Cybersecurity Workforce Research Articles

Decoding the gendered imaginary of cybersecurity careers: a social shaping of technology perspective

ABSTRACT Women account for less than one quarter of the global cybersecurity workforce. Encouraging more women into cybersecurity careers has been identified as one way to address persistent skills shortages in this crucial field. Using expert elicitation, this paper draws on in-depth interviews with 31 senior cybersecurity professionals in Australia to analyse the popular imaginaries that characterise cybersecurity careers. Applying social shaping of technology to examine the causes and effects of women’s low participation in cybersecurity careers, this paper finds that cybersecurity careers are characterised by gendered imaginaries that frame cybersecurity as the exclusive domain of ‘hackers-in-hoodies’, secretive male operators possessed of highly specialised technical knowledge. These imaginaries not only distort the lived reality of cybersecurity work, limiting the popular appeal of cybersecurity careers, they also shape how cybersecurity itself is defined, with gendered effects. This paper calls for a more expansive and inclusive definition of cybersecurity to broaden the appeal of this increasingly interdisciplinary field and ensure gendered consideration of cyber risk.

Evaluating Cybersecurity Class Activities Based on the Cognitive Continuum Theory: An Exploratory Case Study

With the cybersecurity workforce estimated to have grown to 5.5 million in 2023 but still facing a significant shortage, there is an urgent need for educational strategies that can effectively enhance decision-making skills in this domain. This paper explores the application of Hammond's Cognitive Continuum Theory (CCT) in the context of K-12 cybersecurity education, aiming to address the global cybersecurity workforce shortage and skills gap by preparing the next generation of cybersecurity professionals. This study adopts a case-study methodology to investigate the use of CCT in a high school "Cybersecurity and Ethical Hacking" class, analysing 104 tasks across six class activities to determine how different cognitive modes (Analytical Cognition, Quasi-Rational Cognition, and Intuitive Cognition) are induced by various task characteristics from CCT’s Task Continuum Index (TCI). Analytical cognition consists of rational decision making while Intuitive Cognition represents intuitive decision making. Quasi-Rational Cognition represents a blend of these two decision making styles. Directed content analysis and thematic analysis reveal that most tasks in the case promoted Analytical Cognition, with a significant presence of tasks inducing Quasi-Rational Cognition and fewer tasks facilitating Intuitive Cognition. The findings also highlight the dominance of information retrieval and analysis, methodical approaches in information seeking, and synthesis and decision-making across the cognitive modes, pointing towards the critical role of information behaviour in cybersecurity tasks. This research provides insights into how CCT can potentially inform the design of educational activities in cybersecurity, suggesting that a balanced inclusion of tasks across the cognitive spectrum can better prepare students for the complexities of the cybersecurity field. The paper discusses the implications for cybersecurity education, emphasising the need for instructional strategies that encompass a range of cognitive modes to reflect real-world challenges and enhance decision-making capabilities in future professionals. Additionally, the findings make a connection between cybersecurity tasks and school library instruction which focuses heavily on information behaviours. Limitations and directions for future research, including expanding data collection and connecting CCT to other theoretical frameworks, are also discussed.

Mining Reddit users’ perspectives on cybersecurity competitions: a mixed method approach

Purpose Cybersecurity competitions can effectively develop skills, but engaging a wide learner spectrum is challenging. This study aims to investigate the perceptions of cybersecurity competitions among Reddit users. These users constitute a substantial demographic of young individuals, often participating in communities oriented towards college students or cybersecurity enthusiasts. The authors specifically focus on novice learners who showed an interest in cybersecurity but have not participated in competitions. By understanding their views and concerns, the authors aim to devise strategies to encourage their continuous involvement in cybersecurity learning. The Reddit platform provides unique access to this significant demographic, contributing to enhancing and diversifying the cybersecurity workforce. Design/methodology/approach The authors propose to mine Reddit posts for information about learners’ attitudes, interests and experiences with cybersecurity competitions. To mine Reddit posts, the authors developed a text mining approach that integrates computational text mining and qualitative content analysis techniques, and the authors discussed the advantages of the integrated approach. Findings The authors' text mining approach was successful in extracting the major themes from the collected posts. The authors found that motivated learners would want to form a strategic way to facilitate their learning. In addition, hope and fear collide, which exposes the learners’ interests and challenges. Originality/value The authors discussed the findings to provide education and training experts with a thorough understanding of novice learners, allowing them to engage them in the cybersecurity industry.

