The Wild West of Security Post-Secondary Education

Although an increasing number of universities and post-secondary institutions are offering some level of cybersecurity education, the discipline suffers from a lack of consistent accreditation or measurement of educational efficacy. As things stand, educators aren't carefully considering their curriculum standards and recruiters are having a hard time using scholarly credentials as a measurement for new employees.

This is the premise of a Black Hat talk by two Rochester Institute of Technology (RIT) professors who today plan to expose one of the fundamental problems behind the shortage in security talent across the industry.

They took a deep dive examining security programs across the US for their presentation. Foremost among their findings was that while most schools today use their computer science degrees as the main method for disseminating cybersecurity knowledge, the actual security content of these compsci degrees is absolutely miniscule.

The Association for Computing Machinery (ACM) curriculum guidelines that govern compsci degree accreditation only requires three to nine lecture hours of security for a four-year computer science degree, says Rob Olson, a professor of programming, mobile security, and Web app security at RIT. As he emphasizes, those aren't credit hours — those are actual hours in the classroom.

"That's not just application-level security or coding-level security. That includes, in the computing science curriculum, where networking security and strong security principals would fit in," chimes in his co-presenter, Chaim Sanders, also a professor at RIT.

The breakdown typically looks something like one hour dedicated to fundamental security, one to two lecture hours of secure design, one to two hours on defensive security, one hour on threats and attacks, and two optional hours on network security.

"And then — this is one of my favorites — one lecture hour on all of cryptography," Olson says. "And that's optional. That's optional."

Meanwhile, a number of schools are recognizing that they need to step up their game for cybersecurity and are making program changes accordingly. According to Olson and Sanders, for about 25% of schools that means specialized cybersecurity degrees. This is good in theory, but it presents problems at the execution level. First of all, some worry about whether this is even an effective method for teaching security today. While increasingly more real-world organizations move toward DevSecOps, where security is a shared discipline across the developer and operations teams, breaking it out like this goes in the opposite direction that most IT departments are moving.

"So that seems to be an interesting, although maybe not necessarily very effective, maneuver, because it separates out who will essentially become the developers from the people who are going to be doing security in organizations," says Sanders.

Meanwhile, at a more fundamental level there's no true accreditation available as a backstop for these specialized cybersecurity programs. At best, the National Security Agency (NSA) has its own set of designations that have been serving as a pseudo accreditation and which governs grants to these schools from the government for cybersecurity improvements.

"The closest thing to accreditation we have is NSA designations and in those cases there's been a lot of open-endedness historically, which has fueled a lot of fly-by-night schools that are doing it as a draw but which don't necessarily have the technical expertise to maintain the computing security program," Sanders says.

This has created a large degree of stratification of the haves and have-nots, with only the tech schools able to offer a curriculum that keeps pace with today's rapidly changing attack and defense trends. The trick is that it's difficult to even convey that to employers because there's no consistent measurement of cybersecurity educational efficacy either.

"There is very little assessment within higher education of things like learning outcomes for cybersecurity," Olson says. "The curriculum guidelines that are there say these programs are supposed to teach security, but they're not actually assessing the security knowledge that students are getting all that much."

Related Content: