6. The Skill of Cybersecurity: Adversarial Thinking 129 ily emphasized in cyber curriculums through classes like operating systems, computer networks, and programming courses. The unconventional perspectives component is typically taught by example—in fact, it is probably more likely to be caught than taught. Students learn about creative attack vectors such as SQL injection, network packet manipulation, and cross-site scripting. The practical component of adversarial thinking is addressed through threat modeling exercises, but little emphasis has been placed on helping to improve students’ ability to think strategically. This is a blind spot because strategic thinking is well-understood and can be taught and acquired relatively easily. Table 6.4 Adversarial thinking learning outcomes. This book addresses the technological capabilities aspect of adversarial thinking in several chapters, and it touches on the unconventional perspectives aspect in places. The remainder of this chapter, however, focuses exclusively on strategic reasoning. The goal is to help develop the reader’s ability to anticipate the strategic actions of hackers by teaching basic game theory concepts. Learning game theory is a proven way to improve one’s strategic reasoning abilities. 6.2 Game Theory “Strategic thinking seems to be more like learning to windsurf, ski, or fly an airplane, activities that require people to learn skills which are unnatural but teachable, and less like weight-lifting or dunking a basketball, where performance is constrained by physical limits.” - Colin Camerer There are games of skill, games of chance, and games of strategy. Game theory deals with games of strategy. Game theory is not primarily concerned with sports, board games, and video games, although these activities may involve strategy. Game theory was developed to analyze economic scenarios, and is still a staple of the discipline of economics today. It helps answer questions like: how many widgets should we produce next year and how much should we charge per widget? The answers to questions like these involve strategy
RkJQdWJsaXNoZXIy MTM4ODY=