Personal Blogs

On 16 November 2022 I participated an online Cyber Security Education and Employability Forum, which was hosted by CISSE, the UK chapter of the Colloquium for Information Systems Security, and facilitated in collaboration with colleagues from the University of Roehampton School of Arts and Digital Industries and the OU School of Computing and Communications.

The forum was described as “an opportunity to share your knowledge and experience with the cyber education community, and to informally network with colleagues in other institutions who are involved with cyber security learning, teaching and employability.”

Since the event was not recorded, this blog aims to present a summary of what was discussed within the event. It is broadly intended for the 40 delegates who attended the session, but it might be of interest to anyone who may have an interest in cyber security. In some ways, this event follows on from an earlier CISSE Cyber Security Education Workshop that took place in 2021. This blog can also be viewed alongside other OU cyber security blogs.

The event began with an introduction by Charles Clarke, from the University of Roehampton.

Cyber Springboard

The first session was presented by Alex Collins, who presents a tool called Cyber Springboard. Clicking on this link takes you to a page which clearly summarises the aim of Cyber Springboard, which is to help students to “build and evidence the skills to get a job in cyber security”. The site also presents “activities and ideas for you to get curious about to build fluency in cyber skills”. 

Alex told us that he sits on certification panels, and his work on Cyber Springboard comes from 20 years of working in industry.

Alex made some important points that were reflected throughout the session. He emphasised that cyber is more than pen testing (penetration testing), more than forensics, and more than risk management; a career in ‘cyber’ is more than one of those things. An interesting reflection is that each of these areas have different stereotypes, in terms of the type of work that is performed within each area. The point is clear: cyber is broad. There are 21 Knowledge areas within the cyber security body of knowledge, the CyBOK; it’s a broad area. 

Cyber Springboard enables users to find what they like and don’t like. I made a note that there are 301 cards and activities which are connected to the CyBok knowledge areas. When registered, users can tick off cards. Each card contributes to a shape of a cyber knowledge profile, which can be shared on a personal profile or a CV. The next steps are to consider courses and pathways, developing improvements to the structure of Cyber Springboard, and increasing Cybok coverage.

Alex was asked an interesting question about how it is possible to move to cyber security. The question was answered in terms of building practical skills, finding time to learn what you enjoy, and evidence what you have achieved. An important point was: demonstrate enthusiasm. Also, consider providing a Github link on your CV. Sharing something will give you something to talk about in an interview.

Routes into cyber education: discussion and sharing

Next up was an informal session by Phil Hackett and myself, facilitated by Charles Clarke. The aim of the session was to discuss routes into cyber security teaching through a discussion, and sharing of resources.

One of the themes to emerge from this session was the notion of transitions. Phil began as an OU student, and then became a computing teacher at a secondary school. From there, he had ‘crossed the floor’ to work within the university, where he is involved with modules such as M269 Algorithms, data structures and computability.

My own story is a bit different. I moved from the university sector (where I carried out some research which was about the practice of computer programming), to industry, and back again. One thing that Phil and I have in common is that we’re both tutors; he teaches on M269, and I tutor on a Java module that has the title M250 Object-oriented Java Programming. Another commonality is that we have both had to deal with different types of cyber security incident. These incidents connect to the importance of having knowledge of controls and technical knowledge.

One thing that is common to transitions is the importance of evidence, and having a story; points which relate nicely to Alex’s presentation about Cyber Springboard. In terms of moving from industry to academia, one thing that we didn’t have time to share was a short Badged Open Course, which helps potential applicants understand more about the role of an OU tutor: Being an OU tutor in STEM. Anyone completing this course will be providing evidence that they understand what it means to be a distance learning tutor.

Another point that I think I made was about the important contributions industrial professionals can make to teaching. Importantly, and significantly, their industrial experience can help to make module materials come alive.

I made a note of two questions that were asked. The first question was about how to gain access to internships. Some thoughts were: make sure you have a good LinkedIn profile, know what you’re interested in, and don’t be afraid to be cheeky. What I mean by this is: don’t be afraid to get in touch with people and companies.

The second question was an interesting and challenging question: is it really necessary to have strong publication record if you want to be in academia? There are different roles within academia, and different institutions have different requirements. The short answer is: no, it isn’t really necessary, but you may have to choose where to apply to, and what you wish to do. Just like with cyber jobs, evidencing experience is really important. I’ll conclude by saying that becoming an OU tutor is a really great way to evidence your cyber teaching skills, and is a great way to join academia.

CyberFirst

The penultimate session was by Patrick from CyberFirst which is a part of the UK Government National Cyber Security Centre.

CyberFirst aims to “identify and nurture a diverse range of talented young people into a cyber security career”. As well as providing activities to “inspire and encourage students from all backgrounds to consider a career in cyber security”. CyberFirst also offers bursaries to undergraduates and degree apprenticeship students. (As an aside, the OU also offers cyber security analyst digital technology solutions degree apprenticeships for employers who want to support the development of their workforce).

