org/content/tech-jobs-report

51 of 53

Looking forward to connecting

https://www.linkedin.com/in/jamesstanger

52 of 53

The Skills needed to combat today’s cybersecurity�threats (RSA)

Automated Pen Testing�(Admin Magazine)

Two sides of the same coin: Pen testing and

security analytics

�What’s hot in network certifications

(NetworkWorld)

Escaping the Cybersecurity Metrics Matrix

(CompTIA)

Private Eye: Open source tools for automated

pen testing Admin Magazine�

Thoughts about the help desk

(YouTube)

The Hunt for the Meaning of the Red team

(CompTIA)

The IT security disconnect (HP Enterprise)

A blockchain manifesto? A report from �the RSA 2018 Blockchain Focus Group

Cloud Orchestration with Chef

Admin Magazine

No more close shaves: Talking end �user security

�How CIOs can optimize ITSM software

(SearchCIO)

Vulnerability management: How to target

bug bounty programs

(TechTarget)

My career change journey: The importance

of networking

The role of the service desk in the

cybersecurity kill chain (HDI)

How to prevent insiders from breaching

your data (Forbes)

��

10 critical security skills every IT team needs

(interview, CIO Magazine)�

How AI can help you stay ahead of

cybersecurity threats (CSO Magazine)

Don’t hack me, bro! (Admin Magazine)

At the hop: Security testing with hping3

(Linux Magazine)

How Technical Debt Can Damage Business�Agility and�Competitiveness�(ITPro, UK)

The Internet of Things (IoT) and Technical Debt: Why It Matters (CompTIA)

James Stanger, PhD

Twitter: @jamesstanger

Skype: stangernet�

My CompTIA hub:�https://www.comptia.org/blog/listing/author/james%20stanger

Thank You!

53 of 53

To download the slides

https://comptia365.sharepoint.com/:p:/s/stanger/EdHNApF1P4NEm7xTkoH4H_wB_Scnq5A_3ikoUAG68aJupA?e=ghSUHc