Diana Initiative 2021-Duane Dunston-Mentoring and Training Experts: A cognitive science approach

## Overview Dwayne Dunston, an associate professor of cyber security at Champlain College with 24+ years of industry experience, presents a cognitive science approach to mentoring and training cybersecurity experts. This talk is a follow-up to his previous Diana Initiative presentation, addressing concerns about scalability raised by an audience member.

## Key Concepts Dunston distinguishes between novices (those new to a domain who rely on critical thinking, problem-solving, and mimicking) and experts (those with domain-specific knowledge). He introduces the Expert Reversal Effect from cognitive load theory: methods effective for training novices can actually be detrimental to experts because they may undo long-term schemas already built up, especially in graded educational settings.

## Training Experts Through Deliberate Practice Unlike novices who need structured instruction, experts need coaching and advice rather than feedback. Dunston defines deliberate practice as repetitive, willful attempts to improve performance—distinguishing it from general practice. He emphasizes that quality of experience matters far more than hours spent; 24 years of experience provides less expertise development than focused deliberate practice on specific weaknesses.

Key principles for expert development include: - **Dynamic Practice**: Mentors must know their mentees well enough to adjust difficulty levels, progressively pushing them to apply skills in new contexts - **Mentor-Mentee Relationship**: Regular check-ins and communication enable correction of mistakes and refinement of weak skills - **Cognitive Apprenticeship**: The mentor makes thinking visible, provides feedback, allows reflection, and observes the mentee's work

## Practical Methods Dunston illustrates his approach through his own experience learning Mitre ATT&CK Cyber Threat Intelligence. Rather than self-study, he engaged a mentor who provided threat intelligence reports for him to map against the framework, met regularly for guided feedback and advice, and progressively tackled harder scenarios across different domains (universities, industrial control systems).

For training providers, he recommends: - **Case Studies**: Recreate real industry incidents from fire eye or Mandiant reports and have students solve them before reviewing the expert solution - **Community-Driven Hard Problems**: Establish databases of hard problems across threat hunting, incident response, threat intelligence, and reverse engineering. Example: Honeynet Project's approach of posting attack PCAPs for community analysis and expert review - **Worked Examples**: Show step-by-step how to perform tasks rather than directing learners to "google it"

## Takeaways Mentoring experts requires understanding individual needs and capabilities. While some aspects of novice training apply to experts (particularly worked examples), the emphasis shifts to coaching, deliberate practice on specific weak areas, and progressive difficulty increases. A community database of hard problems could enable experts to pursue deliberate practice in their specific skill gaps, addressing the scalability concern from the previous year's talk.