National Initiative For Cybersecurity Education Research Articles

Creating a Repeatable Nontechnical Skills Curriculum for the University of Southern Maine (USM) Cybersecurity Ambassador Program (CAP)

The workforce demand for skilled cybersecurity talent has exceeded its supply for years. Historically, the pedagogical approach was to identify and create curricula for the most in-demand technical knowledge, skills, and abilities (KSAs). Unfortunately, the field has tended to neglect nontechnical counterparts. However, recent literature suggests a core set of nontechnical KSAs that employers seek after. This study explored the codification of a nontechnical curriculum for a cybersecurity internship program at the University of Southern Maine (USM). The USM faculty created the Cybersecurity Ambassador Program that can serve students and the community. The service to students is to make them more attractive to employers. The benefit to the community is to provide cybersecurity awareness training to vulnerable populations. This discussion about the USM CAP serves as a case study for other programs considering this type of enrichment using an internship model. CAP started as an informal program, but this research used objective data to create repeatable blueprints. The researchers designed these lesson plans to help students progress from novices to competent in crucial nontechnical skills delineated in the National Initiative for Cybersecurity Education (NICE) Workforce framework. The team used a mixed methods approach to baseline Tier 1/novice students’ skill levels, place them in a cybersecurity enrichment program, track their progress, and determine program efficacy in helping them achieve beginner status. The information shared can serve as a point of departure for a case study that might guide other programs interested in doing similar work.

A Cyber Counterintelligence Competence Framework: Developing the Job Roles

In recent years, there have been intensifying cyber risks and volumes of cyber incidents prompting a significant shift in the cyber threat landscape. Both nation-state and non-state actors are increasingly resolute and innovative in their techniques and operations globally. These intensifying cyber risks and incidents suggest that cyber capability is inversely proportional to cyber risks, threats and attacks. Therefore, this confirms an emergent and critical need to adopt and invest in intelligence strategies, predominantly cyber counterintelligence (CCI), which is a multi-disciplinary and proactive measure to mitigate risks and counter cyber threats and cyber-attacks. Concurrent with the adoption of CCI is an appreciation that requisite job roles must be defined and developed. Notwithstanding the traction that CCI is gaining, we found no work on a clear categorisation for the CCI job roles in the academic or industry literature surveyed. Furthermore, from a cybersecurity perspective, it is unclear which job roles constitute the CCI field.
 This paper stems from and expands on the authors’ prior research on developing a CCI Competence Framework. The proposed CCI Competence Framework consists of four critical elements deemed essential for CCI workforce development. In order of progression, the Framework’s elements are: CCI Dimensions (passive-defensive, active-defensive, passive-offensive, active-offensive), CCI Functional Areas (detection, deterrence, deception, neutralisation), CCI Job Roles (associated with each respective Functional Area), and Tasks and Competences (allocated to each job role). Pivoting on prior research on CCI Dimensions and CCI Functional Areas, this paper advances a proposition on associated Job Roles in a manner that is both intelligible and categorised.
 To this end, the paper advances a five-step process that evaluates and examines Counterintelligence and Cybersecurity Job Roles and functions to derive a combination of new or existing Job Roles required for the CCI workforce/professionals. Although there are several cybersecurity frameworks for workforce development, establishing the CCI Job Roles is specifically based on the expression of the Job Roles defined in the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework.

Analysis and Evaluation of Capture the Flag Challenges in Secure Mobile Application Development

Capture the Flag (CTF) challenges are frequently used as cybersecurity learning environments to engage students in cybersecurity education activities and learning, focusing on technical concepts. CTF challenges cover various learning topics. However, they do not always maintain a clear learning outcome. In this paper, we present a systematic approach to study and evaluate CTF challenges, then apply the evaluation methodology in two CTF challenges that relate to the development of secure mobile applications. For this proof of concept, we used the National Initiative for Cybersecurity Education (NICE) which is a cybersecurity educational framework published by the National Institute of Standards and Technology (NIST). Additional information was used for the evaluation process which included threat, vulnerability, and weakness taxonomies proposed by Open Web Application Security Project® (OWASP) and Mitre Corporation (MITRE). The evaluation methodology could be used to assess and determine the learning outcomes of other existing or upcoming CTF challenges, including though not limited to secure mobile application development.

