Enhancing the Cybersecurity Workforce

International Conference on Cyber Warfare and Security, 2022

Security by design is an up and coming paradigm which seeks to decrease the opportunity for corruption and disruption, and to increase the inherent stability, dependability and resilience of systems. Cyber experts need to be involved in the design phase as Finagle's Law, interpreted for cybersecurity, is 'if it can be hacked, it will – at the worst possible time'. Testing is designed to counter Murphy's Law and reduce resistentialism. Defensive programming, original cybersecurity, carries an overhead, for which there is often no demonstrable return. The priority of the design stage cybersecurity expert is to plan for contingencies and think like a hacker. It is about risk management; understanding this dictates security by design requirements in the knowledge that interconnected systems' security is only as strong as its weakest link. Definition and audit of Service Level Agreements (SLA) are an essential part of cybersecurity, as is the audit of any third par...

International Journal of Hyperconnectivity and the Internet of Things, 2018

Two significant issues loom throughout the cybersecurity domain. The first is the shortage of cybersecurity professionals and the second quandary is the lack of minimum entry standards in cybersecurity. Some organizations' cybersecurity operations are suffering due to the cybersecurity talent gap accompanied by the increasing sophistication and number of cyber-attack attempts. The shortage of cyber talent is rampant in private entities as in public agencies, which highlights the resolve for entry standards into cybersecurity to enhance the professionalization. Researchers and practitioners provide countless recommendations for ameliorating the cybersecurity workforce by addressing the professionalization issue. Professional associations are the nexus of cybersecurity and possess the expertise, leadership, and sustenance to spearhead efforts to develop national-level strategies to resolve the talent gap and establish professionalization standards.

One of the challenges in writing an article reviewing the current state of cyber education and workforce development is that there is a paucity of quantitative assessment regarding the cognitive aptitudes, work roles, or team organization required by cybersecurity professionals to be successful. In this review, we argue that the people who operate within the cyber domain need a combination of technical skills, domain specific knowledge, and social intelligence to be successful. They, like the networks they operate, must also be reliable, trustworthy, and resilient. Defining the knowledge, skills, attributes, and other characteristics is not as simple as defining a group of technical skills that people can be trained on; the complexity of the cyber domain makes this a unique challenge. There has been little research devoted to exactly what attributes individuals in the cyber domain need. What research does exist places an emphasis on technical and engineering skills while discounting the important social and organizational influences that dictate success or failure in everyday settings. This paper reviews the literature on cyber expertise and cyber workforce development to identify gaps and then argues for the important contribution of social fit in the highly complex and heterogenous cyber workforce. We then identify six assumptions for the future of cybersecurity workforce development, including the requirement for systemic thinkers, team players, a love for continued learning, strong communication ability, a sense of civic duty, and a blend of technical and social skill. Finally, we make recommendations for social and cognitive metrics which may be indicative of future performance in cyber work roles to provide a roadmap for future scholars.

arXiv (Cornell University), 2023

The demand for cyber security professionals is rising as the incidence of cyber crime and security breaches increases, leading to suggestions of a skills shortage in the technology industry. While supply and demand are factors in the recruitment process for any position, in order to secure the best people in the security field we need to know what skills are required to be a security professional in the current cyber security environment. This paper seeks to explore this question by looking at the current state of the Australian Industry. Recent job listings in the cyber security area were analysed, and current security professionals in industry were asked for their opinion as to what skills were required in this profession. It was found that each security professional role has its own set of skill requirements, however there is significant overlap between the roles for many soft skills, including analysis, consulting and process skills, leadership, and relationship management. Both communication and presentation skills were valued. A set of 'hard' skills emerged as common across all categories: experience, qualifications and certifications, and technical expertise. These appear to represent the need for a firm background in the security area as represented by formal study and industry certifications, and supported by solid experience in the industry. Specific technical skills are also required, although the exact nature of these will vary according to the requirements of each role.

What do the Financial Services and Chemical sectors have in common with the Transportation and Government Facilities sectors? All sectors need workers skilled in cybersecurity. What will it take to have qualified workforce candidates coming out of education or training programs with the necessary cybersecurity skills and abilities? A global study indicates there will be a shortage of approximately 1.8 million skilled cyber workers in the next few years (Center for Cyber Safety and Education 2017) . This creates a two-fold problem for national security and protecting our critical infrastructure from cyber attacks. First, is training a sufficient number of new information security workers and, second, is ensuring that existing Information Technology (IT) and cybersecurity workers have the requisite skills to provide necessary levels of security to protect information assets. This paper addresses the second issue – how to better equip learners to enter into, or remain in, the workforce with the necessary cybersecurity skills and abilities. This paper proposes the use of Competency-Based Education and Mastery Learning (CBML) methodologies as an innovative and more effective approach than the current Outcome-Based Education (OBE) approach. CBML methodologies strive for learners to master critical skills at a minimum 95% competency level, before moving on to the next knowledge or skill component; rather than the OBE approach, where a “passing” grade of “C” equates to a 70% competency level. From which approach would you want to hire cyber workers for the Healthcare and Public Health sector or the Energy sector?

