CERTS Workshop 2: Cyber Degrees and Skills Certifications Chair: John Gilligan Center for Internet Security (CIS) Workshop Out brief January 18, 2018

Cyber Degrees and Skills Certifications: Sub Groups Degrees—Led by Tom Longstaff, Johns Hopkins University Certifications—Led by James Stanger, CompTIA Beyond Certifications and Degrees (career learning strategy)—Led by Brian Green, Learning Tree International

Subgroup 1: Degrees What are knowledge gaps and what do we need in the way of cyber education? Do degrees satisfy the knowledge gaps? Do degrees provide what is needed to perform on jobs? There are a range of curricula, what is needed and how do students know what they are getting?

Subgroup 2: Certifications What are the existing – and possible – roles for certification-based training? How do certifications help authoritatively teach the security skills needed today (and tomorrow)? What are the relative strengths and weaknesses of certification-based training? What are some key, hands-on, practical methods that we can adopt to teach people the most critical security skills? Quite a few training frameworks exist. How should we align job standards and competencies (identified knowledge and skills) with training and certification programs? There are a lot of certifications. Are they meeting the DoD needs? What are the best ways to teach different generational learners (e.g., boomers, X-ers, millennials), or even different types of learners?

Subgroup 3: Beyond degrees and certifications How do we ensure that individuals have appropriate knowledge and skills for a career? What knowledge/aptitude is required beyond technical cyber skills? How should the DoD do workforce optimization?

Workshop #2 Overall Observations Current degree and certification programs are not yet fully meeting needs of DoD/US Government Degree and certification programs are important to ensuring that we have a properly skilled cyber workforce Degree and certification programs (suitably evolved) are the starting point, but that they must be augmented with a continuing learning component

Workshop #2 Co- Chair: Tom Longstaff, Johns Hopkins University Subgroup 1: Degrees Major Observation: Cyber is different than most university disciplines (institutional knowledge, persistent content) Recommendations: Degree programs must have a “hands on” component that is based on real world environments Degree programs must “get out of the box” and embrace other disciplines (e.g., project management, human factors) and actual domains (DoD, medical, financial, etc.) Embrace that cyber education is a “team sport” and incorporate concepts such as team teaching, lectures from those in current jobs, etc.

Workshop #2 Co-Chair: James Stanger, CompTIA Subgroup 2: Certifications Major Observation: Certifications are valuable (when compared with degrees)— faster, cheaper, and focused to specific skills. The most authoritative way to ensure programs teach essential skills Hands-on, practical application of learning pathways. Recommendations: Certifications should reflect application of knowledge (i.e., practical skills) Increase emphasis on internships, laboratories, and on the job training Evolve to a trade concept (CPA as a possible model) where certifications identify skills needed to perform real world jobs (possibly leveraging a mapping of NICE to job skills to certifications)

Workshop #2 Co-Chair: Brian Green, Learning Tree International Subgroup 3: Beyond degrees and certifications Major Observation: Active learning and substantiated organizational adoption is the desired outcome; as formal learning only makes up 10% of skills adoption, active learning is achieved through organizational adoption and implementation (70% on the job; 20% collaboration) Recommendations: Organization: Better define that cyber/information support organization’s are imperative to the mission (guide career paths and training, education budgets) People: Embrace “blended learning”—team learning, mentoring/coaching Process: Push down authorities to ensure security professionals receive the proper sphere of control and influence Technology: Ensure transparency of cyber skills within an organization (talent management, resource allocation, employee mobility)