For those working within the schools sector, CyberFirst is divided into a number of UK regions. CyberFirst is “working on ways to build a diverse and sufficient talent pipeline into the cyber sector (in all its forms) no matter what students have studied before”. Linking to the earlier presentations, some related questions are: how do we get people to use Alex’s tools, and how do we encourage students to study cyber security (and related subjects) at the OU?

An important point Patrick made was that “every job is a tech job” and that “our skills gap is pretty much everyone in the UK” given that technology is so interwoven into our lives. There are some fundamental issues that need to be address, such as 80% of cyber security employees are male. It is important to address how to increase the diversity in the sector.

In earlier presentations about cyber security, the ‘leaky skills’ pipeline was highlighted. In this presentation, Patrick offered a brief summary that explains this. If computer science was the only gateway subject into cyber security, it would begin with 300k students going through KS1 through 4. Looking towards the secondary sector, 12% of students study computer science, and only 9% of those are girls. Overall, only 2.5% of students then move on to study computer science at A level.

One way to begin to address diversity is to make people aware of the different career structure that makes up cyber security (which, again, connects to the earlier Cyber Springboard presentation). This of course, links to the earlier question posed in the last session: how do learners get to have a go ‘at some stuff’ to find what they’re good at?

Faced with these challenges, Patrick suggested that it might be instructive to look to other domains to see what they do, such as sport and medicine. A question is: how do you find out what things people are good at? In terms of sport, the answer might be to let people have a go at something and then coach and train people to their full potential. For medicine, give students the time to make informed choices and after they’ve tried different things, only then do learners move into specialism.

A rhetorical question was: what do we do in the security cyber space? How might a “sports model” be applied to cyber? There is a diversity of people, and many of them have not studied computer science. There are non-techies with a little cyber awareness, techies with limited cyber awareness, and techies with a genuine interest in cyber.

Patrick shared an idea of a talent pipeline, which begins with scale and diversity, moved onto learners and people making their own decisions about the subject, engagement and learning, and then directed activity which leads into employment, roles and responsibility.

Towards the end of this session, there was a reference to something called the CISSE UK problem book, which is intended to help educators not just in terms of education and teaching, but also for outreach and engagement.

In the question answer, I noted down two questions. The first question was: “does a degree title matter? How important is the label?” His response was: “we don’t mind the degree title, but it’s more about what the degree enables you to do. Your degree may well help you into the next step; knowing things about yourself is important”. A further point was: it is really important do show and demonstrate passion in an interview. 

The second question was about experience: “as a post-graduate student now doing a part-time masters’ in computer science with cybersecurity, what sort of work experience can I gain whilst doing this degree and where would I look for these opportunities?” In the context of the OU, and other universities there are the career services, which students should feel free to consult. Also, if you want to move into cyber it is possible to do your own thing to build evidence and demonstrate capability. Look to see if there’s some open source projects you can get involved with. Find a way to build a narrative that you can take to potential employers. As was mentioned earlier, consider adding a link to a GitHub repository on your CV, to give yourself something to talk about during interviews.

Academia and industry certifications aligned: An Open University case study

The final presentation of the day was by Lee Campbell from the OU. Lee is the module chair of TM359 Systems Penetration Testing which is due to be presented for the first time in February 2023. TM359 is a part of the OU BSc (Honours) Cyber Security. Lee takes us through a set of slides which presents the background context and much of the rationale for the module.

Why create a penetration testing module?

Business have a skills gap; they need more people with cyber security skills. Plus cyber security issues is a UK government tier 1 threat to national security. Also, students have been requesting a penetration testing module, and there is a need to complete the OU cyber security qualification. 

A really interesting aspect of both cyber security and pen testing is that they cover so many different areas of computing, such as programming, databases, and networking (which are all aspects which have been studied, in one form or another, during earlier modules).

OU options to build a pen test module

There are two key choices: build something in house, or outsource. One key need was to create (or to find) a technical environment that would be used by 600 students that would be separated from the OU technical environment. There are, always challenges; these were the resources that were available and the time.

The key considerations (or requirements) that I noted down from Lee’s presentation were costs, student access, the need for a web-based solution (to avoid the use of virtual machines), ease of integration with university education systems, and scalability. In light of all these considerations, a decision was made to look around to find a solution from an external supplier.

Lee made a point about education philosophy: both education and training is needed “to develop and adapt to society’s needs”. As an aside, training is about how to do things, whereas education is about when and why to do things. Any solution must amalgamate both perspectives.

Why align with a certification body?

