[SPARTA - network.training-awareness] Notes from the ECSO Meeting - Network.training-awareness

22 Oct 2019

Hi,

Here are some notes from the ECSO meetings. As in the previous
meetings, several documents have been presented, but most of them are
not really available (even within ECSO). I will share what I can as
soon as the documents are published on the portal.

Don't hesitate to ask me about a particular subject. Since writing
(or reading) minutes is not always that funny, I tried to send you what
I thought was the most relevant, as soon as I could.

1) Cyber Ranges

ECSO is working on a document defining what cyber ranges (CRs)
are. The document starts by stating that we usually find two different
definitions: one describing the CR as a simulation environment, the
other one describing CR as a platform. Since the latter contains the
idea that a CR is more than a technical piece of software, they prefer
it.

The document then describes different use cases and different features
a CR can have. The idea is to say that, as a car, CRs can be of very
different natures (from Formula 1 to family cars to 4x4s).

Today, a lot of organizations are looking for cyber ranges for
different goals, which can not be done by all cyber ranges. The
prurpose of the document is to shed light on a key/buzz word which is
not clear for many people. It aims at helping consumers of cyber
ranges, but also the providers/researchers to focus on special
features/use cases.

The document is still a draft, and is still supposed to be internal to
ECSO only, but we will have a new version in early November that I
will be able to share with SPARTA partners, to gather feedback.

ECHO (one of the 4 EC pilotes) has been trying to coordinate the
activity. Beyond the survey that was sent earlier, I did not see a lot
on this front from ECSO or from ECHO. The survey collected around 50
answers 3 or 4 weeks ago. It is still open, and it seems it would be
useful to send the link again (we discussed it on the WP9 list, and it
was supposed to have been sent by a Catarina, but I can not find the
message in my archives...).

2) A tool to self-assess one's cybersecurity skills

Georges Ataya presented an online tool for self-assessment and then
see the gap between one's profile and a given role from the NICE
framework.

We are supposed to get a link to this online tool in the weeks to
come. If this happens, I will share it with you.

3) Description of a minimal curriculum for "Cybersecurity for top management and
leaders"

ECSO SubWG 5.2 is working on a document to define minimum curricula,
and they started with the top management and leaders.

For now the document has not been shared among ECSO, so we only got
the first elements. As soon as I have more on this European Cyber
Security Education Framework, I will share it with you.

4) Youth4Cyber

A member from Milano presented an initiative to teach cybersecurity
(mostly awareness) to young people, through 5 modules aimed at 6-10
years old, 10-14, 14-18, 18-22 and 22-26.  They presented the outline
of the modules, which all contain 6 to 7 sessions of 45 to 2h each.

For now, they only have a 1-slide description for each session, and
are looking for funding/work force to produce the content. Since this
is an Italian initiative, they would then need to translate it.

This initiative may be of interest for T9.4?

5) Awareness campaign by SOGEI

SOGEI presented their work on awareness campaigns. It is similar to
the material I sent last month on the Awareness Workshop ECSO
organized.

6) Women4Cyber

ECSO and an SME have created a fondation to lead this initiative. They
already won an award from the nordic countries and hope to have
chapters in different countries and even regions.

7) Education Map from ENISA

Fabio Di Franco presnted the Education Map: more than 500 degrees (it
is a list of degrees, and not courses as we thought initially). The
website is still under development and should be online in November.

It will be possible with a nice UI to apply multiple filters on the
following criteria: language, country, delivery method, major topic,
deree obtained. Their goal is to get an almost exhaustive list of
degrees updated regularly.

They also have gathered information about the cost of the courses, the
number of graduated people, the maximum capacity of each course, the
very coarsed-grain repartition of ECTS (cybersecurity courses, law
courses, internship, etc.)

They have no intention to produce more detailed information; first
because of a lack of resources (Fabio seems the only person involved
in the data collection and validation); second, because they are not
confortable with a taxonomy of the different topics.

Thus, I believe that we can propose something complementary
here. Fabio seemed interested. Jan, if you believe it is useful I
introduce you to him (electronically), I can do it.

8) Report on Cyber Security Education from ENISA

This report offers a critical review of common knowledge about
cybersecurity education and HR.

It is common knowledge that there is a lack of qualified cyber
security professionals. However, maybe the shortage is dominated by a
lack of understanding. We must be more precise on the jobs needed.

ENISA spots the following issues in cyber security education:
 - lack of educators
 - poor interaction with the industry
 - little understanding of the labour market

Yet, it might be useful to recall the goals of universities, which are
today torn between teaching people with a holistic vision, and
producing market-ready people. We might be mistaken in following the
second path too strictly, since we do not know how cybersecurity jobs
will evolve (some jobs might soon become irrelevant because of some
forms of automation).

[As a teacher, I agree with the vision that universities' goal is not
only/primarily to produce market-ready people!]

ENiSA looked at 387 study programs that were "certified" by a national
body (Autstralia, France, UK, USA).

Most certifications have the following elements:
 - check that sufficient hours are put in cybersecurity
 - check the teaching body's qulaifications
 - describe the teaching modalities
 - employment outcomes
 - etc.

9) Presentation from the pilots

9.1) SPARTA

Regarding SPARTA, Edumndas and I briefly presented the documents we
(task leaders) prepared together.

Concerning the skills matrix, Edmundas was asked to invite ENISA, ECSO
and the Program Officer to the coming workshop (I sent him the
contacts I had in another mail).

I was asked to send the WP9 contacts (task leaders) to the ECSO
secreatariat. I will do this shortly.

Regarding possible collaborations, beyond the skills workshop, we
proposed to exchange documents between ECSO and pilots as much as
possible (and I believe we should try and share early when we have no
specific constraints).

9.2) CONCORDIA

They have been collecting information on short courses with possible
filters on an online map
(https://www.concordia-h2020.eu/map-courses-cyber-professionals/). Their
work tracks 60 courses collected in 3 months (31 from within Concordia
and 29 outside). It should be useful to collaborate with them for
T9.3, since we were asked by a representative from the DG Connect not
to do the same things in different EC pilots. I will study what they
proposed to see how we could bring added value.

CONCORDIA also worked on Cyber Ranges (which they would like to also
put on the map). They would like to create an ecosystem, but they are
not after a federation (the woman presenting could not explain more,
but this will be discussed at the next meeting with the relevant
person from the project). They want to share scenarios and work on an
exchange format. Since they were not present the morning for the
discussion about the document on Cyber Ranges, they will contribute to
the document as soon as they get it. Finally, they asked whether there
was interest for an open source Cyber Range. Someone answered that
this was mostly relevant for universities.

9.3) CyberSec4Europe

They quickyl described their work packages (but without slides).

10) Notes

The woman from the DG Connect asked us (pilots) to identify the
possible synergies between project and to clearly define what our
differences are (especially with regards to education and training).
In particular, we were asked not to do the same thing about Cyber
Ranges, which seems to be an especially hot topic.

Best regards,
olivier