An exploration of the current state of information assurance education

Abstract

Information Assurance and computer security are serious worldwide concerns of governments, industry, and academia. Computer security is one of the three new focal areas of the ACM/IEEE's Computer Science Curriculum update in 2008. This ACM/IEEE report describes, as the first of its three recent trends, "the emergence of security as a major area of concern." The importance of Information Assurance and Information Assurance education is not limited to the United States. Other nations, including the United Kingdom, Australia, New Zealand, Canada, and other members from NATO countries and the EU, have inquired as to how they may be able to establish Information Assurance education programs in their own country. The goal of this document is to explore the space of various existing Information Assurance educational standards and guidelines, and how they may serve as a basis for helping to define the field of Information Assurance. It was necessary for this working group to study what has been done for other areas of computing. For example, computer science (CS 2008 and associate-degree CS 2009), information technology (IT 2008), and software engineering (SE 2004), all have available curricular guidelines. In its exploration of existing government, industry, and academic Information Assurance guidelines and standards, as well as in its discovery of what guidance is being provided for other areas of computing, the working group has developed this paper as a foundation, or a starting point, for creating an appropriate set of guidelines for Information Assurance education. In researching the space of existing guidelines and standards, several challenges and opportunities to Information Assurance education were discovered. These are briefly described and discussed, and some next steps suggested.

All That Glitters Is Not Gold: On the Effectiveness of Cybersecurity Qualifications

“…The former can be used in cyber security for the evaluation of educational interventions [5], [10], while the latter mostly provides an understanding on how attackers compromise systems [11]. Academic accreditations and professional certifications are an important part of such competency frameworks [12], and several guidelines and educational standards were proposed to facilitate the process of defining the field of cyber security [13].…”

Framing the Attacker in Organized Cybercrime

“…Instead, existing data sources such as taxonomies, profiling and knowledge elicitation workshops about the targeted group of users can act as an alternative. Considering IT security from an attack versus defend viewpoint is a common way to study threats [16], [17], and can provide insightful information about the attackers such as how they carry out attacks, which weaknesses they target the most, the skill of the attacker in terms of the way an attack is carried out, etc. Such data concerning different categories of attackers can be acquired from IT security professionals using quantitative and/or qualitative means.…”

A Cyber Security Multi Agency Collaboration for Rapid Response that Uses AGILE Methods on an Education Infrastructure

“…As Steven Cooper et al well expressed the historical context of such efforts, [3] cybersecurity training and education evolved through a wealth of sectorspecific training that has matured over the last 40 years, including the CISOstyle training that matured into SANS; the information security education programs that perhaps started as early as Queensland Institute of Technology in Australia offered a Master's level research degree in computer security 1986. Cyber security forces capabilities in departments of defense around the world began to mature as evidenced by the expansion of the U.S. Air Force Mission to incl ude cyberspace in 2005.…”