If the decision is to outsource, which provider should the university go with? Lee highlighted a number of certifications that relate to pen testing and ethical hacking, such as CompTIA PenTest+, CPSA, Offensive OSCP, and Certified Ethical Hacker (CEH). There are also a number of laboratory tools, such as HackTheBox, TryHackMe and NDG Netlab+.

In the end, the Certified Ethical Hacker (CEH) from EC-Council was chosen, which is one of the leading certification bodies and is one of the top 10 certifications that relate to the subject.

There are a lot of CEH resources. There are up to 20 modules, and each module relates to a subject area. Each module has a dedicated video that presents an overview. There are eBooks, and a browser based lab called iLabs. There is also something called the CyberQ platform where students can carry out a pentest.

Integrating the new module

The TM359 module has integrated many of these resources over 31 weeks of study to enable the materials to be delivered through the OU VLE. Significantly, TM359 covers most of the areas in Cybok 1.1. Also, efforts have clearly been made to ensure the module is clearly about education rather than training.

Students study a module per week. Every week begins with an introductory video, and there are additional materials and tools to help students to make notes. There are five blocks. Block 1 is an introduction to the module and the subject; block 2 concerns reconnaissance, scanning and enumeration; block 3 is about system hacking, gaining, maintaining access and clearing tracks; block 4 concerns stakeholder engagement and automation; block 5 covers countermeasures and mitigation.

Question and Answer session

I made a note of three questions. 

The first question relates to the challenges that accompany using a vendor certification within an undergraduate programme. Lee emphasised that the materials explain important concepts and it is hoped and expected that there is a good balance between developing technical understanding and academic learning. A further reflection from this question is that the OU already has substantial experience of linking academic study and appropriate vendor qualification through its connection with Cisco, through the modules TM257 Cisco networking (CCNA) part 1 and TM357 Cisco networking (CCNA) part 2.

A follow up question relates to how the module team deals with iterations or changes. The university has a formal process following the launch of any module. Some of the changes occur through the vendor, and there are clear benefits in using a web-based platform in the sense that the extent that changes can be managed.

The final question was more of a comment. Rather than seeking an industrial provider, one alternative may have been to facilitate a greater level of collaboration with other higher education institutions to facilitate sharing of resources. A challenge that had to be faced was, of course, timescales. A further reflection is that the CISSE community may well have a role to play in facilitating the understanding of needs for cyber security educators.

Plenary discussion and next steps

During the forum, through a link shared in text chat, participants were encouraged to share something about their background and to say something about priorities for the community. Students made up the biggest group, with 19 participants. The other participants were academics, tutors, or members of government.

The priorities were ranked as follows: 

1. How can we ensure students get access to work experience?
2. How can we improve the quality of learning resources in academia?
3. How do we get more cyber security lecturers in academia?
4. What are the alternatives to placements and internships?
5. Alternatives to CVs?
6. What should be in a cyber education problem book?
7. How can job descriptions be improved?
8. The significance of cyber learning hubs between institutions

Regarding the first point, academics have a responsibility to speak with the careers teams or department, to make sure they are fully aware of the diversity of cyber security roles. 

Another important priority, which reflected earlier discussions, is the need to increase gender diversity within cyber security. This led to a discussion about the lack of women computer science teachers. Some accompanying questions were: why is this the case? Also, what can we do to change that? One reflection concerned the language used in job descriptions is an issue. For example, adverts which contain references to “rock star developers” might be attractive to one group, and not another.

The final point I noted down was about cyber security recruitment. Here is the final paraphrased question which I think was presented by Patrick: “how do we get recruiters to engage with the person, rather than asking the technical questions that need to be asked?”.

Perhaps the answer is to take the technical questions out of the interview, leaving space and time for the important question of: which aspect of cyber security do you feel you are best suited to?

Reflections

What was significant about this event was the practical focus of some of the questions that were asked, and also how each of the sessions linked to each other. A key question was: how do I go about gaining practical cyber security experience? There are different ways to answer this: network to gain contacts, be bold when it comes to asking about opportunities, seek advice from your university’s career service (if this is an option open to you), and try to find ways to develop and demonstrate your skills on your own terms.

The lack of gender diversity was a theme that emerged a number of times. Within the OU there is a plan to setup a new OU Women in STEM conference. Linked to this is the importance of role models and teachers which was mentioned by one of the speakers.

The biggest take away point that I took away from this event also related to diversity, diversity of roles that exist within cyber security. Looking to future CISSE sessions, it will be interesting to learn how this aspect of diversity can be expressed and embedded within the ‘problem book’ that the community is working on.

Acknowledgements

This blog post has morphed from a set of notes I made whilst attending the forum. Subsequently, many of the words presented within this blog come from each of the speakers, who all gave fabulous presentations. The idea for running this event came from Charles, who proposed themes, managed the registrations and worked through all the idiosyncrasies of MS Teams to make for a successful event. Thanks are also extended to Charles for his excellent proofreading. Finally, Jill Shaw helped with some of the technology admin on the day.

