Cybersecurity Careers Research Articles

Decoding the gendered imaginary of cybersecurity careers: a social shaping of technology perspective

ABSTRACT Women account for less than one quarter of the global cybersecurity workforce. Encouraging more women into cybersecurity careers has been identified as one way to address persistent skills shortages in this crucial field. Using expert elicitation, this paper draws on in-depth interviews with 31 senior cybersecurity professionals in Australia to analyse the popular imaginaries that characterise cybersecurity careers. Applying social shaping of technology to examine the causes and effects of women’s low participation in cybersecurity careers, this paper finds that cybersecurity careers are characterised by gendered imaginaries that frame cybersecurity as the exclusive domain of ‘hackers-in-hoodies’, secretive male operators possessed of highly specialised technical knowledge. These imaginaries not only distort the lived reality of cybersecurity work, limiting the popular appeal of cybersecurity careers, they also shape how cybersecurity itself is defined, with gendered effects. This paper calls for a more expansive and inclusive definition of cybersecurity to broaden the appeal of this increasingly interdisciplinary field and ensure gendered consideration of cyber risk.

An Exploration of the Awareness and Attitudes of Psychology Students Regarding Their Psychological Literacy for Working in the Cybersecurity Industry

We propose that psychology graduates are uniquely placed to work in the cybersecurity industry due to their understanding of human behavior and the possession of skills needed to address cybersecurity issues. However, there are challenges in attracting psychology graduates to the cybersecurity industry as they may not be fully aware of how skills developed in a psychology degree can be applied to a cybersecurity career. This small-scale evaluation explored psychology students' understanding of what working in cybersecurity entailed and what psychology skills and knowledge (their psychological literacies) they thought were needed for working in psychology and cybersecurity roles. Undergraduate psychology students ( N = 66) answered two open-ended questions about skills needed to work in cybersecurity and then judged the importance of nine psychological literacy items for working in cybersecurity and psychology. A content analysis revealed that students recognized not just the technical aspects of cybersecurity work but also aspects relating to human behavior. Seven of the nine psychological literacy items were perceived as significantly more important for working in psychology than cybersecurity. This study is the first to link psychological literacy to working in cybersecurity. The implications of the results are discussed in terms of supporting students to recognize their psychological literacies for cybersecurity careers and suggestions are made for awareness-raising initiatives.

Sociocultural Barriers for Female Participation in STEM: A Case of Saudi Women in Cybersecurity

The participation of women in Science, Technology, Engineering, and Mathematics (STEM) workforces is overwhelmingly low as compared to their male counterparts. The low uptake of cybersecurity careers has been documented in the previous studies conducted in the contexts of the West and Eastern worlds. However, most of the past studies mainly covered the Western world leaving more knowledge gaps in the context of Middle Eastern countries such as Saudi Arabia. Thus, to fill the existing knowledge gaps, the current study focused on women in Saudi Arabia. The aim of the study was to investigate the factors behind the underrepresentation of Saudi women in the cybersecurity space by specifically targeting the existing socio-cultural barriers. The study used a qualitative design that entailed reliance on both primary interview data and additional evidence from prior literature to evaluate the barriers faced by Saudi women in cybersecurity. A sample of 15 Saudi women aged 18 – 30 years with a college education or still in college pursuing a course in IT (Information Technology) or had basic computer literacy skills was purposefully recruited as the most desirable participants. A thematic analysis process was conducted on the primary data to generate theory from the findings, further compared with and verified based on a critical literature review. The themes that were generated from the interviews include lack of autonomy, family responsibilities, female as the weaker gender, and child bearing and caring duties.

Teaching pentesting to social sciences students using experiential learning techniques to improve attitudes towards possible cybersecurity careers

Labor market analysis shows that there is a significant shortage of experienced cybersecurity professionals, and this trend is expected to continue in the future. In addition, young people who are reluctant to choose STEM subjects in school typically do not see cybersecurity as a part of their future because they believe it demands exclusive technical knowledge that is beyond their reach. We aimed to change this perception among students of the social sciences, assuming that by providing social science students with the basics of cybersecurity, it would be possible to raise their awareness and encourage them to consider this field as a potential career option. Our team has designed a concise technical course based on Kolb's model that employs experiential learning to provide students with a basic knowledge of ethical intrusion (penetration testing). During the 32-hour subject, cadet officers with no prior IT education experienced all the steps of hacking both into a remotely accessible and physically accessible computer, including initial reconnaissance, vulnerability scanning, exploitation, and privilege escalation. A hands-on practical task of breaking into a highly vulnerable remote computer allowed for the evaluation of knowledge and skills as well as the reinforcement of learning experiences. In order to assess how the students' perceptions of the cybersecurity profession have changed based on the theory of planned behavior, they were asked to provide feedback immediately after the course and one year later. The results indicate that the short, technically challenging, but practical course based on experiential learning had a significant and positive effect on participants' attitudes: they were substantially more likely to consider cybersecurity as a future career, and some of them began participating in other cybersecurity courses or activities. It is reasonable to assume, therefore, that providing similar technical courses to social science students will encourage them to pursue cybersecurity-related careers in the future.

