Cybersecurity Work Research Articles

Cybersecurity work at Swedish administrative authorities: taking action or waiting for approval

In recent years, the Swedish public sector has undergone rapid digitalization, while cybersecurity efforts have not kept even steps. This study investigates conditions for cybersecurity work at Swedish administrative authorities by examining organizational conditions at the authorities, what cybersecurity staff do to acquire the cyber situation awareness required for their role, as well as what experience cybersecurity staff have with incidents. In this study, 17 semi-structured interviews were held with respondents from Swedish administrative authorities. The results showed the diverse conditions for cybersecurity work that exist at the authorities and that a variety of roles are involved in that work. It was found that national-level support for cybersecurity was perceived as somewhat lacking. There were also challenges in getting access to information elements required for sufficient cyber situation awareness.

Decoding the gendered imaginary of cybersecurity careers: a social shaping of technology perspective

ABSTRACT Women account for less than one quarter of the global cybersecurity workforce. Encouraging more women into cybersecurity careers has been identified as one way to address persistent skills shortages in this crucial field. Using expert elicitation, this paper draws on in-depth interviews with 31 senior cybersecurity professionals in Australia to analyse the popular imaginaries that characterise cybersecurity careers. Applying social shaping of technology to examine the causes and effects of women’s low participation in cybersecurity careers, this paper finds that cybersecurity careers are characterised by gendered imaginaries that frame cybersecurity as the exclusive domain of ‘hackers-in-hoodies’, secretive male operators possessed of highly specialised technical knowledge. These imaginaries not only distort the lived reality of cybersecurity work, limiting the popular appeal of cybersecurity careers, they also shape how cybersecurity itself is defined, with gendered effects. This paper calls for a more expansive and inclusive definition of cybersecurity to broaden the appeal of this increasingly interdisciplinary field and ensure gendered consideration of cyber risk.

Educating Cybersecurity Experts: Analysis of Cybersecurity Education in Finnish Universities

Cybersecurity is no longer just a technical discipline but a strategic concept. Nowadays, cybersecurity has become an essential part of national security strategies. The European Union and European countries have established cybersecurity strategies to strengthen European and national resilience against cyber threats and ensure that citizens and businesses can take full advantage of reliable services and digital tools. A wide range of actors in society, from both government and non-government sectors, are already involved in cybersecurity work. However, there is a constant need to increase the workforce of cybersecurity specialists to manage cybersecurity risks. Finland's cybersecurity strategy emphasizes the importance of developing cybersecurity education to address the cybersecurity risks the country faces. For the nation to achieve cyber self-sufficiency, the pool of cybersecurity specialists should include experts in every knowledge area relevant to various aspects of cybersecurity. Universities have a role in training cybersecurity specialists through their education programs. Consequently, universities should offer comprehensive education encompassing all cybersecurity knowledge areas. This paper aims to overview the state of cybersecurity education in Finland's universities by focusing on cybersecurity education content. By analysing the content of the universities' cybersecurity education, the aim was to understand how current education in Finland meets the cybersecurity knowledge areas of the European Cybersecurity Taxonomy. In spring 2023, data on cybersecurity degree programs and courses were collected through surveys from nine Finnish universities providing cybersecurity education. As a result, we gained an understanding of the capability of Finnish university-level cybersecurity education to offer specialists in different domain areas of cybersecurity.

Identifying the Scope of Cybersecurity Research Conducted in the Maritime Industry: 2003 - 2023

The maritime industry plays a pivotal role in the modern economy, global trade, safety and transportation globally. Due to the rapid advancement and utilisation of technology in the field, the maritime industry is increasingly vulnerable to cybersecurity threats. The last decade saw many instances of infrastructure having been exploited or attacked, such as the maritime vessels themselves, the port infrastructure and the supply chain. Each component constituting the maritime industry requires unique system critical operations to ensure cybersecurity, however this paper focuses on certain aspects of the maritime industry only. As cybersecurity in the maritime industry is a growing field, this study determines the scope of cybersecurity research on maritime infrastructure which has been published to establish a baseline understanding of the current field. The paper presents the results from a systematic literature review conducted to assess the scope of current cybersecurity work published focusing on the maritime industry. The result from the study clearly shows the increased attention to cybersecurity in the maritime industry, which can be seen from the increased number of publications which showed a sharp increase after 2014.