On 12 February 2013 I volunteered at a joint Open University and UCL event on 12 February 2013 which aimed to introduce aspects of computing and engineering to school students.  This was the first time I had been involved with this type of event.  I have started to view outreach (in the broadest sense) as something that is something that is increasingly important to do (and this is something that I have written about in an earlier blog).  So, if you're interested in hearing some about the outreach stuff that I've recently heard about, the previous blog I've posted might (or might not!) be of interest.

Structure

I learnt about this event by a colleague who was canvassing for volunteers.  Upon accepting his challenge I quickly discovered that I was to play a tiny part of what was a much bigger event and soon heard rumours that students were coming to UCL to hear about other subjects such as chemistry and engineering.  My own role was to offer some support and guidance to students who wished to learn a little bit about computing and information technology.

Not only was this, for me, my first ever time being involved in an outreach or engagement event, it was also my first ever time on the UCL campus: it was massive!  I found myself being ushered into a large computer suite in the basement of one of UCL's impressive buildings.  Within moments, our lead facilitator and lecturer, Arosha Bandara, started to outline the plan for the day.

The focus on the day was the programming language Sense, a language that is used with the Open University module TU100 My Digital Life which is a first level undergraduate module in computing.  One of the key aspects of Sense is that it works with a bit of electronics that allows different types of measurements to be made.  Arosha talked us through a program that simulated a simple etch-a-sketch game.  Students would be asked to make a change to the program so that it would work properly - they were required to do some software maintenance!  During the second part of the day, students were then required to get together in groups to think of how to the language and the sensors to do something fun.

The talking bit...

The morning began with Arosha outlining the broad concept of Ubiquitous computing (Wikipedia), namely, that computers can be everywhere, can contain sensors and can be embedded within the environment.  Arosha then introduced a programming problem (in the form of an etch-a-sketch game).  Everyone was taken through different parts of the Sense programming environment.  Key elements such as buttons, instruction palettes and sprites (graphics) were introduced.

Students were then directed to some key parts of the game that accepted inputs from Sense hardware.  Students were then shown, step-by-step, how to make a change to the game to modify the behaviour of an on-screen pen.  They could immediately see the effect of changes to their programs.  Further modifications included adding some conditions that enabled their game programs to respond to noises (such as clapping!)

The projects bit...

There were loads of things to take in during the first part of the morning.  There was a whole new programming environment, there was the concept that a computer can receive and work with signals from the outside world, and the idea that a program can be formed out of groups of instructions.

The second part of the day was all about being imaginative, thinking about the different kinds of inputs and outputs that the electronics allow, and trying to think of some kind of application or demonstration.  Students were assigned to small groups and were encouraged to come up with different ideas.

The group that I was assigned to came up with the idea of trying to build some kind of 'human sensor', perhaps creating an infra-red trip wire (the Sense board came with a number of different sensors and outputs - one of them being an infrared transmitter or detector).  We collectively thought about the different cables and sensors that we had at our disposal before beginning to play with what kinds of signals (or numbers) we could detect from the outside world.  We got a fair way with this task before our time was up.

Reflections

It was a fun day!  Although there was limited time to do real stuff, the tiny team that I was allied to wrote some simple program code that allowed a heat sensor to work.  The Sense board represented a connection between the magical world of code and software to the physical world, where measurements could be made.

One of the biggest challenges of the day was to convey such a lot of (often quite difficult) theory in such a short amount of time.  Arosha was charged with telling our students something about the different types of programming constructs, variables and graphics.  Although this was necessary to get to the point where we could all do some fun stuff (modify our program), the way that hardware was used with software certainly facilitated engagement and helped to focus our attention.

I liked the way the idea of ubiquitous computing was used as an introduction, but one additional might have been to emphasise the extent that we are surrounded by computers.  The moment you receive a telephone call, there is an unknown number of computers all working together to deliver your telephone call.  There's the computer in your mobile phone, there's a computer in the base station which speaks to other computers... at the other end, there is a similar situation.  Also, turning on the TV means starting up a pretty powerful computer that is performing millions of instructions a second which coverts signals from one format to another.  Their ubiquity and invisibility is astonishing.

What is also astonishing is that the fundamental principles of computer programming that are exposed by the Sense programming language is also shared amongst all these devices and systems.  In the same way we have ubiquitous computing, we also have ubiquitous code; computer software that run anywhere.

Being involved in this day took me back in time to the days when I first got my hands on a computer.   Although the form of a computer has changed immeasurably, some things have not changed.  Computers remain very particular and pedantic - they require patience.  It's also important to remember that to learning how to work with code can and should be fun.  But when you've created a world out of code and you understand how things work, working with them can be immeasurably rewarding too.