CyberQ: Generating Questions and Answers for Cybersecurity Education Using Knowledge Graph-Augmented LLMs

Building a skilled cybersecurity workforce is paramount to building a safer digital world. However, the diverse skill set, constantly emerging vulnerabilities, and deployment of new cyber threats make learning cybersecurity challenging. Traditional education methods struggle to cope with cybersecurity's rapidly evolving landscape and keep students engaged and motivated. Different studies on students' behaviors show that an interactive mode of education by engaging through a question-answering system or dialoguing is one of the most effective learning methodologies. There is a strong need to create advanced AI-enabled education tools to promote interactive learning in cybersecurity. Unfortunately, there are no publicly available standard question-answer datasets to build such systems for students and novice learners to learn cybersecurity concepts, tools, and techniques. The education course material and online question banks are unstructured and need to be validated and updated by domain experts, which is tedious when done manually. In this paper, we propose CyberGen, a novel unification of large language models (LLMs) and knowledge graphs (KG) to generate the questions and answers for cybersecurity automatically. Augmenting the structured knowledge from knowledge graphs in prompts improves factual reasoning and reduces hallucinations in LLMs. We used the knowledge triples from cybersecurity knowledge graphs (AISecKG) to design prompts for ChatGPT and generate questions and answers using different prompting techniques. Our question-answer dataset, CyberQ, contains around 4k pairs of questions and answers. The domain expert manually evaluated the random samples for consistency and correctness. We train the generative model using the CyberQ dataset for question answering task.

Predicting and Visualizing Lateral Movements Based on ATT&CK and Quantification Theory Type 3

When a cyber incident occurs, organizations need to identify the attack's impacts. They have to investigate potentially infected devices as well as certainly infected devices. However, as an organization's network expands, it is difficult to investigate all devices. In addition, the cybersecurity workforce shortage has risen, so organizations need to respond to incidents efficiently with limited human resources. To solve this problem, this paper proposes a tool to assist an incident response team. It can visualize ATT&CK techniques attacker used and, furthermore, detect lateral movements efficiently. The tool consists of two parts: a web application that extracts ATT&CK techniques from logs and a lateral movement detection system. The web application was implemented and could map the collected logs obtained from an actual Windows device to the ATT&CK matrix. Furthermore, actual lateral movements were performed in an experimental environment that imitated an organizational network, and the proposed detection system could detect them.

Improving Belonging and Connectedness in the Cybersecurity Workforce: From College to the Profession

Improving Belonging and Connectedness in the Cybersecurity Workforce: From College to the Profession

Evaluation of an Internet of Things Device-Based Educational Approach to Engage a More Diverse Cybersecurity Workforce

Cybersecurity education heavily utilizes competition-based approaches, such as capture-the-flag (CTF) games to support the need for a skilled cybersecurity workforce. Although CTFs expose students to cybersecurity work competencies, their competitive nature may contribute to the lack of diversity in cybersecurity programs. In response, we developed a technology-based, experiential learning approach utilizing Internet of Things (IoT) devices to educate learners about cybersecurity concepts. We evaluated the approach’s effectiveness in engaging and sparking interest in a diverse sample of high school students. Our results indicated that (a) all participants reported a moderate challenge-skill balance, (b) underrepresented minorities (URMs) reported significantly higher engagement than non-URMs, and (c) significantly more female students compared to male students reported increased levels of intent to pursue cybersecurity after participating in the learning activity. We present the approach, methods, results, implications, and recommendations for the use of IoT devices in cybersecurity education to train a more diverse workforce.

Cybersecurity Work Force Scarcity

Cybersecurity Work Force Scarcity

Optimal Job Role Allocation for Compliance With NCA-ECC Controls Using the Saudi Cybersecurity Workforce Framework

Optimal Job Role Allocation for Compliance With NCA-ECC Controls Using the Saudi Cybersecurity Workforce Framework

Cybersecurity Workforce Development: Bridging The Skills Gap in The Age of Automation 

Cybersecurity Workforce Development: Bridging The Skills Gap in The Age of Automation 