Evaluation of an Internet of Things Device-Based Educational Approach to Engage a More Diverse Cybersecurity Workforce

Cybersecurity education heavily utilizes competition-based approaches, such as capture-the-flag (CTF) games to support the need for a skilled cybersecurity workforce. Although CTFs expose students to cybersecurity work competencies, their competitive nature may contribute to the lack of diversity in cybersecurity programs. In response, we developed a technology-based, experiential learning approach utilizing Internet of Things (IoT) devices to educate learners about cybersecurity concepts. We evaluated the approach’s effectiveness in engaging and sparking interest in a diverse sample of high school students. Our results indicated that (a) all participants reported a moderate challenge-skill balance, (b) underrepresented minorities (URMs) reported significantly higher engagement than non-URMs, and (c) significantly more female students compared to male students reported increased levels of intent to pursue cybersecurity after participating in the learning activity. We present the approach, methods, results, implications, and recommendations for the use of IoT devices in cybersecurity education to train a more diverse workforce.

Cybersecurity Work Force Scarcity

Cybersecurity Work Force Scarcity

An Exploration of the Awareness and Attitudes of Psychology Students Regarding Their Psychological Literacy for Working in the Cybersecurity Industry

We propose that psychology graduates are uniquely placed to work in the cybersecurity industry due to their understanding of human behavior and the possession of skills needed to address cybersecurity issues. However, there are challenges in attracting psychology graduates to the cybersecurity industry as they may not be fully aware of how skills developed in a psychology degree can be applied to a cybersecurity career. This small-scale evaluation explored psychology students' understanding of what working in cybersecurity entailed and what psychology skills and knowledge (their psychological literacies) they thought were needed for working in psychology and cybersecurity roles. Undergraduate psychology students ( N = 66) answered two open-ended questions about skills needed to work in cybersecurity and then judged the importance of nine psychological literacy items for working in cybersecurity and psychology. A content analysis revealed that students recognized not just the technical aspects of cybersecurity work but also aspects relating to human behavior. Seven of the nine psychological literacy items were perceived as significantly more important for working in psychology than cybersecurity. This study is the first to link psychological literacy to working in cybersecurity. The implications of the results are discussed in terms of supporting students to recognize their psychological literacies for cybersecurity careers and suggestions are made for awareness-raising initiatives.

BridgeInsight: An asset profiler for penetration testing in a heterogeneous maritime bridge environment

A maritime bridge environment is a heterogeneous ecosystem of complex systems for various operations. As part of new requirements set by the International Association of Classification Societies, ship operators must now maintain an asset inventory aboard vessels specifically to improve their cyber security. This paper discusses the development of a ship-specific asset profiler that will not only identify and record the devices present automatically but also provide an in-depth analysis of their properties and characteristics in an intelligent and user-friendly manner. As cyberattacks increase in the maritime industry, proper testing of ship systems is essential, to ensure vessels remain secure and the risk of a cyberattack is minimized. An asset profiler for the bridge environment would serve as a tool for profiling the devices, helping personnel make faster and well-informed decisions, and could be a component of a wider audit framework. This paper presents a ship bridge profiler (i.e., BridgeInsight) used to identify all devices on the bridge of a vessel automatically and which provides information on them using a generated PDF report that consists of graphs and charts. To do this, it uses the Random Forest classifier algorithm, and the information it provides will enable the auditor or pen tester to perform manual testing or automate audits, while also providing comprehensive information that engineers and mariners can use to comply with regulations. Highlights As part of new requirements set by the International Association of Classification Societies, ship operators must now maintain asset inventory aboard vessels specifically to improve their cyber security. This paper presents a ship bridge profiler (i.e., BridgeInsight) used to identify all devices on the bridge of a vessel automatically. We envision automated asset detection and classification to have even more benefit in future cyber security work, as penetration testing.

The Identification of Cybersecurity Work Roles for the Water Sector in South Africa

This paper presents the results of a content analysis conducted on the work roles of cybersecurity practitioners for the water sector of South Africa. The paper presents literature review findings on national and international frameworks and guidelines detailing cyber security considerations for the South African water sector as well as national and international guidelines and frameworks which detail the various work roles carried out by cybersecurity practitioners in an organisation. The study found that cyber security considerations and work roles such as physical security of assets, testing and assessment of cybersecurity methods, supply chains cyber security as well as incident investigation and interfacing with law enforcement, were not well defined for cyber security discipline. The study delivers a framework detailing the work roles of cybersecurity practitioners which can be applied to the South African water sector.

Mapping Competencies to Cybersecurity Work Roles

The increase of dependence on digital services as a result of the COVID-19 pandemic reinforced the general need to effectively address the long-term perceived cybersecurity expertise gap. One of the instruments that allow better coordination and optimisation of efforts towards expedient and meaningful cybersecurity training and innovation is an alignment of perspectives on the competency requirements associated with the sought-after cybersecurity experts. To this goal, our research team is developing a cybersecurity qualifications framework modelled on the US-focused NICE framework. In this contribution, we present our progress in mapping the expected competencies to the defined work roles.

