Cyber Professionals Research Articles

Reintegration of cyber veterans: challenges and strategies for post-war transition.

Battles in the cyber domain often lack visibility compared to the physical domain, which can lead to insufficient appreciation of its actors' achievements by the general public and society. Nonetheless, it has become a crucial area of modern warfare in which cyber professionals defend the nation's critical infrastructure, support other military operations and achieve military objectives that could not be attained in other domains. Although cyber combatants might not have as high a risk of injury or death as those on the front lines, they still can face traumatic events and suffer from the same types of issues after the war as any other veteran. Earlier studies on war veterans have shown they have elevated risks of mental health issues, substance use, social problems and financial difficulties which might push some individuals towards a path of crime. The cyber domain is also not limited by time or place, which has given rise to cyber volunteerism in which skilled individuals around the globe decide to assist their own country or friendly nations. This publication aims to identify the challenges cyber veterans might face when transitioning back to civilian life and develop appropriate strategies to facilitate their reintegration. It also raises the awareness of the hundreds of thousands of volunteers who can develop similar problems after the war. Without proper awareness, support and dialogue, some of these individuals can also drift towards harmful social implications such as cybercrime.

The Importance of Malware Awareness for Aspiring Cyber Professionals: Applicability of Gamification Static Analysis Tools

The Importance of Malware Awareness for Aspiring Cyber Professionals: Applicability of Gamification Static Analysis Tools

Penetration Taxonomy: A Systematic Review on the Penetration Process, Framework, Standards, Tools, and Scoring Methods

Cyber attackers are becoming smarter, and at the end of the day, many novel attacks are hosted in the cyber world. Security issues become more complex and critical when the number of services and subscribers increases due to advanced technologies. To ensure a secure environment, cyber professionals suggest reviewing the information security posture of the organization regularly via security experts, which is known as penetration testing. A pen tester executes a penetration test of an organization according to the frameworks and standardization guidelines. Security breaches of the system, loopholes in OS or applications, network vulnerabilities, and breaking data integration scopes are identified, and appropriate remediation is suggested by a pen tester team. The main aim of a penetration process is to fix the vulnerabilities prior to the attack in tangible and intangible resources. Firstly, this review work clarifies the penetration conception and is followed by the taxonomy of penetration domains, frameworks, standards, tools, and scoring methods. It performs a comparison study on the aforementioned items that develops guidelines for selecting an appropriate item set for the penetration process according to the demand of the organization. This paper ends with a constructive observation along with a discussion on recent penetration trends and the scope of future research.

Sustainable development of the system of formal cyber education: reflection of modern concepts

The article defines the conceptual framework for sustainable development of the formal cyberworld system. An analysis of contemporary regulatory, legal, and scientific sources on the preparation of cyber specialists for the security and defense sector has been conducted. The main research methods identified are synthesis, comparative analysis, focusing method, and cause-and-effect method. The new U.S. Cybersecurity Strategy addressing cyber education issues has been analyzed, which sets new requirements for cyber professionals in the context of the transformation of the global and national security environment. The use of analysis data from EU cybersecurity educational programs revealed the characteristic variability of the cybersecurity educational landscape in the EU and helped identify key gaps in the preparation of future professionals. It has been demonstrated that the integration of Ukrainian cyber education into the Euro-Atlantic educational space should occur through the updating of cybersecurity curricula based on the best international practices, the establishment of a unified system for accreditation, certification, and the development of cyber e-learning platforms for formal education. The competency-based approach in the preparation of cyber specialists is identified as a priority direction in research across various fields of knowledge. It has been revealed that there is a hysteresis of skills within the knowledge-ability-skill triad, acquired during education, in relation to the demands of advanced technologies in professional activities.

Cybersecurity Insights Gleaned from World Religions

Organisations craft and disseminate security policies, encoding the actions they want employees to take to preserve and protect organisational information resources. They engage in regular cybersecurity awareness and training drives to ensure that employees know what to do, and how to do it. Despite these efforts, employees make mistakes or do not comply with policy dictates, triggering cybersecurity incidents. The reality is that whereas cyber professionals propose, human nature disposes.In addressing this kind of conundrum, researchers suggest that it could be beneficial to learn from the established practices of other domains that also grapple with erratic human behaviours. This seems reasonable, given that cybersecurity is a relatively young field, and not yet particularly successful in accommodating human nature and fallibility, whereas other fields have years of experience coping with these kinds of problems. Here, we consider learning from religions, which have been around for millennia. The one aspect that all understand is human nature, and the tendency of humans to make mistakes and behave ill-advisedly, sometimes despite knowing better. Religions have developed a number of practices to accommodate human frailties, and to care for their adherents. This might well be a fruitful domain for cybersecurity professionals to learn from, in terms of harnessing effective mechanisms to encourage secure behaviours.To this end, we explored the literature on religions, and interviewed a number of religious leaders to produce a ‘vision for cybersecurity’. The vision was evaluated by cybersecurity professionals, its target audience. We provide our vision here, in the hope that it will launch a debate into a more equitable new era of ‘best practice’ in the cybersecurity domain.

