The Security Expertise Assessment Measure (SEAM): Developing a scale for hacker expertise. Issue 60 (July 2016)

• Record Type: Journal Article
• Authors: Giboney, Justin Scott; Proudfoot, Jeffrey Gainer; Goel, Sanjay; Valacich, Joseph S.
• Is Part Of: Computers & security. Issue 60(2016)
• Page Start: 37
• Page End: 51
• Publication Date: 2016-07
• Subjects: Hacker ability -- Conceptual expertise -- Skill measurement -- Security knowledge -- Hacking techniques; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2016.04.001
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Hackers pose a continuous and unrelenting threat. Industry and academic researchers alike can benefit from a greater understanding of how hackers engage in criminal behavior. A limiting factor of hacker research is the inability to verify that self-proclaimed hackers participating in research actually possess their purported knowledge and skills. This paper develops and validates a conceptual-expertise-based tool that we call SEAM that can be used to discriminate between novice and expert hackers. This tool has the potential to provide information systems researchers with the following two key capabilities: (1) maximizing the generalizability of hacking research by verifying the legitimacy of hackers involved in data collections, and (2) segmenting samples of hackers into different groups based on skill thereby allowing more granular analyses and insights. This paper reports on samples from four different groups: security experts, students, security workers, and Amazon Mechanical Turk hackers. SEAM was able to differentiate between security expertise in different populations (e.g., experts and student novices). We also provide norm development by measuring security workers and Amazon Mechanical Turk hackers.