Investigating the relationship between need for cognition and skill in ethical hackers

As technology gets more complex and increasingly connected, there is a continuing concern with cyber security. Partnered with this concern is continuing demand for cyber security defenders. Unfortunately, there is currently a dearth of skilled professionals to meet that demand. In order to prepare the next generation of cyber defenders, we need to understand what characteristics make skilled cyber security professionals. For this work, we focus on professionals who take an offensive approach to cyber security, so called ethical hackers. These hackers utilize many of the same skills that the adversaries that we defend against would use, but with the goal of identifying vulnerabilities so they can be mitigated before they are exploited by adversaries. We interviewed cyber security researchers who specialize in offensive approaches. Based on the responses to the hacker skill inventory, we generated a self-reported skill score for each participant. We also developed a peer-rating for each participant based on the number of times each individual that was interviewed was named as the most skilled in a particular area. The results are discussed in the context of training and recruitment of cyber security professionals.