Keywords

1 Introduction

Rapid technological developments and definition of the cyber domain as a battlefield has challenged the cognitive attributes of its operators. In order to meet these demands, higher education programs, such as computer science, biology, and physics, are based on scientific approaches that define the science, technology, engineering, and mathematics (STEM) educations. STEM education is hypothesized to better prepare students for future work due to its inclusion of the more technical aspects that are more suited for technological advances [1]. Computer science has been included in the STEM educational umbrella due to its inclusion of scientific approaches in mathematics, engineering and maths and cyber security is a specialization within computer science that focuses on defense and protections of networks and systems. Demands for cyber security workforce is increasing and expected to rise globally to 6 million but is still 1.5 million short [2]. In 2015 the Joint Task Force on Cybersecurity Education (JTF) that was comprised of the Association for Computing Machinery (ACM), IEEE Computer Society (IEEE CS), Association for Information Systems Special Interest Group on Security (AIS SIGSEC), and International Federation for Information Processing Technical Committee on Information Security Education (IFIP WG 11.8), developed educational guidelines for cybersecurity education [3]. Mostly based on technical aspects, the aspect of human factors is mentioned in the requirements but is not expanded to include which human factor aspects need to be included.

There are recruitment differences in higher education within science, technology, engineering and mathematics (STEM). Females in universities make up only 22% of such studies, but that number drops to 12% for career choices within STEM domains of the workforce being female [4]. Within cyber security, prevalence of female professionals has risen from 11% (2013) to 20% (2019) but there is still a disparity and need for higher numbers of females. This disparity may arise from educational factors.

While recruitment to STEM studies focuses on increasing the amount of females in these studies, factors involving retention also needs to be understood. Cohoon [5] identified several factors that characterized departments that were able to retain female STEM students: (a) faculty staff included at least one female mentor and the staff shared responsibility in teaching, (b) the department had institutional support, (c) accessible job market, and (d) sufficient number of females in the study.

Females joining STEM programs may be influenced by situational factors that are not gender specific, that increase risk of drop-out. Cheryan et al. [6] showed that role models (both female and male) who project stereotypical behaviours in STEM programs may increase dissatisfaction of the program or aversion to commence studies. But with the increase of need for cyber security professionals, educational programs need to re-evaluate their approaches and retain students to fill the demands.

1.1 Understanding Cyber Security Operators Profiles

Little is known about the cognitive demands on and the profiles of cyber defence officers. Research in the area of cyber operations is scarce, and also has not reflected gender differences. Psychological determinants (i.e. decision-making, problem-solving) to understand human factors in cyber defence operations needs to be investigated to assess performance in cyber operators, especially with female officer cadets entering the domain. Female cadets may have certain psychological profiles that may be risk factors for dropping out. They also need to be examined for profiles of better performance. Lugo and Sütterlin [7] showed that cyber defence officer profiles differed from normal controls. Their emotional regulation strategies (rumination, worry) did not have the same patterns as their aged matched controls. They also found that cyber defence officers had different cognitive styles (field independent; FID) than matched controls (field dependent; FD) [8]. Knox et al. [9] and Josøk et al. [10] showed that metacognition predicted better performance in cyber domains. Cyber defence officers who also reported being more introverted were rated with higher confidence and better leadership, contrary to previous findings [11].

Psychological factors have been found to influence performance in cyber defence operations [7] but these findings did not include females. These factors may be relevant also in future selection processes. Selection processes can be time consuming, but are essential in recruiting the proper personnel for specific jobs [12]. Cognitive abilities have been found to be a strong predictor for selection and job performance.

1.2 Cognitive Factors

Perceived self-efficacy is defined as the ‘beliefs in one’s capabilities to organize and execute the courses of action required to produce given attainments’ [13, p. 3] and is divided into a specific and a global component. General self-efficacy relates to the overall belief that one is in control over one’s own life, actions, and decisions that shape one’s life, while specific self-efficacy is the belief into one’s performance in a certain task or described situation. Self-efficacy is also contingent on outcome expectancies, since one has to consider the desired outcome and judge if one possesses the skills necessary to reach those outcomes [13,14,15]. Self-efficacy can be strong and weak all within one person, as being confident in one’s skills in one area of functioning does not automatically generalize to other areas. Self-efficacy is realized through four separate efficacy-activated processes [13]: (1) Cognitive processes, including goal setting, self-appraisals, anticipatory scenarios, and analytic thinking; (2) Motivational processes, which include causal attributions, self-regulatory processes, outcome expectancies, and cognized goal/reinforcements; (3) Affective processes, affected by anxiety arousal, vigilance, rumination, and situations; and (4) Selection processes, by choosing of environments. These processes work in conjunction with each other, are dynamic and can be influenced in different ways. Bandura [13] identified four influencing factors for perceived self-efficacy. The first source and most prominent affecting self-efficacy is that of mastery experience. Overcoming any demanding situation in a beneficial way increases the perception of self-efficacy, thus strengthening confidence and self-evaluations, while the opposite happens when failing.

