Framework, Tools and Good Practices for Cybersecurity Curricula

Abstract

Cybersecurity education and training are essential prerequisites of achieving a secure and privacy-friendly digital environment. Both professionals and the general public widely acknowledge the need for high-quality university education programs and professional training courses. However, guides, recommendations, practical tools, and good examples that could help institutions design appropriate cybersecurity programs are still missing. In particular, a comprehensive method to identify skills needed by cybersecurity work roles offered on the job market is missing. This paper aims to provide practical tools and strategies to help higher education providers design good cybersecurity curricula. First, we analyze the content of 89 existing study programs worldwide, collect recommendations of renowned institutions within and outside the EU, and provide a comprehensive survey accompanied by a dynamic web application called Education Map. Based on the knowledge about the current state in cybersecurity education, we design the SPARTA Cybersecurity Skills Framework that provides the currently missing link between work roles and required expertise and shows how to develop a curriculum that reflects job market requirements. Finally, we provide a practical tool that implements the framework and helps education and training providers design new study programs and analyze existing ones by considering the requirements of cybersecurity work roles.

Strategic Approaches to Cybersecurity Learning: A Study of Educational Models and Outcomes

“…Research has spotlighted potential opportunities and pitfalls in various educational models, especially when it comes to attracting, retaining and preparing students for a career in cybersecurity [14,20,21]. Stavrou [17] emphasized that cultivating lifelong learning should be a priority in formal education for cybersecurity subjects.…”

Cybersecurity Education in Universities: A Comprehensive Guide to Curriculum Development

“…In [34], Hudnall estimated the above-mentioned mapping to become an ''overwhelmingly time consuming'' task, and in [36] although the authors did not perform the mapping, they concluded that for a successful mapping, and due to a huge number of knowledge descriptions, the researchers have to trim the knowledge descriptions of the NICE framework. In another work [37] that was performed within the Advanced Research and Technology in Europe project (a.k.a., SPARTA project) 2 , the authors mapped the job roles of the NICE framework to 29 cybersecurity topics that were defined by the SPARTA project. This mapping enables the curricula designers to directly consult knowledge descriptions, skills, and tasks that are required for each job role of the NICE framework.…”

Towards NICE-by-Design Cybersecurity Learning Environments: A Cyber Range for SOC Teams

“…Others [50] examined whether NICE can be used as a baseline to create questionnaires that measure the level of knowledge improvement. The benefits of using the NICE framework as a detailed and extensive list of expected learning outcomes have also been mentioned in [36]. In another work [74], the NICE framework was analysed, and a model was proposed to design a cybersecurity degree program, highlighting the potential inconsistencies of the framework.…”