The role of national cybersecurity strategies on the improvement of cybersecurity education

Digital information and telecommunication technologies have not only become essential to individuals’ daily lives but also to a nation’s sustained economic growth, societal well-being, critical infrastructure resilience, and national security. Consequently, the protection of a nation’s cyber sovereignty from malicious acts is a major concern. This signifies the importance of cybersecurity education in facilitating the creation of a resilient cybersecurity ecosystem and in supporting cyber sovereignty. This study reviews a sample from world-leading countries National Cybersecurity Strategic Plans (NCSPs) and analyzes the associated existing cybersecurity education and training improvement initiatives. Furthermore, a proposal to adopt the Goal-Question-Outcomes(GQO)+Strategies paradigm into cybersecurity education and training programs curricula improvement to national cybersecurity strategic goals is presented. The proposal maps cybersecurity strategic goals to cybersecurity skills and competencies using the National Initiative for Cybersecurity Education (NICE) framework. The newly proposed cybersecurity education and training programs’ curricula learning outcomes were generated from the GQO+Strategies paradigm based on the three major cybersecurity strategic goals: Development of secure digital and information technology infrastructure and services, defending from sophisticated cyber threats, and enrichment of individuals’ cybersecurity maturity and awareness. It is highly recommended that cybersecurity university program administrators utilize the proposed GQO+Strategies to align their program’s curriculum to NCSP. Hence, closing the gap that exists with the relevant skills and sustain national cybersecurity workforces.

Bridging the disconnect within Cybersecurity Workforce Supply Chain

Within the Cybersecurity workforce supply chain, there continues to be a disconnect between the undergraduate curriculum and industry skill demand. The cybersecurity workforce framework of the National Initiative for Cybersecurity Education can serve as one of the tools to bridge this disconnect. Borrowing from the learnings in the training of students in medical school, this paper performs a qualitative literature review on some of the existing efforts to develop the cybersecurity workforce. By exploring the integration of the cybersecurity workforce framework and the curriculum guideline of the Joint Task Force on Cybersecurity Education, it recommends the introduction of Entrustable Professional Activities and mandatory apprenticeship as part of the curriculum guideline. The Entrustable Professional Activities could be based on workforce tasks defined by NICE and cybersecurity graduates will be expected to demonstrate capability to perform those activities. Industry participation is required across all levels of the supply chain.

Assessing Competencies Using Scenario-Based Learning in Cybersecurity

Recent years have seen a disconnect between much-needed real-world skills and knowledge imparted to cybersecurity graduates by higher education institutions. As employers are shifting their focus to skills and competencies when hiring fresh graduates, higher education institutions are facing a call to action to design curricula that impart relevant knowledge, skills, and competencies to their graduates, and to devise effective means to assess them. Some institutions have successfully engaged with industry partners in creating apprenticeship programs and work-based learning for their students. However, not all educational institutions have similar capabilities and resources. A trend in engineering, computer science, and information technology programs across the United States is to design project-based or scenario-based curricula that impart relevant knowledge, skills, and competencies. At our institution, we have taken an innovative approach in designing our cybersecurity courses using scenario-based learning and assessing knowledge, skills, and competencies using scenario-guiding questions. We have used the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework and the Office of Personnel Management (OPM) Hiring Cybersecurity Workforce report for skills, knowledge, and competency mapping. This paper highlights our approach, presenting its overall design and two example mappings.

Security Education Training Program Characteristics needed to Development Task of Security Software in Security Majors of 5 Universities of Seoul Region

In this paper, the technology and capabilities required for the job of developing security software recommended by the Cybersecurity Human Resources Development Framework of the National Initiative for Cybersecurity Education (NICE) were studied. In this paper, we describe what security skills are needed for the task of developing security software and what security capabilities should be held. The focus of this paper is to analyze the consistency between security technologies (core and specialized technologies) required for security software development tasks and the curriculum of information protection-related departments located in Seoul, Korea. The reason for this analysis is to see how the curriculum at five universities in Seoul is suitable for performing security software development tasks. In conclusion, if the five relevant departments studied are to intensively train developers of development tasks for security software, they are commonly required to train security testing and software debugging, how secure software is developed, risk management, privacy and information assurance.

ИНФОРМАЦИОННАЯ БЕЗОПАСНОСТЬ ГОСУДАРСТВЕННЫХ ИНФОРМАЦИОННЫХ СИСТЕМ

Целью статьи является рассмотрение вопросов связанных с обеспечением безопасности государственных информационных систем в Российской Федерации. Актуальность этих вопросов обусловлена в первую очередь тем, что с каждым годом в России не уменьшается число кибератак (наносящих значительный ущерб государству) на различные сферы её экономики, в том числе, на её государственные информационные системы. Несколько лет назад начала реализацию национальная инициатива в области кибербезопасности – NICE ( « The National Initiative for Cybersecurity Education » ), что не обойдено вниманием российских и других специалистов в области информационной безопасности. К основным направлениям защиты информационной собственности отнесены: охрана (государственной, служебной, коммерческой, банковской, налоговой, страхования, персональных данных и др.) тайн и интеллектуальная собственность. Государственные информационные системы (ГИС) включают информационно-технологические средства и системы, при создании которых опираются на передовые научные изыскания, такие как знания, передовые технологии (ноу-хау) и др. и являются неотъемлемой частью и достаточно сложной системы государственного управления. Предметом исследования являются ГИС, как основа управления государственных органов. В работе первоочередное внимание уделено современным тенденциям в области обеспечения защиты информации ГИС, краткому обзору законодательства в области ГИС и критической информационной инфраструктуре.

The NICE Challenge Project: Providing Workforce Experience Before the Workforce

This article explains how the National Initiative for Cybersecurity Education (NICE) Challenge Project (NCP) provides students with the opportunity to apply their knowledge, skills, and abilities to a realistic hands-on scenario similar to what would be expected of them in actual cybersecurity work roles. It also describes use cases, lessons learned, and the future focus of the project.

К ВОПРОСУ О ЦЕЛИ И ЗАДАЧАХ НАЦИОНАЛЬНОЙ ОБРАЗОВАТЕЛЬНОЙ ИНИЦИАТИВЫ США В ОБЛАСТИ КИБЕРБЕЗОПАСНОСТИ

In the current year, Russia entered a three-year transitional period for the implementation of professional standards designed to replace the traditional regulations of the Unified Qualification Handbook (UQH) for the positions of executives, specialists and employees. Several professional standards have been approved for the field of staffing of information security. However, from the higher school point of view, the existing variety of approved professional standards can hardly be used as a normative basis for the improvement and development of the existing system of educational standards in the information security area, although such an obvious conceptual task was set in the framework of the transition from UQH to professional standards. This paper analyses foreign experience in solving this problem using rather impressive example of the United States. A systematic study of the labor (personnel) resources structure in the cybersecurity field was carried on within the framework of the national initiative for cybersecurity education, which is proposed as a fundamental reference resource. That resource can be used to guide the various category users, including educational organizations, to solve their tasks of providing labor resources in the field of cybersecurity. The cybersecurity workforce framework (CWF) components include such categories as specialty areas, work roles, knowledge, skills, abilities and tasks (performed for any kind of work). The paper analyzes the presented CWF, its content, as well as its important role in harmonizing the Russian educational standards in the field of cybersecurity.

Identifying Dimensions of Cyber Aptitude

Cybersecurity is a broad and growing job field, encompassing many different job categories with different cognitive demands. Traditional, knowledge-based assessments may exclude candidates who are cognitively suited to performing cybersecurity work but who have not had the opportunity to learn the subject matter. Using the job categories included in the National Initiative for Cybersecurity Education (NICE) framework for the cybersecurity workforce, we propose a model for predicting cybersecurity aptitude beyond a general- intelligence approach. In addition to including general intelligence, the model is based on a classification of jobs as requiring real-time or deliberate performance, and proactive or reactive actions. We suggest that tasks, work roles, and people can be represented along the same set of axes to match job requirements to person attributes. These constructs can then be used to create assessments of potential for cybersecurity applicants, including one we propose, called the Cyber Aptitude and Talent Assessment (CATA).