Having an understanding of how cognitions affect behaviour requires individuals to reflect over relevant experiences and their outcomes. Reflecting can be done alone or with others (mentoring, feedback), but is an important process in consolidating experiences to long-term memory [16]. Being able to monitor and control encoding processes that arise from both negative and positive outcome but meaningful experiences leads to better long-term retention [17]. The importance of developing such metacognitive skills is essential in functioning properly within the Hybrid-Space domain [18]. Encoding experiences to long-term memory integrates both cognitive and emotional processes and strategies used. Metacognition is defined as ‘awareness of one’s own knowledge—what one does and does not know—and one’s ability to understand, control, and manipulate one’s cognitive processes’ [19] and includes three components: knowledge of one’s abilities, situational awareness, and behavioural regulation strategies [20]. It involves the active process of being aware of and exerting control over one’s thinking to achieve present goals through planning, monitoring, and evaluating one’s cognitions, emotions and behaviours, and actively adapting to the situational demands. Examples of metacognitive knowledge skills include world, technical, and experiential knowledge, and personal knowledge and awareness of one’s own skills (e.g. self-efficacy), beliefs (confidence), and expected outcomes (situational knowledge). This involves the awareness of emotional and behavioural factors, and how they can be controlled and adjusted so that they can be incorporated into adaptive situational decision-making and problem solving strategies [21].

Gender differences in self-efficacy depend on the educational field [22]. Females display higher language arts self-efficacy, while males exhibited higher mathematics, computer, and social sciences self-efficacy, but these results also moderated by age, where larger effect size occurred for older respondents. But for mathematics self-efficacy, significant gender differences emerged in late adolescence. Even though these findings are significant, effect sizes were small.

1.3 Norwegian Perspective

Norway scores in the top of worldwide surveys on gender equality [23] where education, health, income, and political empowerment are measured. But Norway, and other Scandinavian countries scoring in the top of equality studies, also have a disparity and an over representation of gender inequality in traditional careers that are stereotypical, such as nursing and engineering, where females make up 89% and 17% respectively [24]. Within engineering, females make up 20% of the students, while more technological studies have a representation of 32,5%.

This research focused on assessing the educational setting of the Norwegian Defence Cyber Academy (NDCA) and its factors in promoting female student retention in their computer engineering program, and profiling female officer cadets to see if any differences in personality, cognitions, and behaviour strategies exist between male and female cadets.

2 Methods

Participants (N = 35) were recruited from the NDCA (n = 18; nfemale = 8) and were controlled with age and gender matched non-technical students from Inland Norway University of Applied Sciences, Norway (n = 17; nfemale = 7, as well as male (n = 9) cyber defence cadets from the NDCA. Psychological factors tested included cognitive styles, personality, emotion regulation strategies, self-efficacy, and metacognition.

2.1 Cultural Factors

Qualitative approaches were used to identify institutional factors that lead to female retention in accordance to Cohoon [5] and Cheryan [6] identified factors: (a) staff composition and behaviours, (b) institutional support, (c) accessible job market, and (d) sufficient number of females in the study. To answer a, & d, drop-out statistics, female-teacher ratio, and class composition was calculated. To answer b & c, a qualitative analysis of cultural factors relating to institutional support and need for cyber security professionals in Norway was investigated. These factors will be reported in the discussion.

2.2 Quantitative Measures

Quantitative measures were collected to identify cognitive aspects of female cyber operators and compared to males who are in the same educational route, and to other females from a non-technical but STEM education (psychological science).

Cognitive Styles.

Cognitive styles were measured with the Group Embedded Figures Test (GEFT) [25]. The GEFT was developed for research into cognitive functioning, but it has become a recognized tool for exploring analytical ability, social behaviour, body concept, preferred defence mechanism and problem solving style as well as other areas. Finding common geometric shapes in a larger design is the assessment method. The results yield two cognitive styles: field dependence (FD) and field independence (FI). The GEFT is a twenty-five item assessment and scored manually. Persons with FI are considered to be detailed and analytical in their perception. They are characterized by a tendency to be able to space-orientate independently of their surroundings, and capabilities in cognitive and perceptual restructuring are considered to be the strength of FI individuals. FD individuals are described as using more “global” or overall focused perception and a lesser interest in details. They are characterized by a propensity to orient themselves in space based on their surroundings. Interpersonal abilities and emotional sensitivity are considered to characterize FD individuals [26, p. 17]. Reported reliability coefficients on GEFT test retests all fall between .78 and .92 [26].

