Paper at FIE’19 on cyber security education and accreditation

This week, with colleagues from the Universities of Bath, Sunderland and Northumbria, we presented our joint paper at the 49th Annual IEEE Frontiers in Education Conference (FIE’19). This paper links to our coming work on degree accreditation, but primarily focuses on what is taught and what should be taught for cyber security as part of a general computer science undergraduate degree programme, and whether cybersecurity should be taught stand-alone or in an integrated manner, as part of UK-based case study.

The abstract of the paper is below; you can access the full paper online, on GitHub, or via my institutional repository:

A UK Case Study on Cybersecurity Education and Accreditation

Tom Crick, James H. Davenport, Alastair Irons and Tom Prickett

This Innovative Practice Full Paper presents a national case study-based analysis of the numerous dimensions to cybersecurity education and how they are prioritised, implemented and accredited; from understanding the interaction of hardware and software, moving from theory to practice (and vice versa), to human factors, policy and politics (as well as various other important facets). A multitude of model curricula and recommendations have been presented and discussed in international fora in recent years, with varying levels of impact on education, policy and practice. This paper address three key questions: i) what is taught and what should be taught for cybersecurity to general computer science students; ii) should cybersecurity be taught stand-alone or in an integrated manner to general computer science students; and iii) can accreditation by national professional, statutory and regulatory bodies enhance the provision of cybersecurity within a body’s jurisdiction? Evaluating how cybersecurity is taught in all aspects of computer science is clearly a task of considerable size, one that is beyond the scope of this paper. Instead a case study-based research approach — primarily focusing on the UK — has been adopted to evaluate the evidence of the teaching of cybersecurity within general computer science to university-level students. Thus, in the context of widespread international computer science/engineering curriculum reform, what does this need to embed cybersecurity knowledge and skills mean more generally for institutions and educators, and how can we teach this subject more effectively? Through this UK case study, and by contrasting with related initiatives in the US, we demonstrate the positive effect that national accreditation requirements can have, and offer some recommendations both for future research and curriculum developments.

Keywords: Cybersecurity, curricula, accreditation, computer science education, public policy, UK

https://doi.org/10.1109/FIE43999.2019.9028407

(also see: Publications)