The NICE Framework: Why You Need to Understand This Important Initiative

Cybersecurity is an emerging profession. It is far too vast and complex to be a specialty area of one of the electronic disciplines. Instead it is a fully defined discipline in-and-of itself. The National Institute for Standards and Technology (NIST), National Initiative for Cybersecurity Education (NICE) represents a body of knowledge for this new field and in that respect it defines the concepts and practices that are legitimate areas of professional work and workforce education and training. The rationale and the detailed structure of this groundbreaking model are presented here along with how it fits with substantive efforts to ensure the U.S. critical infrastructure.

미래 융합환경 기반의 정보보호 직업군 설계

Recently advanced security threats have increasingly occurred, and the necessity and importance of Information Security has been growing with the advent of the era of convergence beyond information-oriented age. Most domestic studies in the field of occupational classification of Information Security have only focused on technology-oriented occupations. Relatively little research has been carried out on the occupational classification in the view of convergence environment. Therefore, in this paper we gave a definition of Information Security occupations, classified them and draw required capabilities by occupations in order to design the occupational classification system of Information Security and the required capabilities for future convergence environment by analyzing the previous studies. We also reclassified the occupational classification and required capabilities by occupations, and verified the validity of them based on National Initiative for Cybersecurity Education’s the occupational classification system of Information Security considering the future convertgence environment. It is expected that the results of this study will be employed as base data for manpower demand and supply and improvement of working conditions in the future convergence environments. In the future study we will build standardized instruction methods which provide occupational capabilities by using the required capabilities by occupations.

Defense against the dark arts (of Cyberspace) universities are offering graduate degrees in cybersecurity

In an increasingly networked world, security attacks have become not just more frequent and sophisticated but also more financially damaging. The silver lining is the growing need for cybersecurity experts. Information security analyst jobs are expected to grow by 37 percent by 2022, according to the U.S. Bureau of Labor Statistics. "Every time there‚s a new breach anywhere, a light goes on in some C-suite office and it opens up hiring," says Ernest McDuffie, who leads the National Initiative for Cybersecurity Education (NICE) at the U.S. National Institute of Standards and Technology.

Multifarious initiatives in cybersecurity education

According to the nAtionAl Security council, “president obama has identified cybersecurity as one of the most serious economic and national security challenges we face as a nation, but one that we as a government or as a country are not adequately prepared to counter [2].” in may of 2009, the president supported the recommendations from his commissioned cyberspace policy review that, among other endorsements, included promoting cybersecurity awareness and building the digital workforce of the 21st century. the recommendations from the cyberspace policy review were based upon the 2008 comprehensive National cybersecurity initiative (cNci), which consists of 12 individual initiatives designed to help secure the united States in cyberspace. this column will focus on initiative 8 – expand cyber education – as it relates to two-year college programs. First a little background on cNci initiative 8. presently, an insufficient number of cybersecurity practitioners and professionals exist to protect and defend the united States in cyberspace. the current cybersecurity training and education programs are limited in focus and lack unity of effort. Evolving from cNci initiative 8, the National initiative for cybersecurity Education (NicE) was established with the goal of creating “operational, sustainable and continually improving” cybersecurity education that will enhance the nation’s security [8]. the Department of Education and the National Science Foundation (NSF) are serving as co-leads for this NicE component called Formal Cybersecurity Education. the mission of this component is to bolster cybersecurity education programs from kindergarten through graduate school, with an emphasis on science, technology, engineering and mathematics (StEm) disciplines to fill the pipeline with technologicallyskilled and cyber-savvy personnel. During the summer of 2011, an acm innovation and technology in computer Science Education (iticSE) working group studied 16 associate-degree programs in information assurance (a.k.a. cybersecurity). the findings are revealing and in concert with cNci initiative 8. “a lack of consensus of what constitutes information assurance (ia) education has led to ia degree programs with widely varying curricula [10].” associate degree ia programs vary in their particular emphases, their curricular structure, and whether they are meant to place graduates into the workforce or to matriculate students into baccalaureate degree programs. of the 16 associate-degree programs examined by the 2011 working group, 14 were associate of applied Science (a.a.S.) degrees and 2 were associate of Science (a.S.) degrees. of the a.a.S. career programs, two areas of concentration emerged, network security and computer forensics. Figure 1 depicts the composition of a typical network security degree, while Figure 2 illustrates the composition of a typical computer forensics

