The Wild West of Security Post-Secondary Education

Black Hat researchers will show how inconsistent security schooling is at the university level.

Although an increasing number of universities and post-secondary institutions are offering some level of cybersecurity education, the discipline suffers from a lack of consistent accreditation or measurement of educational efficacy. As things stand, educators arent carefully considering their curriculum standards and recruiters are having a hard time using scholarly credentials as a measurement for new employees.
This is the premise of a
Black Hat talk
by two Rochester Institute of Technology (RIT) professors who today plan to expose one of the fundamental problems behind the shortage in security talent across the industry.
They took a deep dive examining security programs across the US for their presentation. Foremost among their findings was that while most schools today use their computer science degrees as the main method for disseminating cybersecurity knowledge, the actual security content of these compsci degrees is absolutely miniscule.
The Association for Computing Machinery (ACM) curriculum guidelines that govern compsci degree accreditation only requires three to nine lecture hours of security for a four-year computer science degree, says Rob Olson, a professor of programming, mobile security, and Web app security at RIT. As he emphasizes, those arent credit hours — those are actual hours in the classroom.
Thats not just application-level security or coding-level security. That includes, in the computing science curriculum, where networking security and strong security principals would fit in, chimes in his co-presenter, Chaim Sanders, also a professor at RIT.
The breakdown typically looks something like one hour dedicated to fundamental security, one to two lecture hours of secure design, one to two hours on defensive security, one hour on threats and attacks, and two optional hours on network security.
And then — this is one of my favorites — one lecture hour on all of cryptography, Olson says. And thats optional. Thats optional.
Meanwhile, a number of schools are recognizing that they need to step up their game for cybersecurity and are making program changes accordingly. According to Olson and Sanders, for about 25% of schools that means specialized cybersecurity degrees. This is good in theory, but it presents problems at the execution level. First of all, some worry about whether this is even an effective method for teaching security today. While increasingly more real-world organizations move toward DevSecOps, where security is a shared discipline across the developer and operations teams, breaking it out like this goes in the opposite direction that most IT departments are moving.
So that seems to be an interesting, although maybe not necessarily very effective, maneuver, because it separates out who will essentially become the developers from the people who are going to be doing security in organizations, says Sanders.
Meanwhile, at a more fundamental level theres no true accreditation available as a backstop for these specialized cybersecurity programs. At best, the National Security Agency (NSA) has its own set of designations that have been serving as a pseudo accreditation and which governs grants to these schools from the government for cybersecurity improvements.
The closest thing to accreditation we have is NSA designations and in those cases theres been a lot of open-endedness historically, which has fueled a lot of fly-by-night schools that are doing it as a draw but which dont necessarily have the technical expertise to maintain the computing security program, Sanders says.
This has created a large degree of stratification of the haves and have-nots, with only the tech schools able to offer a curriculum that keeps pace with todays rapidly changing attack and defense trends. The trick is that its difficult to even convey that to employers because theres no consistent measurement of cybersecurity educational efficacy either.
There is very little assessment within higher education of things like learning outcomes for cybersecurity, Olson says. The curriculum guidelines that are there say these programs are supposed to teach security, but theyre not actually assessing the security knowledge that students are getting all that much.
Related Content:
Why Printers Still Pose a Security Threat
HP Disputes Printer Security Vulnerabilities
7 Hardware & Firmware Hacks Highlighted at Black Hat 2017

Last News
▸ Watch out for risks in HTML5 development ◂ Discovered: 26/12/2024 Category: security	▸ Google defies surveillance gag. ◂ Discovered: 26/12/2024 Category: security	▸ FBI searches for license photos spark privacy concerns. ◂ Discovered: 26/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
The Wild West of Security Post-Secondary Education