skip to main content
OSTI.GOV title logo U.S. Department of Energy
Office of Scientific and Technical Information

Title: Investigating the Relationship between Need for Cognition and Skill in Ethical Hackers

Abstract

As technology gets more complex and increasingly connected, there is an increasing concern with cyber security. There is also a growing demand for cyber security professionals. Unfortunately there currently are not enough skilled professionals to meet that demand. In order to prepare the next generation of cyber security professionals to meet this demand, we need to understand what characteristics make skilled cyber security professionals. For this work, we focus on professionals who take an offensive approach to cyber security, so called ethical hackers. These hackers utilize many of the same skills that the adversaries that we defend against would use, with the goal of identifying vulnerabilities and address them before they are exploited by adversaries. A commonly held belief among ethical hackers is that hackers must possess exceptional curiosity and problem solving skills in order to be successful. Curiosity is has been studied extensively in psychology, but there is no consensus on what it is and how to measure it. Further, many existing inventories for assessing curiosity are targeted at measuring curiosity in children. Although there isn’t an accepted standard to assess curiosity in adults, a related construct, called Need for Cognition (may capture what is meant when people speakmore » of curiosity. The Need for Cognition scale also captures the tendency toward preferring complex problems (which correlates with good problem solving skills), which may provide insight into what make skilled hackers. In addition to the Need for Cognition, we used a structured interview to assess hacker skill. Hackers rated their own skill on a scale from one to ten on a predefined list of hacker skills. They were then asked to rate a peer who they felt was most skilled in each of the skills. They were asked to rate two peers for each skill, one that they worked with directly and one person that was the most skilled in the field (these could be known by reputation only). The hypothesis is that hackers have a higher than average (i.e., compared to non-hackers) Need for cognition and that Need for Cognition will be positively correlated with self-reported and peer reported skill. We interviewed 20 cyber security researchers who specialize in offensive approaches. Based on the responses to the hacker skill inventory, we generated a self-reported skill score for each participant. We also developed a peer-rating for each participant based on the number of times each individual that was interviewed was named as the most skilled in a particular area. The results indicate that the sample of ethical hackers has a high Need for Cognition and that Need for cognition was related to both self-reported skill and peer-reported skill. The results are discussed in the context of training and recruitment of cyber security professionals.« less

Authors:
;
Publication Date:
Research Org.:
Idaho National Lab. (INL), Idaho Falls, ID (United States)
Sponsoring Org.:
USDOE Office of Nuclear Energy (NE)
OSTI Identifier:
1358196
Report Number(s):
INL/CON-15-37384
Journal ID: 978-3-319-41932-9
DOE Contract Number:
DE-AC07-05ID14517
Resource Type:
Conference
Resource Relation:
Journal Name: Part of the Advances in Intelligent Systems and Computing; Journal Volume: 501; Conference: 7th International Conference on Applied Human Factors and Ergonomics, Florida, USA, July 27–31, 2016
Country of Publication:
United States
Language:
English
Subject:
99 GENERAL AND MISCELLANEOUS; Curiosity; Cyber Security; Hacker; Need for Cognition; Skill

Citation Formats

Le Blanc, Katya, and Freeman, Sarah. Investigating the Relationship between Need for Cognition and Skill in Ethical Hackers. United States: N. p., 2016. Web. doi:10.1007/978-3-319-41932-9_18.
Le Blanc, Katya, & Freeman, Sarah. Investigating the Relationship between Need for Cognition and Skill in Ethical Hackers. United States. doi:10.1007/978-3-319-41932-9_18.
Le Blanc, Katya, and Freeman, Sarah. 2016. "Investigating the Relationship between Need for Cognition and Skill in Ethical Hackers". United States. doi:10.1007/978-3-319-41932-9_18. https://www.osti.gov/servlets/purl/1358196.
@article{osti_1358196,
title = {Investigating the Relationship between Need for Cognition and Skill in Ethical Hackers},
author = {Le Blanc, Katya and Freeman, Sarah},
abstractNote = {As technology gets more complex and increasingly connected, there is an increasing concern with cyber security. There is also a growing demand for cyber security professionals. Unfortunately there currently are not enough skilled professionals to meet that demand. In order to prepare the next generation of cyber security professionals to meet this demand, we need to understand what characteristics make skilled cyber security professionals. For this work, we focus on professionals who take an offensive approach to cyber security, so called ethical hackers. These hackers utilize many of the same skills that the adversaries that we defend against would use, with the goal of identifying vulnerabilities and address them before they are exploited by adversaries. A commonly held belief among ethical hackers is that hackers must possess exceptional curiosity and problem solving skills in order to be successful. Curiosity is has been studied extensively in psychology, but there is no consensus on what it is and how to measure it. Further, many existing inventories for assessing curiosity are targeted at measuring curiosity in children. Although there isn’t an accepted standard to assess curiosity in adults, a related construct, called Need for Cognition (may capture what is meant when people speak of curiosity. The Need for Cognition scale also captures the tendency toward preferring complex problems (which correlates with good problem solving skills), which may provide insight into what make skilled hackers. In addition to the Need for Cognition, we used a structured interview to assess hacker skill. Hackers rated their own skill on a scale from one to ten on a predefined list of hacker skills. They were then asked to rate a peer who they felt was most skilled in each of the skills. They were asked to rate two peers for each skill, one that they worked with directly and one person that was the most skilled in the field (these could be known by reputation only). The hypothesis is that hackers have a higher than average (i.e., compared to non-hackers) Need for cognition and that Need for Cognition will be positively correlated with self-reported and peer reported skill. We interviewed 20 cyber security researchers who specialize in offensive approaches. Based on the responses to the hacker skill inventory, we generated a self-reported skill score for each participant. We also developed a peer-rating for each participant based on the number of times each individual that was interviewed was named as the most skilled in a particular area. The results indicate that the sample of ethical hackers has a high Need for Cognition and that Need for cognition was related to both self-reported skill and peer-reported skill. The results are discussed in the context of training and recruitment of cyber security professionals.},
doi = {10.1007/978-3-319-41932-9_18},
journal = {Part of the Advances in Intelligent Systems and Computing},
number = ,
volume = 501,
place = {United States},
year = 2016,
month = 7
}