Managing Large-Scale Heterogeneous Deployments for Cybersecurity

In cyber defense, we must contend with the massive amounts of data being generated in a variety of different formats and speeds. Unfortunately, traditional tools and methods are not meeting the requirements for scale and speed and rely too heavily on heuristics. Advancements in mobile technologies and the Internet of Things (IoTs) will continue to contribute to the additional growth in data volumes anticipated for the foreseeable future. As data continues to grow in complexity and scale, cyber professionals must rely upon models that are more elaborate and sophisticated to predict future behavior. More complex models can give additional inference capabilities; however, they are also difficult to scale and deploy in real-time environments. Managing large-scale, heterogeneous deployments for cybersecurity is challenging. Hardware capabilities and software tools both motivate and limit computational and inferential objectives. Hence, the interplay between data science (especially machine learning) and computation become more significant than ever to explore to gain more insight into heterogeneous deployments and how they can be more effectively managed. In this study, we identify ways in which data science tools and techniques can be used in improving the management of large-scale heterogeneous deployments for cybersecurity.

Experiential Cyber Education

There is a gap between available cyber professionals with necessary skills and experience to meet industry requirements. Institutions of higher education (IHE)—as well as other programs—have begun increasing course and degree offerings to help educate, train, and even retrain working professionals to close this gap. Of growing importance are tools and techniques to supplement theoretical development with accelerated experiential cyber training. Fortunately, there has been an increase in providers offering these services, although they vary substantially in features, costs, and opportunities. The purpose of this research is to identify a current spectrum of vendors and opportunities providing hands-on cyber training. The authors of this paper include cyber faculty at a university offering undergraduate and master's cybersecurity degrees. Both degrees are offered to resident as well as online students.

Cybersecurity Workforce Development in Minority, Low Income, and Native American Reservation Communities

This study will explore an innovative approach to cybersecurity workforce development in low income, minority, and Native American reservation communities in a way that could address low living wages and high unemployment while meeting cyber workforce demands. In the efforts to build a robust talent pipeline, there is a critical need for innovative practices to educate the future cyber professions in underserved diverse communities. Systemically, diverse communities have been untapped, ignored, and undervalued for technical job opportunities. This study looks at using charter schools with minority demographics that should have advanced technology programs that address a colossal workforce development need in the U.S. by training future cyber professionals on the high school level.

The Core Cyber-Defense Knowledge, Skills, and Abilities That Cybersecurity Students Should Learn in School

Our cybersecurity workforce needs surpass our ability to meet them. These needs could be mitigated by developing relevant curricula that prioritize the knowledge, skills, and abilities (KSAs) most important to cybersecurity jobs. To identify the KSAs needed for performing cybersecurity jobs, we administered survey interviews to 44 cyber professionals at the premier hacker conferences Black Hat 2016 and DEF CON 24. Questions concerned 32 KSAs related to cyber defense. Participants rated how important each KSA was to their job and indicated where they had learned that KSA. Fifteen of these KSAs were rated as being of higher-than-neutral importance. Participants also answered open-ended questions meant to uncover additional KSAs that are important to cyber-defense work. Overall, the data suggest that KSAs related to networks, vulnerabilities, programming, and interpersonal communication should be prioritized in cybersecurity curricula.

Leveraging Lexical Link Analysis (LLA) To Discover New Knowledge

Lexical Link Analysis (LLA) is a form of text mining in which word meanings represented in lexical terms (e.g., word pairs) are treated as if they are in a community of a word network. LLA can provide automated awareness for analyzing text data and reveal previously unknown, data-driven themed connections. We applied LLA to develop authentic archetypes and conversely determine potential imposters of that same archetype. We use publically available social media data to develop a cyber professional as an example. This paper reports the development of the algorithm, the collection and labeling of data, as well as the results of analysis of the characteristics of three authentic cyber professionals using data collected from Facebook, LinkedIn and Twitter. This method can provide automated analyzing and understanding massive Big Data in open and social media data sources to discover new knowledge for a widening range of applications.

Military Cyber Professionals Have an Important Part to Play in the Obama-Trump Transition

Military Cyber Professionals Have an Important Part to Play in the Obama-Trump Transition

Educating Cyber Professionals: A View from Academia, the Private Sector, and Government

How do we solve the workforce problem? Guest editor Mischel Kwon brought together a group of people from government, private-sector, and academic backgrounds to discuss the challenges in educating cyber professionals.

A Tale of Three Cyber-Defense Workshops

Since 2006, the National Cyber Defense Initiative (NCDI), an ad hoc group of cyber professionals, has been working behind the scenes to help inform the US research agenda for strategic cyber defense. These activities have been in anticipation of the country and its leadership developing the will to aggressively invest in the area to reduce the significant risk the country faces. An important part of the NDCI's activities has been sponsorship of three workshops so far: the 2006 Safe-Computing Workshop, the 2007 Opening-Moves Workshop, and the 2008 Industry Workshop. Here we look at them and their results.

The cybersecurity challenge

The cybersecurity challenge