A study on the legislative trend of cybersecurity legislation - Focusing on changes in legislation according to the amended 「NATIONAL INTELLIGENCE SERVICE KOREA ACT」 -

Since the late 2000s, as the importance of political, social, and cultural activities in cyberspace has been emphasized, interest in cyberspace safety and security has expanded. Therefore, in order to take systematic and prompt action in case of an accident while preparing measures against the threat, the role of intelligence agency is important. Cyberattacks taking place in cyberspace are technical and information security issues that need to be addressed at the individual or organizational level, and it is a problem that requires an immediate and comprehensive response at the national level, and the need for international cooperation is growing. Korea, a divided country, has a strong dependence on ICT and a high vulnerability to cyber safety, but it is criticized that the legal system in the field of cyber security to prepare for this is still insufficient. In this situation, it was pointed out that it is difficult to respond systematically and efficiently in the event of a cybersecurity crisis, and the legal basis for performing the mission is insufficient. Various types of cyber security related bills have been submitted according to the need to enact the Cyber Security Act, but they have not been enacted due to opposition from the opposition parties and civil society for privacy violations. While sympathizing with the importance of cybersecurity and the need for related laws, the lack of trust in the National Intelligence Service, which will obtain authority through the law, is acting as a stumbling block to the establishment of the legal system. It should be remembered that there cannot be a distinction between the public and private sectors in national security and that protection of all constitutional institutions, including the executive branch as well as the legislative and judicial branches, is important. Currently, there is no cybersecurity-related law that regulates both the public and private sectors and encompasses all other constitutional institutions such as the judiciary and legislative branch. In the meantime, the recent revision of「NATIONAL INTELLIGENCE SERVICE KOREA ACT」as an opportunity to clearly stipulate the cyber security mission of the National Intelligence Service and to enact the first presidential decree-related cyber security-related norms is an encouraging change. Therefore, this paper analyzes the recently reorganized Legislative Trends and Future Tasks for Cybersecurity Legislation- Focusing on changes in legislation according to the amended「National Intelligence Service Act」, 「Cyber Security Work Regulations」 and「Cyber Security Act Bill」 from the perspective of establishing an effective response system for cyber security, and analyzes the problems of current regulations and future cyber security A legal task was proposed to strengthen the legal system.

Incorporating active learning activities to the design and development of an undergraduate software and web security course

Data breaches and cybersecurity incidents have been a major concern for companies in various sectors, including healthcare, financial, entertainment, business, education, and government. Maintaining and protecting these systems requires a workforce that is educated with the practical and technical skills needed by cybersecurity experts for information warfare and non-technical skills demanded by the industry. This paper describes the design and development of an undergraduate software and web security course using active learning strategies. It discusses the rationale in the course design on the selected cybersecurity knowledge and skills for a cybersecurity course developed at York College of the City University of New York (CUNY). Several active learning activities were used to promote both technical security and non-technical skills necessary to perform cybersecurity work, such as think-pair-share, buzz group, and roleplay. The results show that active learning help promote students' development in solving problems, proposing solutions, and explaining ideas through writing and discussion, essential cybersecurity skills. The paper may serve as an informative guide for other instructors to promote active learning in their cybersecurity courses. A course evaluation survey has suggested favorable results using active learning activities in the class. Students believe that it helped them to understand complex concepts and engage with the materials and activities.

Increasing Cybersecurity Career Interest through Playable Case Studies

In this paper we introduce an approach to cybersecurity education and helping students develop professional understanding in the form of a Playable Case Study (PCS), a form of educational simulation that draws on affordances of the broader educational simulation genre, case study instruction, and educational Alternate Reality Games (or ARGs). A PCS is an interactive simulation that allows students to “play” through an authentic scenario (case study) as a member of a professional team. We report our findings over a multi-year study of a PCS called Cybermatics, with data from 111 students from two different U.S. universities who interacted with the PCS. Cybermatics increased student understanding about certain key aspects of professional cybersecurity work, improved their confidence in being able to successfully apply certain skills associated with cybersecurity, and increased about half of the students’ interest in pursuing a cybersecurity career. Students also reported a number of reasons why their perceptions changed in these areas (both positive and negative). We also discuss design tensions we experienced in our process that might be encountered by others when creating simulations like a PCS, as they attempt to balance the authenticity of designed learning experiences while also sufficiently scaffolding them for newcomers who have little background in a discipline.

Organizational science and cybersecurity: abundant opportunities for research at the interface

Cybersecurity is an ever-present problem for organizations, but organizational science has barely begun to enter the arena of cybersecurity research. As a result, the “human factor” in cybersecurity research is much less studied than its technological counterpart. The current manuscript serves as an introduction and invitation to cybersecurity research by organizational scientists. We define cybersecurity, provide definitions of key cybersecurity constructs relevant to employee behavior, illuminate the unique opportunities available to organizational scientists in the cybersecurity arena (e.g., publication venues that reach new audiences, novel sources of external funding), and provide overall conceptual frameworks of the antecedents of employees’ cybersecurity behavior. In so doing, we emphasize both end-users of cybersecurity in organizations and employees focused specifically on cybersecurity work. We provide an expansive agenda for future organizational science research on cybersecurity—and we describe the benefits such research can provide not only to cybersecurity but also to basic research in organizational science itself. We end by providing a list of potential objections to the proposed research along with our responses to these objections. It is our hope that the current manuscript will catalyze research at the interface of organizational science and cybersecurity.

Framework, Tools and Good Practices for Cybersecurity Curricula

Cybersecurity education and training are essential prerequisites of achieving a secure and privacy-friendly digital environment. Both professionals and the general public widely acknowledge the need for high-quality university education programs and professional training courses. However, guides, recommendations, practical tools, and good examples that could help institutions design appropriate cybersecurity programs are still missing. In particular, a comprehensive method to identify skills needed by cybersecurity work roles offered on the job market is missing. This paper aims to provide practical tools and strategies to help higher education providers design good cybersecurity curricula. First, we analyze the content of 89 existing study programs worldwide, collect recommendations of renowned institutions within and outside the EU, and provide a comprehensive survey accompanied by a dynamic web application called Education Map. Based on the knowledge about the current state in cybersecurity education, we design the SPARTA Cybersecurity Skills Framework that provides the currently missing link between work roles and required expertise and shows how to develop a curriculum that reflects job market requirements. Finally, we provide a practical tool that implements the framework and helps education and training providers design new study programs and analyze existing ones by considering the requirements of cybersecurity work roles.

The institutional logic of security assessment of cross-border data transfers in China: context and progress

“Data has become a national basic strategic resource.” This is the common understanding of the two basic official documents that are guiding China’s economic and social development so far: The Action Plan to Promote the Development of Big Data and the 13th Five-Year Plan. Therefore, China’s government must face as a top priority how to effectively protect data, a valuable national basic strategic resource. With the official start of the implementation of the Cybersecurity Law on 1 June 2017, the basic framework of China’s cybersecurity work and the work priorities for cybersecurity have been clearly defined. The Cybersecurity Law has a three-tiered design for data: protecting data’s confidentiality, integrity, and availability; personal information protection; and data protection at the national level. The Cross-Border Data Flows Security Assessment, as an important part of the data protection designed at the national level, is a key step in establishing a comprehensive data resource protection system in China. However, the comprehensiveness of the existing institutional design of the Cybersecurity Law is not yet commensurate with the importance of data, a basic strategic resource designated by the Chinese state. The Cybersecurity Law is off to a good start, but obviously we also need to develop additional data security management measures and other measures to make data protection really catch up with the pace of development of big data.

The NICE Challenge Project: Providing Workforce Experience Before the Workforce

This article explains how the National Initiative for Cybersecurity Education (NICE) Challenge Project (NCP) provides students with the opportunity to apply their knowledge, skills, and abilities to a realistic hands-on scenario similar to what would be expected of them in actual cybersecurity work roles. It also describes use cases, lessons learned, and the future focus of the project.

CyberMaster: An Expert System to Guide the Development of Cybersecurity Curricula

The growing number of reported cyber-attacks pose a difficult challenge to individuals, governments and organizations. Adequate protection of information systems urgently requires a cybersecurity-educated workforce trained using a curriculum that covers the essential skills required for different cybersecurity work roles. The goal of the CyberMaster expert system is to assist inexperienced instructors with cybersecurity course design. It is an intelligent system that uses visual feedback to guide the user through the design process. Initial test executions show the promise of such a system in addressing the enormous shortage of cybersecurity experts currently available for designing courses and training programs.

Identifying Dimensions of Cyber Aptitude

Cybersecurity is a broad and growing job field, encompassing many different job categories with different cognitive demands. Traditional, knowledge-based assessments may exclude candidates who are cognitively suited to performing cybersecurity work but who have not had the opportunity to learn the subject matter. Using the job categories included in the National Initiative for Cybersecurity Education (NICE) framework for the cybersecurity workforce, we propose a model for predicting cybersecurity aptitude beyond a general- intelligence approach. In addition to including general intelligence, the model is based on a classification of jobs as requiring real-time or deliberate performance, and proactive or reactive actions. We suggest that tasks, work roles, and people can be represented along the same set of axes to match job requirements to person attributes. These constructs can then be used to create assessments of potential for cybersecurity applicants, including one we propose, called the Cyber Aptitude and Talent Assessment (CATA).

Industry dynamics [MIIT Issued Guidance on Strengthening Cybersecurity Work in the Telecommunications and Internet Industries

Industry dynamics [MIIT Issued Guidance on Strengthening Cybersecurity Work in the Telecommunications and Internet Industries