On cultivation of cybersecurity and safety talents and responsible developers

To address the serious imbalance between the supply and demand of the cybersecurity workforce, this paper proposes to embrace the latest trend of a fundamental shift in the “underlying dynamics of the digital ecosystem”, focusing on a shared liability for cybersecurity between the application side and the manufacturing side. Assuming that product providers shall take more responsibility by implementing secure defaults, this paper explores the establishment of an S&S talent cultivation system to strike the right balance of cybersecurity liabilities by nurturing more responsible developers. This paper proposes a Knowledge, Skill, and Awareness (KSA) model for Security and Safety (S&S) talent cultivation, proves the feasibility of this model by analyzing the theoretical, disciplinary, methodological, practical, and societal foundations of S&S talent cultivation. Additionally, this paper proposes principles and strategies for building a S&S talent cultivation system based on its unique characteristics and patterns. It gives a talent cultivation scheme, supported by an “Independent Knowledge System, Education and Cultivation System, Practice and Training system, Evaluation and Certification system, and Awareness Popularization System”. Finally, this paper puts forward a proposal for coordinating efforts and adopting multiple measures to accelerate the cultivation of S&S talents.

Advanced Cybersecurity Strategies for Protecting Critical Infrastructure: Strengthening the Backbone of National Security

In an era characterized by rapidly evolving cyber threats, the safeguarding of critical infrastructure (CI) has become paramount. Cyber threats are not only growing in sophistication but also in frequency, presenting unprecedented challenges to the security of essential systems. Critical infrastructure encompasses vital sectors such as energy, transportation, healthcare, and financial services, all of which serve as the backbone of modern societies. The interconnectedness of these infrastructures means that a disruption in one sector can lead to cascading effects across others. For instance, a cyberattack on a power grid can result in widespread outages, impacting hospitals, transportation systems, and financial institutions, thereby resulting in chaos and significant economic repercussions. Such disruptions pose serious risks to national security and public safety, as evidenced by incidents like the ransomware attack on the Irish Health Service Executive in 2021, which disrupted medical services and endangered lives. The increasing reliance on digital technologies, including the Internet of Things (IoT) and cloud computing, further complicates the cybersecurity landscape. While IoT devices enhance operational efficiency, they also introduce numerous entry points for cybercriminals, expanding the potential attack surface. Cloud computing, although offering scalability and flexibility, raises concerns about data privacy and the security of third-party services. To address these multifaceted challenges, this paper explores the critical importance of cybersecurity in protecting CI. It will examine key strategies to enhance resilience against cyber threats, analyze emerging threats that could compromise CI, and provide recommendations for building a robust cybersecurity workforce capable of responding to these evolving challenges. By understanding the vulnerabilities and risks associated with critical infrastructure, stakeholders can better implement advanced cybersecurity strategies to safeguard the systems that underpin national security and economic stability.

Addressing Bio-Cybersecurity Workforce Employee Shortages in Biotechnology and Health Science Sectors in the U.S.

Abstract The ever-increasing demand for employees with cybersecurity and artificial intelligence expertise in healthcare technology roles has resulted in an unprecedented skills shortage. Historically Black Colleges and Universities (HBCUs) and Historically Women’s Colleges (HWCs) can significantly develop under-represented and diverse talent in this field. As bio-cybersecurity concerns widen, there is an urgent need for individuals with skillsets related to the security of biological payloads and systems. In addition, the inclusion of traditionally under-represented groups into the cybersecurity workforce is necessary to ensure the diversity of skills and security knowledge needed to combat cyberattacks. This paper will discuss how HBCUs and HWCs can contribute to diversifying the cybersecurity workforce, their role in developing artificial intelligence (AI) and bio-cybersecurity talent, and how they can provide an educational platform for new and under-represented talent in the field. It will also address the need for experienced artificial intelligence experts, bio-cybersecurity professionals, educators, and policymakers to facilitate the integration of cybersecurity experts into the traditional biological workforce. Ultimately, this paper will demonstrate how the inclusion of diverse and traditionally under-represented individuals in bio-cybersecurity and artificial intelligence (AI) will benefit the security infrastructure of biological systems.

