映射网络安全领域组织劳动力知识概况的框架
A Framework for Mapping Organisational Workforce Knowledge Profile in Cyber Security
AI总结：
本文提出了一个利用CyBOK构建组织网络安全知识概况的框架，用于识别知识覆盖范围与差距，支持组织进行针对性招聘、培训或第三方外包评估，并通过三个案例研究和从业者研讨会验证完善了该框架。
摘要：
网络安全组织需要确保其劳动力具备必要的知识以履行其网络安全业务职能。同样，当组织选择将其网络安全任务委托给第三方提供商时，必须确保所选实体具备稳健的知识能力以有效执行分配的任务。构建全面的网络安全知识概况是一项独特的挑战；该领域随着各种专业认证、学术资格和在职培训而不断发展。到目前为止，一直缺乏一种明确定义的方法，来系统地根据标准化参考点评估组织的网络安全知识，特别是源自其劳动力的知识。以往跨学科知识概况的研究主要采用了诸如SWEBOK等成熟框架。然而，在网络安全领域，标准化参考点的缺失十分明显。在本文中，我们提出了一个利用CyBOK的框架，以构建组织的知识概况。该框架使用户能够识别覆盖领域以及可能存在的差距，以便组织可以考虑有针对性的招聘或培训，或者在可以外包此类专业知识的情况下，从第三方引入知识能力。在后一种情况下，该框架也可用作评估此类第三方知识能力的基础。我们提出了知识概况框架，讨论了支持其初始开发的组织团队中的三个案例研究，随后通过与网络安全从业者的研讨会对其进行了完善。
英文摘要：
A cyber security organisation needs to ensure that its workforce possesses the necessary knowledge to fulfil its cyber security business functions. Similarly, where an organisation chooses to delegate their cyber security tasks to a third party provider, they must ensure that the chosen entity possesses robust knowledge capabilities to effectively carry out the assigned tasks. Building a comprehensive cyber security knowledge profile is a distinct challenge; the field is ever evolving with a range of professional certifications, academic qualifications and on-the-job training. So far, there has been a lack of a well-defined methodology for systematically evaluating an organisation's cyber security knowledge, specifically derived from its workforce, against a standardised reference point. Prior research on knowledge profiling across various disciplines has predominantly utilised established frameworks such as SWEBOK. However, within the domain of cyber security, the absence of a standardised reference point is notable. In this paper, we advance a framework leveraging CyBOK, to construct an organisation's knowledge profile. The framework enables a user to identify areas of coverage and where gaps may lie, so that an organisation can consider targeted recruitment or training or, where such expertise may be outsourced, drawing in knowledge capability from third parties. In the latter case, the framework can also be used as a basis for assessing the knowledge capability of such a third party. We present the knowledge profiling framework, discussing three case studies in organisational teams underpinning its initial development, followed by its refinement through workshops with cyber security practitioners.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
