Identifying Dimensions of Cyber Aptitude

Abstract

Cybersecurity is a broad and growing job field, encompassing many different job categories with different cognitive demands. Traditional, knowledge-based assessments may exclude candidates who are cognitively suited to performing cybersecurity work but who have not had the opportunity to learn the subject matter. Using the job categories included in the National Initiative for Cybersecurity Education (NICE) framework for the cybersecurity workforce, we propose a model for predicting cybersecurity aptitude beyond a general- intelligence approach. In addition to including general intelligence, the model is based on a classification of jobs as requiring real-time or deliberate performance, and proactive or reactive actions. We suggest that tasks, work roles, and people can be represented along the same set of axes to match job requirements to person attributes. These constructs can then be used to create assessments of potential for cybersecurity applicants, including one we propose, called the Cyber Aptitude and Talent Assessment (CATA).