Keywords

1 Background

Projections based on “A Human Capital Crisis in Cybersecurity” [2] in 2010 are being dwarfed by current projections for skilled cybersecurity professionals [3]. Recent projections by Tech Republic and Forbes indicate global projections of 1.8 million to 2.0 million unfilled cybersecurity jobs by 2022 [4, 5]. While IT has been traditionally considered the entry way into cybersecurity positions, the existing IT workforce and current IT-based programs are inadequate to meet the growing demand for workforce and professional development in cybersecurity.

Capacity is not the only challenge. The nature of cybersecurity careers and consequently the curricula for the training programs is shifting as well. As we transition from the Information Age into the Cyber-Mental Age [6] cybersecurity has to be fully integrated into all aspects of modern day society. Securing the Internet of Things and intelligent machines will require cross-disciplinary skills and knowledge beyond IT skills.

As NICE works to define cybersecurity pathways, UW CIAC has begun developing career guidance tools for use by candidates, counselors, academics, and practitioners. These career guidance tools estimate the multi-disciplinary aptitudes, soft skills, and character considerations, since integrity, trust and productive workplace behavior are important considerations for professionals with access to high value information.

2 Professionalization of Cybersecurity: Career Profiling and Professional Development

Initiatives to professionalize cybersecurity are underway. Research by Dr. Diana Burley of George Washington University proposes cybersecurity workforce development benchmarked against professionalization of the medical profession [7]. Building upon the medical model analogy, the UW CIAC team adapted research methodology building a psychological profile for Surgical Burn Unit residents as a protocol for selecting talent into cybersecurity.

In 2010 a team of psychologists published the “Psychological Profile of Surgeons and Surgical Residents” [8] a research project to ultimately increase retention of surgical residents. The project utilized two of three components of a validated assessment tool and focused on the Psychological Profile component. One scale, Career Aptitude, was not engaged for surgeons and surgical residents given the rigor required to progress through medical school into residency status and beyond. Cybersecurity leaders and employers emphasize the need to identify fundamental qualities that underlie reliability, ethics and trustworthiness to build a strong cyber workforce. Deficiencies in these qualities of character result in ‘insider threat’ concerns, which are a concern across all sectors. Trade journals and industry publications document the high cost of counterproductive workplace behavior when employees are not screened for honesty, integrity, positive fiscal attitudes and pro-social behavior. [9,10,11] Integrity First assesses five factors driving an individual’s integrity-related behavior in the workplace, which ultimately impacts an organization’s ROI [12]. A more detailed description of the dimensions of both tools, WOWI and Integrity First, is provided below.

A literature review of psychological career profiling across the medical field revealed a body of knowledge delineating differences between dermatologists, surgeons, radiologists, internists, family practice etc. [13, 14]. Following this example, we would ultimately like to profile all 35 career pathways within the field of cybersecurity. For the scope of this initial research project, we select two job roles to adapt the methodological approach from a mature profession like medicine to the emerging profession of cybersecurity.

The UW CIAC Research team reviewed the seven career pathways listed in the NIST NICE Cybersecurity Workforce Framework (‘Framework’) [15].

The interactive tool www.cyberseek.org provides an interactive heat map of supply and demand in 340 markets within the United States. The research team used the heat map for supply and demand, interviews with hiring managers, and consideration of the knowledge unit (KU) maps, to select the two job roles to study. Penetration testing was selected based upon the high demand for this specific skill set. 2017 witnessed the acceleration of ransom ware and increasing attacks from global cyber actors, escalating individuals with penetration testing skills as the most desired cybersecurity workers [4] (Table 1).

Table 1. NICE Framework workforce categories
Full size table

For the second job role, we selected careers that emphasized the communication, business, and policy aspects of cybersecurity [4]. Leaders also remain in high demand in cybersecurity, so we selected the category Oversight and Governance as the second career pathway. This part of the research study is the topic of another paper.

To study penetration testing, we selected all four specialty areas under the category Protect and Defend, in the Framework [16]. The Framework does not presently contain a specific job description for penetration tester. It identifies four specialty areas within the Protect and Defend category in which penetration testing is listed as a task: Cybersecurity Defense Analyst (CDA), Cybersecurity Defense Infrastructure Support (INF), Incident Response (CIR) and Vulnerability Assessment and Management (VAM).

Moreover, organizations have not yet fully adopted the Framework. Consequently, penetration testers’ actual job descriptions had to be collected and analyzed against the four Protect and Defend job roles to align results across the four work roles within Protect and Defend described in Table 2 [16].

Table 2. .
Full size table

3 Materials and Methods

3.1 Participants and Site Selection

Cybersecurity professionals from an array of Pacific Northwest corporations, state and municipal government, and the Washington Air National Guard 252nd Cyberspace Operations Group are scheduled to complete the assessment instruments in early 2018.

