[SPARTA - network.training-awareness] Minutes from an ECSO WG5 meeting last Wednesday - Network.training-awareness

24 Jun 2019

Dear WP9 members,

Here are some notes about an ECSO (European Cyber Security
Organisation) meeting I attended last week (Wednesday June 19th) in
Brussels. The meeting was about WG5 which deals with awareness,
skills, education and training in cybersecurity (the exact scope of
SPARTA WP9).

I am sorry to have written rather long minutes for the day, but I
believe some pointers might be useful for SPARTA WP9. I added comments
using brackets, beyond what was discussed on Wednesday.

I am at your disposal for any comments and I plan to share the
documents I will be allowed to with you as soon as I get them.

Best regards,
olivier

= CyberRange =

The first item discussed was about cyber ranges, which, as you know,
are being developed in many institutions and training centers.

== CR14 : NATO Cyber Range (A. Rebane - Estonia Ministry of Defence) ==

A. Rebane presented the CR14, facilities located in the center of
Tallin, consisting of 10 classrooms.

Estonia has been organizing LockShield, a massive annual exercise (24
teams across different countries, of 15 people each) for several years.

With their infrastructure, they mainly target governments, but also
industry and academia. In particular, they opened a new program this
year called Open Cyber Range for SMEs and startups

Later this year, they will organize an exercise to show how to
federate cyber ranges across countries.

One aof the four pilot, ECHO, has a package on federation of
cyberranges. ECSO WG5 has been invited by ECHO on July 12th (in
Brussels) to a meeting on the topic. [At this time, I don't plan to
attend].

== Draft paper on definition of cyber ranges ==

ECSO plans to produce a paper on cyber ranges. The table of contents
is a WIP, but it should be available for comments soon (in July).

The goal is a 10 to 20-page document with definitions, guidelines on
how to mount a cyber range, business models and legal/ethical aspects.

== Cyber range workshops and collaboration with EC Pilots ==

There is work in progress with the EDA (European Defence Agency) about
cyberrange federation.

As a side note, ECSO representatives told us they will act as a
coordinator between the 4 pilots and the commission, especially when
it comes to trainings/cyberranges.

There was an argument about the word defence, since the ECSO Board of
Directors firmly said that they should not work on military/offensive
aspects of cyberranges. This may change in the future and we might be
able to work with industrial in the defense industry in a more open
fashion.

To be able to work more easily, we will use the paper to include a
glossary in the draft paper.

= Education and training activities (Parish Rathod) =

A recent study tells that 142,000 professionals are missing in Europe
(350,000 in 2022), 63% of the businesses questionned need more staff,
and 59% of the companies are currently considered at risk.

We are thus facing a challenge to get the competent workforce. A lot
of efforts has already benn put, but they are scattered.

In Fance, we have trainings, but we need them to more attractive (a
recent initiative was discussed at ECSO general assembly concerning
10-18-year-old students)

In Italy, they have a 1-year training but it might be too long, since
we need people now.

CSI (Cyber Security Initiative) in Ireland aims at teaching hygiene
for small businesses (since it is difficult to have them in
trainings). They are looking at webinars. Moreover, leadership people
are not always technical people and they are lost in the
lingo. Academia has been asked to deliver trainings with industry
content (part-time trainings) and they mostly use online resources.

Italy also has cyberchallenge.it for students (16-23 years old).

The goal of the presentation is to push for an initiative, Towards
European Cybersecurity Professional Education and Training Framework.

Among the questions asked, we wondered how we could homogenize ECTS,
skills frameworks, etc. between countries?  For skills, there is the
European Competence Framework... One big question is how can we
compare different trainings (e.g. masters degree) in differente
countries?

[Of interest for WP9 is a white paper on Gaps in Education &
Professional training
(https://www.ecs-org.eu/documents/publications/5bf7e01bf3ed0.pdf)]

There is currently existing certifications
 - CISSP (see below)
 - Certified Ethical Hacker
 - Pentest and Security Analysis certificates
 - Some Finnish certifications?
 - CompTIA
[I need to get the slides to be more precise about these certifications,
but at the time of writing, I did not receive them yet.]

The presentation also presented a paper on online cybersecurity
education and professional training [There again, I did not have time
to take the reference, but I will ammend the minutes as soon as
possible].