Securing the Information and Communications Technology Global Supply Chain from Exploitation: Developing a Strategy for Education, Training, and Awareness

Introduction critical chains of government and industry are no longer simple and visible sets of links from raw materials to manufacturers to acquirers immune to outside threats. Supply chains for information and communications technologies (ICT)-enabled components, like other critical chains, have become more complex and dynamic, making it imperative to assure that the products delivered for the component, system, and mission do what they are intended to do, and nothing else. U.S. Department of Defense (DoD) and others in the federal government view this growing threat to the critical ICT as an emerging national security issue that deserves more attention across the enterprise. Global ICT risk is a new aspect of cybersecurity identified as a priority in the Comprehensive National Cybersecurity Initiative (2009) as Initiative 11: Develop a multi-pronged approach to global risk management. Additionally, Initiative 8: Expand cyber education led to the creation of the National Initiative for Cybersecurity Education (NICE) (2009) and its National Cybersecurity Workforce Framework (2012) that defines specialty areas; knowledges, skills, and abilities (KSAs); and competencies. Global ICT risk cuts across many of the framework's specialty areas and the workforce requirements for ICT risk are found in the tasks, KSAs, and competencies of each specialty area. This paper frames the key elements of global ICT security and its importance to government as well as private sector companies. It also discusses the foundations of an education, training, and awareness (ETA) effort for the DoD workforce, where none currently exist. A is defined as the set of suppliers that contribute to the content of a product or system (both hardware and software) or that have the opportunity to modify its content (Ellison & Woody, 2010). Supply risk is the process for managing risk by identifying critical systems, processes, and components; vulnerabilities; and threats throughout the chain, and developing mitigation strategies to combat those threats. According to the U.S. National Strategy for Global Supply Chain Security (January 2012), global systems rely upon an interconnected web of transportation infrastructure and pathways, information technology, and cyber and energy networks (p. 2). The is now recognized as a major cyber threat affecting development and operation of computer systems and not just a threat to the transportation of material and goods from supplier to purchaser (Filsinger, Fast, Wolf, Payne, & Anderson, 2012, p. 9). Private sector companies are increasingly concerned about malicious tampering of software and hardware and counterfeits that lead to loss of their intellectual property, interfere with the successful performance of their products, and potentially damage their brands and reputations. term supply risk management was selected by policy makers to describe this new aspect of cybersecurity; however, the term has different meanings in other communities. term commonly applies to the efficiency and logistical aspects of the chain, not the integrity of ICT or the risks associated with its exploitation. For this new national cyber security concern, the ETA effort, and this paper, the topic is managing the taking of risks associated with global ICT exploitation with a focus on product integrity and its significance to the design, systems engineering, and sustainment phases of the system life cycle. Statement of the Problem: Responding to the Global ICT Supply Chain Security Threats Federal IT systems are increasingly at risk of both intentional and unintentional compromise due to the growing sophistication of information and communications technologies (ICT) and the growing speed and scale of a complex, distributed global chain (Boyens, Paulsen, Bartol, Moorthy, & Shankles, 2012, p. …

NICE: Creating a Cybersecurity Workforce and Aware Public

The National Initiative for Cybersecurity Education (NICE) aims to create an operational, sustainable, and continually improving program for cybersecurity awareness, education, training, and workforce development. As part of the initiative, the NICE Cybersecurity Workforce Framework aims to codify cybersecurity talent; define the cybersecurity workforce in common terms; and tie the workforce's various jobs, competencies, and responsibilities into a common architecture.