Boosting Holistic Cybersecurity Awareness with Outsourced Wide-Scope CyberSOC: A Generalization from a Spanish Public Organization Study

Public sector organizations are facing an escalating challenge with the increasing volume and complexity of cyberattacks, which disrupt essential public services and jeopardize citizen data and privacy. Effective cybersecurity management has become an urgent necessity. To combat these threats comprehensively, the active involvement of all functional areas is crucial, necessitating a heightened holistic cybersecurity awareness among tactical and operational teams responsible for implementing security measures. Public entities face various challenges in maintaining this awareness, including difficulties in building a skilled cybersecurity workforce, coordinating mixed internal and external teams, and adapting to the outsourcing trend, which includes cybersecurity operations centers (CyberSOCs). Our research began with an extensive literature analysis to expand our insights derived from previous works, followed by a Spanish case study in collaboration with a digitization-focused public organization. The study revealed common features shared by public organizations globally. Collaborating with this public entity, we developed strategies tailored to its characteristics and transferrable to other public organizations. As a result, we propose the “Wide-Scope CyberSOC” as an innovative outsourced solution to enhance holistic awareness among the cross-functional cybersecurity team and facilitate comprehensive cybersecurity adoption within public organizations. We have also documented essential requirements for public entities when contracting Wide-Scope CyberSOC services to ensure alignment with their specific needs, accompanied by a management framework for seamless operation.

Building the Operational Technology (OT) Cybersecurity Workforce: What are Employers Looking for?

A trained workforce is needed to protect operational technology (OT) and industrial control systems (ICS) within national critical infrastructure and critical industries. However, what knowledge, skills, and credentials are employers looking for in OT cybersecurity professionals? To best train the next generation of OT cybersecurity professionals, an understanding of current OT cybersecurity position requirements is needed. Thus, this work analyzes 100 OT cybersecurity positions to provide insights on key prerequisite requirements such as prior professional experience, education, industry certifications, security clearances, programming expertise, soft verbal and written communication skills, knowledge of OT frameworks, standards, and network communication protocols, and position travel. We found that OT cybersecurity roles are typically non-entry level, as experience was the most common requirement, and was required on 95% of analyzed positions. Possession of a bachelor’s degree or higher was required for 82% of positions, while industry certifications such as the Certified Information Systems Security Professional (CISSP) or the Global Information Assurance Certification (GIAC) Global Industrial Cyber Security Professional (GICSP) were listed on 64% of positions. Knowledge of OT or IT frameworks and standards and strong communication skills were listed on 48% of positions, while programming expertise, possession of the United States security clearance, and knowledge of OT or IT networking protocols were required for 18%, 24%, and 27% of positions, respectively. A work travel requirement was listed on 29% of positions. Individuals seeking to enter the OT cybersecurity field, and educational programs focusing on training OT cybersecurity professionals should prioritize obtaining experience, education, and certification, possessing strong communication skills, and knowledge of relevant OT and IT industry standards and frameworks.

Building a Diverse Cybersecurity Workforce: A Study on Attracting Learners with Varied Educational Backgrounds

Cybersecurity has traditionally been perceived as a highly technical field, centered around hacking, programming, and network defense. However, this article contends that the scope of cybersecurity must transcend its technical confines to embrace a more inclusive approach. By incorporating various concepts such as privacy, data sharing, and ethics, cybersecurity can foster diversity among audiences with varying educational backgrounds, thereby cultivating a richer and more resilient security landscape. A more diverse cybersecurity workforce can provide a broader range of perspectives, experiences, and skills to address the complex and ever-evolving threats of the digital age. The research focuses on enhancing cybersecurity education to attract a diverse audience through the development and testing of a virtual platform on Haaukins (a cybersecurity training platform) designed with features resembling social media for capture-the-flag exercises. The results show that the cyber training platform effectively engages a diverse group of learners, bridging the gap between traditional technical boundaries and the urgent demand for comprehensive cybersecurity competence.

Leveraging VR/AR/MR/XR Technologies to Improve Cybersecurity Education, Training, and Operations

The United States faces persistent threats conducting malicious cyber campaigns that threaten critical infrastructure, companies and their intellectual property, and the privacy of its citizens. Additionally, there are millions of unfilled cybersecurity positions, and the cybersecurity skills gap continues to widen. Most companies believe that this problem has not improved and nearly 44% believe it has gotten worse over the past 10 years. Threat actors are continuing to evolve their tactics, techniques, and procedures for conducting attacks on public and private targets. Education institutions and companies must adopt emerging technologies to develop security professionals and to increase cybersecurity awareness holistically. Leveraging Virtual/ Augmented/Mixed/Extended Reality technologies for education, training, and awareness can augment traditional learning methodologies and improve the nation’s cybersecurity posture. This paper reviews previous research to identify how distance and remote education are conducted generally, and how Virtual/Augmented/Extended/Mixed reality technologies are used to conduct cybersecurity awareness training, cybersecurity training, and conduct operations. Finally, barriers to adopting these technologies will be discussed. Understanding how these technologies can be developed and implemented provides one potential way of overcoming the cybersecurity workforce gap and increasing the competencies and capabilities of cybersecurity professionals.

