The Work of Cybersecurity Advocates

Abstract

Cyber attacks are on the rise, with potentially devastating effects at the personal, business, and national levels. Despite real and evolving cyber threats, people often fail to implement and effectively use basic, well-known cybersecurity technologies and practices. Further contributing to the cybersecurity problem is the shortage of security personnel to address these challenges.A critical role and force-multiplier in security adoption is the cybersecurity advocate: a security professional who has the skills to effectively promote security and facilitate positive security behavior change. Cybersecurity advocates attempt to remedy implementation failures by promoting and facilitating the adoption of security best practices and technologies as an integral component of their jobs.Currently, there is no clear career track and few resources for educating professionals on how to be good cybersecurity advocates. Furthermore, it is unclear as to what advocacy techniques may be most effective. In addition to the bias towards technical skills, these gaps are likely due to the fact that we have little understanding of the work practices and competencies that lead to successful security advocacy.

Privacy Champions in Software Teams: Understanding Their Motivations, Strategies, and Challenges

“…the new idea either fnds a champion or dies" [59, p. 8]. Prior research acknowledges the role of champions in software teams for promoting the use of software technologies such as Java generics [52,53], usability [46], and security practices [31][32][33].…”

“…They can be an experienced hacker who helps testers in fnding vulnerabilities [74], an intermediary between the security and development teams [25,70], or the leader in threat modelling activities [10,63]. They are involved in several security-related activities such as educating other developers [31,33,34,38,73], increasing awareness [19,33,34], and promoting the adoption of technologies [31,32,34].…”

Want to Raise Cybersecurity Awareness? Start with Future IT Professionals.

“…Our results further showed that students are willing to disseminate the course among fellow students, family members, friends, and colleagues. Subsequently, students could act as "cybersecurity advocates: individuals who encourage positive change by promoting and providing guidance on security best practices and technologies" [9]. As such, they are indispensable for increasing security in different ecosystems, even outside the university.…”

Towards Security-Focused Developer Personas

“…A number of past studies [20,29,30,64,65] have investigated the idea of categorizing software developers into distinct groups, based on a range or set of characteristics.…”

“…Haney et al [65] explore the skills and characteristics of successful cybersecurity advocates, and identify eight skills or characteristics that separate successful cybersecurity advocates from those less so [65]. These skills and characteristics included (a) diverse backgrounds and roles whereby different perspectives are introduced into their cybersecurity processes; (b) technical skills, and specifically cybersecurity skills; (c) soft skills, which include a combination of communication skills that allows them to "sell security" to those around them, positive personal and career attributes and people skills, namely the ability to get along with others; (d) context awareness, referring to good understanding of any security context in order to elicit the best outcomes; and (e) service orientation, which the authors describe as a desire to positively contribute to the security needs of those around them [65]. These findings are encouraging as they can potentially formulate persona dimensions; however, this study is focused on defining cybersecurity advocates, and the findings may therefore not extend to all software developers.…”