Barriers to a cybersecurity career: Analysis across career stage and gender

The demand for cybersecurity professionals is high—especially for women. Efforts to attract women to cybersecurity careers are not meeting goals of equal representation. Researchers have not yet identified a theoretical rationale for the differences. To provide a theoretical rationale, we investigate barriers to a cybersecurity career based on career stages defined by Super (1957) and gender. Concerns about a cybersecurity career differ between girls, young adult women, and mid-career women. Girls feel an unawareness of opportunity and requisite training, whereas adult women are concerned that they will be undervalued in a male-dominated field, and mid-career women are concerned about being harassed in a male-dominated field. This paper outlines several suggestions for improving these concerns.

Closing the Gap

This paper describes the activities and results of a George Washington University DoD Cyber Scholarship Program (CySP) capacity building project Grant No. H98230-19-1-0320 during the 2020-2021 academic year. In particular, the report provides information about the conference held on “Closing the Gap: Re-entry of Women Veterans into Cybersecurity Careers.”
 Closing the Gap was a working virtual conference combining presentations and break-out discussions which focused on the research in cyber workforce development and gender issues. By bringing together a variety of stakeholders in this topic, this working conference was able to address how to overcome challenges to increase the recruitment, representation, and retention of women veterans in the cybersecurity workforce and to provide practical suggestions for improvement.

Connecting O*Net® Database to Cybersecurity Workforce Professional Certifications

The Occupational Information Network O*NET is considered the primary source of occupational information in the U.S. I explore here possible uses of O*NET data to inform cybersecurity workforce readiness certification programs. The O*NET database is used to map out education requirements and how they relate to professional certifications as required by employers and job designers in accordance with the National Initiative for Cybersecurity Careers and Studies (NICCS). The search focuses on the “Information Security Analysts” occupation as listed on O*NET, Careeronestop, U.S. Bureau of Labor Statistics (BLS), and finally tied back to NICCS source work role to identify certifications requirements. I found that no site has listed any certification as required, desirable or mandatory. NICCS offered general guidance to potential topics and areas of certification. Careeronestop site provided the ultimate guidance for this role certification. Professional certifications are still not integrated in the Cybersecurity Workforce Framework official guidance.

Increasing Cybersecurity Career Interest through Playable Case Studies

In this paper we introduce an approach to cybersecurity education and helping students develop professional understanding in the form of a Playable Case Study (PCS), a form of educational simulation that draws on affordances of the broader educational simulation genre, case study instruction, and educational Alternate Reality Games (or ARGs). A PCS is an interactive simulation that allows students to “play” through an authentic scenario (case study) as a member of a professional team. We report our findings over a multi-year study of a PCS called Cybermatics, with data from 111 students from two different U.S. universities who interacted with the PCS. Cybermatics increased student understanding about certain key aspects of professional cybersecurity work, improved their confidence in being able to successfully apply certain skills associated with cybersecurity, and increased about half of the students’ interest in pursuing a cybersecurity career. Students also reported a number of reasons why their perceptions changed in these areas (both positive and negative). We also discuss design tensions we experienced in our process that might be encountered by others when creating simulations like a PCS, as they attempt to balance the authenticity of designed learning experiences while also sufficiently scaffolding them for newcomers who have little background in a discipline.

Toward Cyber Workforce Development: An Exploratory Survey of Information Security Professionals

High-profile cases of network intrusions in private organizations are becoming a regular occurrence, illustrating the vulnerabilities in current information technology. Cybersecurity is an emerging specialization within information technology careers. Demand for cybersecurity professionals greatly outstrips supply, and the disparity is expected to grow. In this paper, we describe existing efforts to professionalize cybersecurity careers and contribute the results of two exploratory surveys of cybersecurity subject-matter experts (SMEs) working in large corporations in California’s Silicon Valley. We asked SMEs about their training and experience, process for threat detection and response, team organization, and major challenges. Our results are the first in a series of studies aimed at bridging the gap between evolving knowledge, skills, and attitudes (KSAs) and the development of training needed to support the cybersecurity workforce.

The Outcomes of Cybersecurity Competitions and Implications for Underrepresented Populations

Although advocates promote cybersecurity competitions as beneficial for participants, little research has methodically evaluated these competitions' outcomes and implications. Drawing primarily on Cybersecurity Competition Federation workshops, literature reviews, and outcomes of similar STEM competitions, the authors consider how cybersecurity competitions might increase student awareness of cybersecurity careers and build their confidence and self-efficacy. Studies relevant to gifted students, females, and low-income and/or high-risk groups are highlighted.

Cybersecurity Competitions: The Human Angle

As a first step in a larger research program, the authors surveyed Cybersecurity Awareness Week participants. By better understanding the characteristics of those who attend such events, they hope to design competitions that will inspire students to pursue cybersecurity careers.

Engaging learners in cybersecurity careers

Educators and sponsors endorse competitions as a strong, positive influence on career choice. However, empirical studies of cybersecurity competitions are lacking, and evidence from computer science and mathematics competitions has been mixed. Here we report initial results from an ongoing study of the National Cyber League to provide a glimpse of the role of competitions in fostering cybersecurity career engagement. Preliminary results suggest that cyber competitions attract experienced individuals who will remain in the profession for the long-term, but future research is needed to understand how cyber competitions may engage women and those new to the field.

Cashing in on Security Training

At long last, a cybersecurity career field has emerged. The (ISC)2 US Government Advisory Board Executive Writers Bureau examines where employment opportunities lie and how much you can expect to be paid in this very important sector