1. CERTS Workshop 2: Cyber Degrees and Skills Certifications
Chair: John Gilligan
Center for Internet Security (CIS)
Workshop Out brief
January 18, 2018

2. Cyber Degrees and Skills Certifications: Sub Groups
Degrees—Led by Tom Longstaff, Johns Hopkins University
Certifications—Led by James Stanger, CompTIA
Beyond Certifications and Degrees (career learning strategy)—Led by Brian Green, Learning Tree International

3. Subgroup 1: Degrees
What are knowledge gaps and what do we need in the way of cyber education?
Do degrees satisfy the knowledge gaps?
Do degrees provide what is needed to perform on jobs?
There are a range of curricula, what is needed and how do students know what they are getting?

4. Subgroup 2: Certifications
What are the existing – and possible – roles for certification-based training?
How do certifications help authoritatively teach the security skills needed today (and tomorrow)?
What are the relative strengths and weaknesses of certification-based training?
What are some key, hands-on, practical methods that we can adopt to teach people the most critical security skills?
Quite a few training frameworks exist. How should we align job standards and competencies (identified knowledge and skills) with training and certification programs?
There are a lot of certifications. Are they meeting the DoD needs?
What are the best ways to teach different generational learners (e.g., boomers, X-ers, millennials), or even different types of learners?

5. Subgroup 3: Beyond degrees and certifications
How do we ensure that individuals have appropriate knowledge and skills for a career?
What knowledge/aptitude is required beyond technical cyber skills?
How should the DoD do workforce optimization?

6. Workshop #2 Overall Observations
Current degree and certification programs are not yet fully meeting needs of DoD/US Government
Degree and certification programs are important to ensuring that we have a properly skilled cyber workforce
Degree and certification programs (suitably evolved) are the starting point, but that they must be augmented with a continuing learning component

7. Workshop #2 Co- Chair: Tom Longstaff, Johns Hopkins University
Subgroup 1: Degrees
Major Observation:
Cyber is different than most university disciplines (institutional knowledge, persistent content)
Recommendations:
Degree programs must have a “hands on” component that is based on real world environments
Degree programs must “get out of the box” and embrace other disciplines (e.g., project management, human factors) and actual domains (DoD, medical, financial, etc.)
Embrace that cyber education is a “team sport” and incorporate concepts such as team teaching, lectures from those in current jobs, etc.

8. Workshop #2 Co-Chair: James Stanger, CompTIA
Subgroup 2: Certifications
Major Observation:
Certifications are valuable (when compared with degrees)— faster, cheaper, and focused to specific skills.
The most authoritative way to ensure programs teach essential skills
Hands-on, practical application of learning pathways.
Recommendations:
Certifications should reflect application of knowledge (i.e., practical skills)
Increase emphasis on internships, laboratories, and on the job training
Evolve to a trade concept (CPA as a possible model) where certifications identify skills needed to perform real world jobs (possibly leveraging a mapping of NICE to job skills to certifications)

9. Workshop #2 Co-Chair: Brian Green, Learning Tree International
Subgroup 3: Beyond degrees and certifications
Major Observation:
Active learning and substantiated organizational adoption is the desired outcome; as formal learning only makes up 10% of skills adoption, active learning is achieved through organizational adoption and implementation (70% on the job; 20% collaboration)
Recommendations:
Organization: Better define that cyber/information support organization’s are imperative to the mission (guide career paths and training, education budgets)
People: Embrace “blended learning”—team learning, mentoring/coaching
Process: Push down authorities to ensure security professionals receive the proper sphere of control and influence
Technology: Ensure transparency of cyber skills within an organization (talent management, resource allocation, employee mobility)