The cultivation and selection of talents are indispensable for a"ruler"to measure them.Taking the CVSS as an example,an evaluation model with high operability can not just be an abstract model of thinking.Furthermore,there are six essential elements:criterion,weight,a method to map the criterion with a corresponding numerical value,computational formula,score,and rating.Prior models lack those elements to varying degrees.Therefore,in the form of multiple rounds of questionnaire surveys,this paper uses several qualitative and quantitative evaluation methods to establish a comprehensive evaluation model with the above six essential elements for the competency assessment of pentesting cybersecurity talents,named CEMoPT.First,we summarized the criterion structure and definition by combining literature review with the Delphi method.Then,we applied the analytic hierarchy process,the entropy weight method,and the combination weighting method to obtain the weight of the criteria.Next,we designed a method of labeling tasks based on the membership matrix to map the criterion with a corresponding numerical value.Finally,the score and rating were calculated by taking advantage of the computational formula in the fuzzy comprehensive evaluation method.We designed an online questionnaire,recruited 72 subject matter experts,conducted reviews on the six essential elements of the CEMoPT in turn,and strictly followed the constraints of stability measure and consensus measure,and experienced a maximum of 4 rounds of iterations.Specific to CEMoPT,the criteria make up of 5 basic metric groups and 18 criterion items.The weight is a combination weight,which is a compromise between the subject weight and the object weight.The membership matrix is the core of the mathematical formula.Based on the score,the rating is divided into 5 levels,i.e.,novice,apprentice,journeyman,expert,and master.The reliability of CEMoPT was verified by conducting a comparative experiment.To ensure the validity of CEMoPT,the research process strictly followed many constraints required by scientific methods.
维普
万方数据