IGF 2018 WS #323
Global Cybersecurity Education Needs: Outcomes of Inaction

The cybersecurity skills shortage represents an existential threat to developed nations that rely on technology as the backbone of their economy, critical infrastructure, and society at large.”
According to the World Economic Forum’s Global Risk Report 2018, cybersecurity risks are growing, both in their prevalence and in their disruptive potential. In order to tackle this issue, there needs to be a significant improvement in the way the global community approaches the education and training of cybersecurity competencies and professionals. Currently the world is faced with an immense skills deficit when it comes to cybersecurity. Failure to address this will result in wide ranging and globally reaching barriers to the achievement of the Sustainable Development Goals. Such disruption will hinder the global communities’ ability to both harness and share in the benefits of technological development. As such, this session will explore global cybersecurity education and training needs, and highlight the consequences of inaction in addressing such skills deficits.

Such discussion will be informed by the work of the Global Cyber Security Capacity Centre (GCSCC) at the University of Oxford including research related to the Cybersecurity Capacity Maturity Model for Nations (CMM), of which ‘Education, Training and Skills’ is one of five dimensions crucial for a country’s cybersecurity capacity, and the Cyber Harm Framework (CHF).

Cybersecurity Capacity Maturity Model for Nations (CMM)

The Cybersecurity Capacity Maturity Model for Nations (CMM) considers national cybersecurity capacity across five dimensions. These five dimensions cover the broad expanse of areas that make up the essential national cybersecurity capacity. They consist of a number of factors, and all factors are considered
with respects to five levels of maturity. The CMM outlines what a country
should expect to be able to do in each factor of each dimension, for each level
of maturity, and so the evidence that is required to convince that a level has
been achieved. It is a guided self-assessment model that can help a country
understand both its current maturity in each dimension, and also the types of
capacity-building that would need to be undertaken to further mature capacity
in any area, as prescribed by the model. Countries are then able to prioritise
capacity-building investments, according to their needs, the harms they wish
to address, and the risks that concern them most.
In order for a country to develop capabilities across all five dimensions, education and training will be critical. Firstly, there is a need to ensure that the government’s own education and training programmes can connect all of this information together and convert it into appropriate content and channels to meet their local context most effectively. Secondly, specific education and training requirements are needed to support the development of maturity within and across all dimensions of the CMM for all stakeholders involved in delivering the national capacity. Here lessons can be drawn from Dimension 3 of the CMM, “Cybersecurity Education, Training and Skills”, which provides an insight into types of national cybersecurity capacity-building requirements.
Cyber Harm Framework (CHF)
The GCSCC is in the process of developing a holistic and robust model for understanding the harm experienced by nations as a result of a lack of capacity, and how this can be reduced. The initial focus-groups and interview results suggest that an overwhelming majority of research participants (85% of them) identified education as a fundamental area where capacity-building is required. There is an educational need across the full range of possible stakeholders affected by cyber-harm, specifically for groups of people who hold key roles in their organisations (board members and managers) as well as more vulnerable groups (such as teenagers and elderly people).
Apart from training courses in cybersecurity and general education regarding phishing emails and other trending threats, it is also evident from our research that cyber-risk is underestimated. Risk appetites are socially determined, and unless cybersecurity risk becomes part of the mainstream, people will continue to overlook it. Therefore, educational efforts should focus on making these risks more tangible to individuals. Developing education courses focusing on understanding harm, and proposing effective channels to communicate its effects to a wider public are essential. For these education topics, in many cases the knowledge already exists, but needs to be developed into an educational offering. In other cases, there is a knowledge gap that will require research before educational offerings can be designed. One clear priority area for research is in the area of understanding harm arising from cyber-attacks or a lack of cybersecurity.
The session will be structured into two parts, first analysing the current need for cybersecurity capacity building in terms of education, and secondly discussing the need to reconsider our approach to cybersecurity education and training.

Part one: Need for cybersecurity education and training
Significant improvements in the way the global community approaches the education and training of cybersecurity competencies and professionals is required in order to begin to close the skills deficit.
Panellists will briefly discuss the increasing risk of cybersecurity and the role of education. Each speaker will describe the challenges in their stakeholder group/communities in terms of cybersecurity training and education and the consequences. Panellists will highlight the evidence relating to the global cybersecurity skill shortage, taking both global and regional perspectives and looking at the impact of such gaps on nations at various stages of economic development.
The GCSCC will provide a reflection on the lessons that have already been learnt at the Capacity Centre from the research related to the CMM and the CHF, and critiquing the need for an analysis of the full spectrum of cybersecurity educational requirements, and the development of a template national education strategy that countries can easily adopt and adapt as they seek to mature aspects of their national cybersecurity capacity
Part Two: Ideas and opportunities for action

This will be followed by a discussion on the integration of cybersecurity capacity building and education (?) into international development projects, including barriers to integration, connection of cybersecurity to the United Nations Sustainable Development Goals (SDGs) and linking to the World Summit on the Information Society (WSIS) Action Lines.

Panellists will further discuss the role of education and training in National Cybersecurity Strategies and will provide examples for building action plans to build a national cybersecurity worksforce. Different cooperation examples will be presented including national, regional and approaches for education and trainings including public-private partnerships and research collaborations.