Understanding How to Diversify the Cybersecurity Workforce: A Qualitative Analysis

A robust cybersecurity workforce is critical for protection against a range of malicious attacks. However, it has been noted that there are many vacancies and a shortage of individuals entering the cybersecurity workforce. This workforce shortage has partly been attributed to the lack of diversity in the cybersecurity field, with women, African Americans, and Hispanics remaining underrepresented in educational and professional settings. Using a qualitative approach, this work sought to investigate what led underrepresented minorities currently involved in cybersecurity to the industry, with the goal of determining methods to attract and diversify the workforce. A thematic analysis was conducted using data collected during interviews with 23 participants including underrepresented minority students, underrepresented minority professionals, college instructors, and a high school administrator. The interview questions aimed to address (a) what attracted minorities to the field, (b) how they overcame educational and professional roadblocks, (c) how they built non-technical knowledge, skills, and attitudes, and (d) how they maintained engagement. Findings revealed 17 themes that were related to characteristics of (a) the learner, (b) the instruction, and (c) the environment. Based on these findings, recommendations are presented to illustrate how these themes can be implemented by instructors with the goal of increasing the participation and involvement of underrepresented minorities and fostering diversity in the cybersecurity field.

Integrating certifications into the cybersecurity college curriculum: The efficacy of education with certifications to increase the cybersecurity workforce

One only needs to listen to the news reports to recognize that the gap between securing the enterprise and cybersecurity threats, breaches, and vulnerabilities appears to be widening at an alarming rate. An un-tapped resource to combat these attacks lies in the students of the secondary educational system. Necessary in the cybersecurity education is a 3-tiered approach to quickly escalate the student into a workplace-ready graduate. The analogy used is a three-legged-stool, where curriculum content, hands-on skills, and certifications are equal instruments in the edification of the cybersecurity student. This paper endeavors to delve into the 3rd leg of the stool by developing the concept of vendor-specific and vendor-neutral certifications to educate the cybersecurity student and test their capability of protecting the workplace. The research data was drawn from companies in the Atlanta, Georgia area, who employ and hire cybersecurity recruits. The data from the research proves certifications are necessary as an addition to the cybersecurity curriculum in the secondary education arena. The paper reviews the need for cybersecurity graduates, the balance between cybersecurity theory and applied skillsets, the difference between a certificate and a certification, benefits to the community, classifications of certifications, relevancy of a college degree in today’s workforce, and recommendations for further study.

Digital innovation through cybersecurity learning factories

Globally, the cybersecurity workforce changes tremendous challenges. Shortages in specialised cybersecurity staff members essentially puts organisations at risk. New graduates can face difficulties in entering the cybersecurity domain due to a lack of experience and knowledge. However, with the advent of newer techniques for knowledge development, we find that learning factories offer a fresh perspective. Learning factories provide a mechanism to remove the barriers in the field of cybersecurity and cultivate a nurturing training environment. This paper looks at the modernisation of traditional training by covering the application of learning factories in the cybersecurity field. It aims to show how knowledge can be geared into more practical schemes to empower participants and expose them to critical cybersecurity skills. Through the paper, it will be demonstrated that learning factories can be used for real-world learning and information sharing. Learning factories embody the principles of knowledge sharing and promotes more efficient knowledge management. With the use of nominated tools and technologies cyber security learning factories can help measure the effectiveness of worker training as well provide for consistent facilitated training. Overall, learning factories can help to transform training and build knowledge application.
 Learning factories may be set up to tackle real industry challenges and are particularly useful in the field of cybersecurity. Using learning factories there is an opportunity to advance multi-dimensional cybersecurity skills and develop innovation in the field. Due to the added advantages of Information and Communication Technology (ICT) being virtually accessible, there is the added benefits of agility, responsiveness and increased engagement. Using a variety of modes, cybersecurity learning factories can combine the techniques of gamification, videos, multi-media and simulation. All of this provided an augmented and enriched experience for participants. Learning factories are a low-cost solution to replicating working environments thus assisting in skills development. Through the application of learning factories, a skilled workforce can be developed and cultivated.