Conference:
Other availability
Please see Document Availability for additional information on obtaining the full-text document. Library patrons may search WorldCat to identify libraries that hold this conference proceeding.

Save / Share:
  • Considerable research effort has recently been directed at improving and operationalising ensemble seasonal streamflow forecasts. Whilst this creates new opportunities for improving the performance of water resources systems, there may also be associated risks. Here, we explore these potential risks by examining the sensitivity of forecast value (improvement in system performance brought about by adopting forecasts) to changes in the forecast skill for a range of hypothetical reservoir designs with contrasting operating objectives. Forecast-informed operations are simulated using rolling horizon, adaptive control and then benchmarked against optimised control rules to assess performance improvements. Results show that there exists a strongmore » relationship between forecast skill and value for systems operated to maintain a target water level. But this relationship breaks down when the reservoir is operated to satisfy a target demand for water; good forecast accuracy does not necessarily translate into performance improvement. We show that the primary cause of this behaviour is the buffering role played by storage in water supply reservoirs, which renders the forecast superfluous for long periods of the operation. System performance depends primarily on forecast accuracy when critical decisions are made – namely during severe drought. As it is not possible to know in advance if a forecast will perform well at such moments, we advocate measuring the consistency of forecast performance, through bootstrap resampling, to indicate potential usefulness in storage operations. Our results highlight the need for sensitivity assessment in value-of-forecast studies involving reservoirs with supply objectives.« less
  • The history and reasons for launching the Human Genome project and the current uses of genetic human material; Identifying and discussing the major issues stemming directly from genetic research and therapy-including genetic discrimination, medical/ person privacy, allocation of government resources and individual finances, and the effect on the way in which we perceive the value of human life; Discussing the sometimes hidden ethical, social and legislative implications of genetic research and therapy such as informed consent, screening and preservation of genetic materials, efficacy of medical procedures, the role of the government, and equal access to medical coverage.
  • The objective of the study was to increase the understanding of the relationship among land use, transportation accessibility and energy consumption in an urban context. The issues addressed include: (1) How transportation accessibility and land use planning interact for increased energy conservation; (2) The role the public sector plays with regard to incorporating and integrating transportation, land use and energy conservation; and (3) The institutional and/or technical barriers for better integration of energy, transportation and land use considerations. The study combines an extensive literature survey in the subject areas with field case studies in five urban areas: Washington, DC; Baltimore,more » MD; Toronto, Canada; San Francisco, CA.; Miami, FL.« less
  • This short summary of the main transformations to the La Hague reprocessing plant since initial commissioning in 1967 amply illustrates the extent to which plant flexibility was needed during the last 10 years, to cater to the multiple changes in the characteriestics of spent fuel delivered for reprocessing. Although the number and scale of modifications during this period were undoubtedly somewhat exceptional, they do clearly demonstrate one of the problems of operating a reprocessing plant; namely, the necessity of resolving unforseeable difficulties arising from technological progress further upflow in the fuel cycle. This necessary flexibility in fuel reprocessing plants does,more » however, have one important benefit, in that problems of outdated and aging equipment are greatly reduced or even eliminated, because equipment must almost always be replaced before it becomes obsolete. Whether such long-term flexibility will be required for future reprocessing plants is somewhat of an open question. Hopefully, the answer is no; better standardization of reactors and fuel will permit more regular and continuous operations of these future plants. In this respect, France's policy is encouraging; since the beginning of its light-water reactor program in 1974, EdF, the power utility, has ordered just two types of standard-design reactors (900-MW(e) and 1300-MW(e) PWRs). On the other hand, consideration is being given to significantly increasing LWR fuel burnup, and what of FBR fuel. In the face of these new uncertainties, it is best to assume that some degree of flexible adaptability will continue to be demanded of the last link in the fuel cycle, the spent-fuel reprocessing plants.« less
  • The entrapment of nonwetting phase fluids in unconsolidated porous media systems is strongly dependent on the pore-scale geometry and topology. Synchrotron X-ray tomography allows us to nondestructively obtain high-resolution (on the order of 1-10 micron), three-dimensional images of multiphase porous media systems. Over the past year, a number of multiphase porous media systems have been imaged using the synchrotron X-ray tomography station at the GeoSoilEnviroCARS beamline at the Advanced Photon Source. For each of these systems, we are able to: (1) obtain the physically-representative network structure of the void space including the pore body and throat distribution, coordination number, andmore » aspect ratio; (2) characterize the individual nonwetting phase blobs/ganglia (e.g., volume, sphericity, orientation, surface area); and (3) correlate the porous media and fluid properties. The images, data, and network structure obtained from these experiments provide us with a better understanding of the processes and phenomena associated with the entrapment of nonwetting phase fluids. Results from these experiments will also be extremely useful for researchers interested in interphase mass transfer and those utilizing network models to study the flow of multiphase fluids in porous media systems.« less