Would cybersecurity professionalization help address the cybersecurity crisis?

Abstract

Evaluating the trade-offs involved in cybersecurity professionalization.

All That Glitters Is Not Gold: On the Effectiveness of Cybersecurity Qualifications

“…However, this has to be undertaken at the right pace and not necessarily at the same time for all occupations [2], and existing standard and certification bodies should be rationalised into a single professional body per discrete occupation [14].…”

“…Research strands that seek to address this topic have focused on industry professionalisation [2], competency requirements [3], [4], and the design of training programmes [5], [6], with a particular emphasis on the role of competitive events, such as Capture The Flag (CTF) competitions [7], [8], [9], [10]. One core area that has remained unaddressed, however, is a focus on the approaches to assess competency within cyber security qualifications.…”

The professionalisation of information security: Perspectives of UK practitioners

“…Whilst we saw above that this reticence is common, it has arguably hindered professional recognition since there is no clear single certification to recognise as a standard (Furnell, 2004;Tate et al, 2008;Schultz, 2005). Without a common body of knowledge, there cannot be a unified professional identity (Everett, 2011;Burley et al, 2014). And yet professional identity is clearly the aim of many such schemes, which often require both an examination and a qualifying period of experience.…”

“…In the US, the Department of Homeland Security [DoHS] (2012) is also active in developing "cyber skills" however the National Research Council [NRC] (2013) appears more cautious than the UK Government towards formal professionalisation. Alongside noting the effects of artificially manipulating labour markets, it cites the lack of a single body of knowledge to define such a profession (Burley et al, 2014). Yet references are already commonly made to information security "professionals" and a number of credentials exist to certify this professional status.…”

“…The study examines their basic concept of "profession", alongside their attitude to professional status as a motivator and the value of certification. In addition, it investigates practitioner perspectives towards the heterogeneity of professional identity noted by Burley et al (2014) and others, examining whether those who implement technical controls and those who manage, educate, instil a security culture and issue policies represent a single occupation.…”