The cyber security skills crisis is a key policy issue in many countries, and governments look in part to universities to address it. This paper addresses one narrow question to see how it speaks to the broader challenges: are current Master of Cyber Security programs in Australia preparing students for the workforce? This research flags a new direction for further, much needed research rather than claim to be an exhaustive analysis.
The paper outlines cyber security education as being multi-faceted and multidisciplinary and then identifies current gaps in university-based offerings. It pursues several lines of investigation. The first approach is to scope the field. To do that, and following a brief literature review, the paper proposes a new multi-level matrix, the Cyberspace Education Framework. This framework allows a high-level comprehensive view of cyberspace education.
The paper then investigates current generalist master’s programs in Australia and the proposition that mission-specific and purpose-driven courses may better prepare students and address the skills crisis than generalist degrees. A survey of cyber security master’s students at one university campus and subsequent discussions with other stakeholders revealed a contrast between expectations. The paper then compares the current educational learning outcomes of Master’s programs in Australia with the knowledge, skills and abilities (KSA) set out in the U.S. Government’s work standards document as a proxy for what would be required for five cyber work roles of high national importance to Australia. It reveals only modest alignment (around 50 per cent) between the several Australian Master’s degrees reviewed and U.S. benchmark KSAs, compared with a 97 per cent alignment with them for a specialised Master’s degree at University College Dublin. UNSW Canberra does score a 77 per cent alignment for one U.S. identified role with one of its more specialised degrees, and Edith Cowan scores a 67 per cent alignment in the same role (cyber defence incident investigator).
The paper concludes that the requirement for purpose-driven and mission-specific cyber security education is increasing and recommends that this become a focus of new initiatives in cyber security education. Universities have an obligation to work with industry and government to ensure that cyber security programs are more directly preparing students for the workforce. That will give Australia more chance to become cyber resilient and an opportunity to become a global leader in cyber security education.