1. So Many Possibilities Dr. Vic MaconachyChris Inglis Capitol Technology University U. S. Naval Academy CAE Community Meeting, - Columbia, Maryland Accreditations and Designations Working Session November 4, 2014

2. TODAY What we know: Huge and growing demand for educated cybersecurity workers Huge and growing threats and vulnerabilities

3. What we are doing now:

4. For the Future: A. As the discipline matures a. Industry need will grow, beyond government’s b. Industry and government currently look for graduates from nationally accredited programs: Start getting cybersecurity content into those programs DisciplineNational Accrediting Body Engineering & Computer ScienceABET BusinessIACBE FinanceAACSB ITCAHIIM EducationNCATE LawABA

5. Why Accreditation? Council on Higher Education. The Value of Accreditation. Washington, D. C. 2010.

6. Multiple Paths Sustain current government “recognition” Promote inclusion of cybersecurity in criteria updates with current national accreditors. Begin studies on feasibility and validity to possible new national accreditation in cybersecurity. (Major role for industry and academia) Pursue cybersecurity in the context of “Cyber Science”

7. Sustain Government “Recognition” Continue active government leadership and resourcing Similar to 1950’s National Defense Act Still inherently government function Response to state of national cyber insecurity

8. Inclusion in Existing Accreditations Produce workforce with greater sense that designing and implementing cybersecurity is a critical part of their job. Puts cybersecurity capability directly into business, industry, government and the critical infrastructures. Example already exists

9. Begin studies on possible future interdisciplinary cybersecurity degree national accreditation. WHY: We Must keep Improving a. Truly confirm interdisciplinary nature of cybersecurity b. Study/Confirm need for generalists as Bachelor’s level c. Explore potential for “Deep Dive” into specialty areas of cybersecurity at graduate level. New NSA approach serves as a model.

10. Cyber Science 1. Scope Definition – Right now, the concept of “cyber” is being thrown around without any explicit scope definition or restrictions. We need to define what it is that we are talking about. 2. Process – Based on the IT historical exemplar that we have been loosely considering as a potential model for this effort, there are three major components of the process to get from concept to a set of accreditation criteria: a. Identification of the professional community – This is important for three key reasons. First, it is the professional community and/or constituents that define the related Body of Knowledge. Second, accreditation criteria are necessarily community driven. And third, in practice a professional society needs to “own” the accreditation criteria. b. Identification of a Body of Knowledge (BOK) for the discipline – Of course, to have a BOK, one must first define the scope of the discipline and then determine a BOK for that scope. There have been some attempts to address this, but each seems to get bogged down by the all-too broad scope of the loosely defined term cyber. Without a proper scope definition, it is impossible to canonize any existing work as appropriate for CEP. c. Development of a set of ABET program criteria –

11. Just As Technology Does not Stand Still, So Does the Expertise of Those Who Would Do us Cybernetic Harm The APTs Will Get Worse : Study where and what are those “professionals and practitioners” learning as tradecraft. Remember ! “Train the way you fight” Train & educate better than the adversary

12. What next? Education Cannot Be the Weakest Link Achieving this complete integration of cybersecurity across current academic disciplines will take time, effort, collaboration, and advocates. Until this integration is achieved, and even beyond, it is the role, responsibility and national expectation that government will lead in assuring our national cyber defense includes robust, evaluated, and recognized programs of study.

13. For Today In groups examine and report on: Seeking national accreditation Emergence of “cyber” as a science of study Relationship of national accreditation to current CAE Program We will reconvene before the end of the session and review results.

14. Group 1: Seeking national accreditation Some questions to consider: Which current national accrediting bodies should be approached? Why? How can industry & academia move this forward? Is there a priority order for approaching those bodies? Select one area of accreditation and outline some of the proposed new areas of study. ( Example: Computer science – Secure Coding )

15. Group 2: Emergence of “cyber” as a science of study Some questions to consider: It what ways is this similar to the move to establish “computer science” as a discipline of study? List potential stakeholders in this movement? What would you expect a person graduating with a degree in Cyber Science to know and be able to do?

16. Group 3: Relationship of national accreditation to current CAE Program Some questions to consider: Is providing guidance and leadership in this area still (in whole or part) inherently a government function? What elements of the CAE program can any national movements towards accreditation use/build upon? Given the current state of national cyber security what role do you see government performing with regards to program recognition / accreditation?