Emotion Regulation.

Emotion regulation was measured using three scales, The Rumination Styles Questionnaire, the Penn State Worry Questionnaire, and Cognitive Emotion Regulation Questionnaire.

Rumination was measured with the Response Style Questionnaire (RSQ) [27] and consists of 10 items with two subscales, brooding (five items) and reflective rumination or pondering (five items). Items are on a 4-point Likert scale from 1 – “almost never” – to 4 – “almost always”. Example items for the brooding subscale include: “Why can’t I handle things better” and for reflective pondering “Go away by yourself and think about why you feel this way”. The RSQ shows good internal reliability (Cronbach’s α = .89).

Worry was measured with the Penn State Worry Questionnaire (PSWQ) [28]. The scale is a 5-point Likert scale ranging from 1 – “Not at all typical of me” – to 5 – “Very typical of me”. The PSWQ shows good internal reliability (Cronbach’s α = 0.96).

Cognitive emotion regulation questionnaire short (CERQ-S) [29] is an 18 item 5 point Likert scale from 1 to 5 designed to evaluate nine cognitive strategies used to regulate emotions in response to negative or unpleasant events: blaming themselves, blaming others, accepting, refocusing on planning, positive refocusing, rumination, positive reappraisal, put in perspective and disaster thinking. Only the blaming themselves, blaming others, accepting, scales were used for analysis since the RSQ and PSWQ were used due to stronger links to performance. The CERQ subscales focusing on blame and acceptance were relevant for this study. Reliability analysis of internal consistency gave good Cronbach’s α for the translated scale (α = .682 − .884) except for the refocusing scale (α = .419) which was not used in the analyses.

Metacognition.

To measure metacognition, two measurements were used, The Metacognitive Awareness Inventory and the Self-regulation Questionnaire.

The Metacognitive Awareness Inventory (MCAI) [30] was used. It is a self-report scale comprising of 52 items that includes several subscales assessing knowledge of cognition (declarative knowledge, procedural knowledge, conditional knowledge) and regulation of knowledge (planning, information management strategies, monitoring, debugging strategies and evaluation). Items are assessed on bipolar responses (true/false) and then ratios are computed from the subscales. Sample items include: “I find myself using helpful learning strategies automatically” (procedural knowledge) and, “I ask myself if I have considered all options when solving a problem” (comprehension monitoring). The test shows high reliability on all subscales (Cronbach’s α = .90).

The Self-Regulation Questionnaire (SRQ-63) [31] is a 5-point Likert self-report scale, ranging from strongly disagrees to strongly agree. The scale has 7 subscales that consist of receiving, evaluating, triggering, searching, formulating, implementing, and assessing. Sample items include; “I usually keep track of my progress toward my goals” and, “I have sought out advice or information about changing”. The test shows high reliability (test-retest: r = .94, p < .0001; α = .91).

Trait self-efficacy was measured with the General Self-Efficacy Scale (GSES) [32]. The scale is composed of 10 Likert-scale items with scores ranging from 1 to 4, with higher scores indicating higher trait self-efficacy. The scale has shown validity in several domains and across cultures [33] and has acceptable internal validity (α = .75–.91).

Positive affect and negative affect was measured using the Positive Affect and Negative Affect Scale (PANAS) [34]. This consists of 20 words related to positive affect (PA; 10 items) and negative affect (NA; 10 items). PANAS is a summative questionnaire with answers ranging from 1 – “not at all” – to 5 – “a lot”. Positive affect items include “interested” and “excited”, and negative affect items include “distressed” and “upset”. Participants are asked to respond according to their usual levels of affect. Cronbach’s α ranges from 0.86 to 0.90 for PA and from 0.84 to 0.87 for NA. This scale is highly correlated with depression checklists.

3 Results

3.1 Quantitative Factors

Female cyber defence officers were different on several psychological factors than non-technical control females. They showed higher degrees of maladaptive emotion regulation strategies (brooding; t = 1.93, p = .040 (1-tailed), Cohen’s d = 1.01), less assertiveness (t = −2.36, p = .038, Cohen’s d = −1.38), and self-efficacy (t = 2.635, p = .023, Cohen’s d = 1.44), but had better metacognitive regulation strategies (comprehension management; t = 2.18, p = .026 (1-tailed), Cohen’s d = 1.24).

Compared to male cyber defence officer cadets, females reported less positive affect (t = 2.18, p = .044, Cohen’s d = 0.58), more anxiety (t = 2.69, p = .016, Cohen’s d = 1.28), less self-efficacy (t = 2.71, p = .015, Cohen’s d = 1.25) and more maladaptive emotion regulation strategies (self-blame: t = 2.10, p = .032 (1-tailed), Cohen’s d = .96; reappraisal: t = 2.02, p = .032 (1-tailed), Cohen’s d = 0.93). Females cadets also reported lower metacognition (planning: t = 2.246, p = .039, Cohen’s d = 1.04).

