The Cyber Domains: Understanding Expertise for Network Security

Abstract

In this chapter, the historical and continuing evolution of the cyber domains, and how current research in cyber expertise can be operationalized, are described. Research into cyber expertise is in its infancy; in fact, there is no clear definition of what constitutes cyber expertise or how it may be unique when compared to other technical fields. The work roles of cyber operators are described and results from cognitive task analyses of their workplace are reviewed. The chapter then reviews several paradigms in detail including experiments using simulated intrusion detection software to study different levels of expertise and how information is shared between multiple teammates in these environments. Finally, some candidate topics for future research are presented, including the use of realistic synthetic environments to study cyber operations with more ecological validity.