Site selection is based upon multiple factors. Organizational support, manager and subjects’ understanding how their contribution impacts the professionalization and quality development of cybersecurity talent are key factors. Criteria selection identified organizations with mature penetration testing functions. Departments with a sufficient number of employees, ideally more than eight, functioning primarily as penetration testers, or working within the four job titles identified by NICE, have been recruited to ensure that normative scaling can be accomplished. Confidentiality of subjects is a requirement in this study

Diversity of organizations provided another selection criteria. Initial outreach to the National Guard provided multi-dimensional aspects. Team members included in the National Guard sites are ‘traditional’ service members who attend monthly drill week-ends and, in most situations hold civilian positions in a variety of industries. Additional diversity of organization selection includes telecommunications, software development, health care, travel, aerospace, retail and government. On-site proctored data collection of the assessment tool is scheduled during the first quarter of 2018. Statistical analysis of data is scheduled for second quarter 2018 with dissemination of results being prepared and delivered in third quarter 2018.

3.2 Assessment Tools

Two validated on-line instruments were utilized to measure cybersecurity professionals. Assessment tools generally capture aptitude or interest; but rarely are psychological profiles combined in the same instrument. The World of Work Inventory (WOWI) collects data from subjects in all three dimensions. Measuring integrity is the fourth dimension incorporated through the Tescor Survey, also known as Integrity First.

4 The World of Work Inventory

The WOWI provides three subscales measuring career training potential (CTP), Job Satisfaction Indicators (JSI) and Career Interest Activities (CIA). Using a nomothetic approach, CTP assesses verbal, numerical, learning style, spatial ability, mechanical electrical and organizing skills with an added feature of this comparison scale also measures for subject’s motivational levels in each of these seven areas. (Table 3) [17].

Table 3. Measurements of Career Training Potential (CTP)
Full size table

The second and third subscales, JSI and CIA utilize ideographic scales. The JSI subscales measure twelve characteristics comprising psychological workstyle preferences (Table 4).

Table 4. Characteristics of Job Satisfaction Indicators (JSI) subsets
Full size table

The CIA subscale measures 17 Career Interest Activities corresponding to Table 5:

Table 5. .
Full size table

5 Integrity First

Integrity First is used during recruitment to identify and remove candidates with Counterproductive Workplace Behavior (CWB) from the hiring process. [18] This assessment adds a dimension not covered within career aptitude, psychological and interest assessments. Businesses desire ethical behavior and integrity in their employees; cybersecurity managers, military and civilian, deem ethics, integrity and positive workforce behavior essential when assembling cybersecurity pen testing teams. CWB falls into four fundamental categories: employee theft, hostility, drug abuse and hostility. Using overt testing methods, candidates chose one of four answers to direct questions regarding attitudes and high risk workplace behavior [19]. A more comprehensive list of CWB is provided in Table 6 [20]. The UW CIAC research team acknowledged there is a gap in career instruments including the WOWI, to overtly measure characteristics of integrity and ethics.

Table 6. Examples of counterproductive workplace behavior
Full size table

6 Conclusion

6.1 Participants and Site Selection Revisited

Organizational culture impacts data collection. Washington’s Air National Guard, government agencies and universities conduct annual performance reviews; but not all of these organizations rank and stack employee perfor. Military organizations have ingrained merit and ranking systems and conduct structured performance reviews. Government and academic organizations, while annual reviews are conducted, no merit ranking system is utilized.

Corporations in the Pacific Northwest, for the most part, migrated from strict adherence to a military merit rating system in favor of talent development and performance appraisals [20] based upon on-going adaptation of Douglas McGregor’s Theory X and Y

[21] Employees are assessed from multiple perspectives, personal and team interaction and contributions to corporate success are acknowledged, in some corporations, by bonuses [22]. This metric may supplant managerial ranking. Managerial ranking is being reviewed and compared to a revised Performance Appraisal system identifying end-of-year bonuses as a performance metric.

6.2 Hypothesis

Talent identification in cybersecurity informs the hypothesis that there are statistically significant profiles across measures of aptitude, personality type indicators, interests, and integrity such that (a) these profiles are a reliable predictor of success in careers within the Protect and Defend category in the NICE Workforce Framework and (b) the measuring instruments for these profiles are robust against biased inputs.

Initial research results focus on CTP, JSI, CIA and results from CWB defining profiles of high performing Protect and Defenders with an emphasis on the four job titles encompassing penetration testing proclivities. Additional research targeting specific job roles in Oversight and Governance, planned for later in 2018, provides the opportunity to compare profile results. Based upon the findings, additional research may be warranted.