== ENISA / education mapping ==

ENISA is starting a new task on training and education database. ECSO
agreed to collaborate on this with ENISA. It would certainly be useful
that the four EC pilots also participate. There is some information
available at
https://www.enisa.europa.eu/topics/cybersecurity-education/nis-in-education…

[This might be useful for SPARTA T9.2 and perhaps for T9.3. We should
try and be consistent with the ENISA templates if possible?]

= EHR4CYBER =

The afternoon was dedicated to the EHR4CYBER Workshop. The EHR4CYBER
task force aims at producing a body of knowledge and skills to enable
setting up education and training programs, and to verify skills in
programs.

The related initiatives are :
 - US NICE Framework
 - Australian approach
 - Cybok
 - CEN e-CF
(http://ecompetences.eu/wp-content/uploads/2014/02/European-e-Competence-Fra…)
 - ENISA work on education mapping

[These documents might be of interest for T9.1, but also T9.2 and T9.3]

To define a minimum skill set for cybersecurity, European Digital
Competence Framework (developed by GRC)

The goal could be to define EU-wide minimum curricula for
cybersecurity with 3 different levels:
 - secondary vocational
 - bachelor
 - master
 => but we should still leave room for the different specialisations
    of universities and training centers

== Word from the pilots ==

ECHO, Sparta and Concordia were represented at the meeting. We were
asked to present our position.

For Sparta, I presented the different work packages and a high-level
description of our goals in WP9. One immediate feed back was an
invitation to not neglect existing documents (from ECSO, ENISA and
other reports).

Concerning education and training, Concordia is working on CyberRanges
and aims at building a European ecosystem for cybersecurity. Here are
some Their target is not only technical people. Currently, they have a
map with the courses handled by Concordians. They are also trying to
gather what is needed on the market, to then develop micro masters
aimed at the professionals. One of Concordia partners is TUV, a
certification body. Finally, they plan to teach the teachers.

Regarding ECHO, they only focus on 4 sectors. Their planned
methodology is the following:
 - Work from what we want to have, and then build
 - Focus on hands-on training (cyberranges)
 - Work on the methodology of training
 - Mix F2F training and online courses

A recurring question during the workshop was to know how ECSO can work
with the pilots to avoid doing the same tasks four times. ECSO would
like to assume the role of coordinator layer between the pilots and
the commission. We should especially focus on what ECSO can
disseminate.

[This is why I proposed we ask the coordination level of SPARTA how we
will work with the other pilots on education and training.]

The four pilots were also asked to produce a short document to
describes the tasks and the deliverables to share with ECSO and the
other pilots. [This was discussed on the WP9 Steering Committee on
Friday June 24th]

[For T9.1], we were invited to try and not reinvent the wheel. That is
why it might be useful to consider existing frameworks such as e-CF.

== Word from (ISC)2 ==

(ISC)2 was represented by Yves Le Roux, who presented their
certifications [which should be an input for T9.3 of SPARTA I guess]:
 - SSCP is the basis
 - CISSP is the well known certification
 - 3 specializations (Engineering, Architecture and Management) on
   top of CISSP
 - a Healthcare-specific certification
 - CCSP : a cloud certification with a lot of legal stuff (it was
   done with the Cloud Security Alliance, CSA)

For CISSP, 5 years of experience are required, but it is possible to
have the qualification and work then to gain the experience needed.

(ISC)2 also presented their Charitable Arm Center for Cyber Safety and
Education, aimed at teaching the teachers (the material is based on
the commic strip Garfield)

Finally, there exists a mapping between (ISC)2 certifications and the
NICE framework. We should be able to get it when (ISC)2 shares it with
ECSO.

== Miscellaneous and wrap-up ==

On a related note, the UK has launched its National Cybersecurty
Center which delivers the CCP, to certify people on 4 different job
titles.

Finally, there seems to be an interesting document to read: ENISA
Stock Taking, which describes the gap between trainings and needs from
the industry. It is available here:
https://www.enisa.europa.eu/publications/stock-taking-of-information-securi…

The next deliverable for ECSO WG5 is a standard EU-wide minimum
curriculum for information/cyber security on different EQF
levels. This curriculum will however allow universities and training
centers to keep their specializations.