2012

The cybersecurity workforce is one of the most critical employment sectors in the world. The systems supporting the information technology requirements of the world’s government, power, and financial systems are interconnected more than any other system in the world. Despite the criticality and interconnectivity of these systems, the workforce has developed without a concentrated and standard view of its requirements. In this paper the authors report on efforts in the last two years to define the requirements for developing the cybersecurity workforce.

Cybersecurity training becomes year after year more critical: as digitalization spreads in all spheres of civic, professional and social life, threats are both more insistent-as in so-called 'president extortions'-and more diffuse-as in ransomware. It is therefore urgent to focus training efforts on a general audience, on the one hand, and various trades, on the other hand, on actual risks bound with cybersecurity. We will present several examples of cybersecurity training covering this news stakes, as well as associated pedagogies: MOOCs, cyber-training platforms, lab session for administration of cybersecurity in industrial contexts, audit projects. The evolution of threats Cybersecurity training becomes year after year more critical: as digitalization spreads in all spheres of civic, professional and social life, threats are both more insistent-as in so-called 'president extortions'-and more diffuse-as in ransomware. The four categories of threats organisations currently face are the named financial extortion, site destruction, web site abuses and, officially since the BSI annual report for 2015 [BSI2015], physical site destruction. Site destruction has come to the centre of awareness since 9/11 on the one hand, and Katrina Hurricane, on the other. These two dramatic events initiated an area of massive Business recovery and continuity planning. Massive web site abuses have come to light after the low technology but quantitatively impressive attacks following terrorist attacks of January 2015 known as OpFrance: more than 20000 web sites have been reportedly been corrupted. Destruction of physical sites is a reality for civilian infrastructures since the burning of a foundry in Germany, even though it was already reported in diplomatic or military conflicts beforehand , as the Stuxnet case leading to destruction of centrifuge machines in Iran in 2010, or the explosion of a pipeline in Turkey in 2009. For all these reasons, the traditional approach to Cybersecurity teaching focusing on cryptography and network security urgently needs to be complemented by a new portfolio of cybersecurity trainings: cryptographic tools are nowadays available to the broad public and more than 70% of vulnerabilities are discovered at the application level. Training efforts now need to be strengthened on actual risks bound with cybersecurity. IT professionals must be trained to master the security issues of the tools they are implementing and deploying: software projects, liabilities and best practices in the health, bank, industry domains, as well as operational execution of security audits supporting day after day an improvement of cyber health of organisations and enterprises. Cybersecurity trainings should from now on encompass the full stack of security requirements of our organisations: sensibilization, web applications security, IoT security, risk analysis with a specific focus on connected physical infrastructures, and training for security audits. Sensibilization programs need to be target both at a broad audience, but also at top management and accounting teams who are regular targets for social engineering attacks [Puhakainen2010]. Programs are to be very specific to their target audience: Actual and perceived threats as well as efficient reactions may differ from continent to continents. Ransomware, president attacks, web exploit are relevant to all countries, but their prevalence, available government support for reaction and disclosure policies accepted by clients and partners are very heterogeneous from one location to

Journal of The Colloquium for Information Systems Security Education, 2017

Professionalization of a cybersecurity workforce is under development from multiple perspectives. Government agencies, the military and academic institutions strive to standardize excellent curriculum and career pathways, certifications, job descriptions classifications are contributing to the effort. In its infancy is the development of statistically validated psychological profiles of candidates' possessing the talent, disposition and interest to excel in the rapidly maturing field and diversifying field of cybersecurity. To address this gap, we propose to borrow from the well-established medical profession and utilize psychological profiling protocols tailoring a statistically validated career assessment tool to build cybersecurity psychological profiles of two markedly different cybersecurity career pathways. Once profiles are defined and validated we propose several Next Steps. Team members and industry partners comparing the psychological profiles can advise or refute a case to conduct additional profiling of additional cybersecurity career pathways. The assessment protocols and methodology will be disseminated to multiple communities at regional, national and international conferences to increase the diversity and numbers of talent entering the cybersecurity career pipeline.

Information Systems Frontiers

This research contributes to the knowledge of how Information Systems (IS) researchers can iteratively intervene with practitioners to co-create instructional programs with a framework designed for fast-paced, rapidly changing IS fields such as cybersecurity. We demonstrate how complex fields, such as cybersecurity, have the need for a skilled workforce that continues to rapidly outpace supply from universities. IS researchers partnering with practitioners can use this research as an exemplar of a method to design, build, and evaluate these innovative co-curricular IS programs. Moreover, we find these co-curricular IS programs are essential to upskilling students, integrating training on the latest tools, systems, and processes in these rapidly evolving disciplines.