4 Discussion

This study focused on assessing the factors in promoting female student retention in their computer-engineering program, and profiling female officer cadets and the educational setting of Norwegian Defence Cyber Academy.

Results show that female cyber defence officer cadets score as other related fields (engineering) and their male counterparts in cognitive styles (field independence/dependence). The female cyber officer cadets did have some findings that could put them at risk of dropping out of schooling. They reported higher anxiety and maladaptive emotion regulation strategies than both fellow male cyber students as well as when compared to age and gender matched controls. They also reported significantly less self-efficacy than all other groups. Anxiety, low self-efficacy, and maladaptive emotion regulation styles are all risk factors in academic under-performance (see Ackerman et al., 2013 and Riegle-Crumb & King, 2010 for a review). But these factors do not seem to contribute to drop-outs, and this may be due to qualitative factors of the institution.

4.1 Cultural Factors

Some aspects of the NDCA reflects the Norwegian culture in supporting female participation in this educational field, but otherwise follow international trends of underrepresentation of females within the field. The Commandant of the institute is female and the students have access to female professors in STEM subjects. But of the 20 full time teachers at the institution, only 3 are females. The NDCA has a total of 40 students per year and since 2013 females have almost made up 20% of the cohorts but have ranged from 10% to 30% (see Table 1).

Table 1. Percentage of females at NDCA
Full size table

However, the number of actual female dropouts at NDCA is very low. During the last 6 years, 16% of the students have been females. 8 of them, representing 21% of the total amount of females attending the NDCA in this time period, participated in this study. During this time period, there has been a 2.5% total dropout rate; 2.7% for females and 2.5% for males. The drop-out rate does not include two females that left within the first school week having been offered places at civilian engineer universities. In cases where female officer cadets decided to leave the school, poor academic performance was not the motivation.

There are several contributing factors that may explain such low female drop-out rates during the three-year bachelor degree course at the NDCA. During the first two school years, the cadets have a dedicated mentor who provides academic guidance including techniques for studying and time management. Throughout the entire three years, their closest military leader mentors the cyber officer cadets to ensure their attitude and behaviour is in accordance with expected standards. In addition, students receive mentoring and guidance from the staff during and after their attendance to military exercises. Throughout their time at the academy students attend a total of four major exercises. Class sizes at the NDCA are small due to the maximum intake each year of 40 cadets. This gives teachers the possibility to know their students and to tailor guidance to each individual needs. Attendance to all classes is also obligatory.

One additional factor is peer-support. The cohort becomes a tight-knit group over the three years. A fall-out form this is the sharing of the academic burden. Meaning individual and team workload demands can be more easily overcome. Interestingly, in 2017 a female cadet won the prize for best in military skills, and was second in the academic rankings. Then in 2018, a female cadet was awarded the first prize in academic and in military studies. This can inform that the environment is a healthy and competitive, and that females are capable of performing across domains. These two high performing females may also help motivate future female cadets to not be hindered by negative psychological factors.

The qualitative aspects of the NDCA support the model presented by Cohoon [5] and Cheryan [6]. Faculty at the NDCA has at least one female mentor and the staff shared responsibility in teaching, including the school Commandant being female. Combined with the cultural aspect that Norway is one of the most gender balanced societies in the world, institutional support is engrained in all aspects. Norway’s minister of defence from 2013 to 2017 was also female and was the first woman to hold this position. The role models the female cadets are exposed too, both nationally and locally at the institution also have cultural aspects that represent equality and support. Access to job markets in Norway also follow gender equality.

The quantitative findings show that female cyber officer cadets have some risk factors that could lead to dropping out of school that reflect previous finings. Anxiety, low self-efficacy, and maladaptive emotion regulation styles are all risk factors in academic under-performance (see Ackerman et al., 2013 and Riegle-Crumb & King, 2010 for a review) and females at the NCDA displayed lower levels on similar factors, making them vulnerable to dropping out. However these results need to be seen in conjunction with the institutional factors that prevent such drop-outs occurring.

5 Conclusion

The NDCA provides novel insights on female performance in computer science domains, even when gender participation is similar to other nations. The qualitative differences of the NDCA provide support to research focusing on retention of females in computer science education. Even though female officer cadets showed worrisome scores on psychological predictors of academic outcomes, they were no different on other cognitive measurements than their male counterparts. Cyber engineering is considered a STEM degree, but due to the novelty of the domain, little is known about female operators functioning within it. Future research needs to identify how factors used in previous studies might affect female performance in cyber education and the when operating in the domain.