Improving cybersecurity in Sweden through education
A strategy for Cybercampus Sverige
Ambition
Skills and knowledge in cybersecurity for analysis, planning and execution require education and training. Cybercampus has the ambition to strengthen and complement existing educational offerings in Sweden and to drive development of education for professionals. Cybercampus education is grounded in ongoing research, both internationally and within the organization nationally. Our education aims at transferring new results to practicable use as well as to raise competence for all needs.
This document provides a first strategy for establishing national collaboration regarding higher continuous education to meet the competence needs in the Swedish society. There are three audiences addressed: the public for their private lives and civic engagements, professionals in their work roles, and cybersecurity specialists for their specific needs.
Cybercampus serves also as a national collaboration hub for higher education in cybersecurity regarding educational resources, credit transfers, student exchanges, personnel and infrastructures.
General guidelines and rationales
The role of Cybercampus in education
The priority of Cybercampus is to strengthen and to complement existing educational programs at universities, university colleges, and higher vocational education providers to address the needs of professionals and prioritized categories of society.
Education for professionals should primarily be contract education, which has degrees of freedom not available for publicly grant-funded courses: absence of admission, no formal prerequisites, guaranteed availability, and freedom in scheduling and formats. Contract education is fully financed by the buyers and may award credits and grades.
All academic partners in Cybercampus provide free-standing courses that can be taken for free by admitted participants who meet the prerequisite qualifications. Cybercampus will provide a unified view of these courses with guidance to find matching courses for specific needs.
The strengthening of education at the partner institutions of higher education is through collaboration regarding sharing of course materials, credit transfer and other means of forming a national curriculum in cybersecurity and to provide, operate and use common infrastructures for education.
Formats follow function
Professional upskilling needs education provided in situated, online and hybrid modes to be available as formal (for credits) or informal education (with other forms of recognition). Courses need to be of different sizes and formats to allow part-time studies. Informal activities will be given in the form of self-tests, challenges, seminars, discussions and consultations, and public lectures.
Cybercampus activities shall be characterized by high standards. All activities will be designed to be efficient for meeting the intended goals, and their quality will be evaluated and assured by Cybercampus in terms of contents, delivery and fulfillment of purpose.
Outreach activities will address society at large to provide actionable skills and applicable knowledge. We intend to build interest in vocational and academic studies and careers in cybersecurity by attractive youth activities.
Educational objectives and standards
The role of Cybercampus education is to meet higher educational goals: analysis, synthesis and evaluation. All courses should have high expectations on the participants when the education is formal: The study time should correspond to awarded credits and a passing grade should not be awarded without distinction in the work performed. High teaching standards shall be maintained in subject matter, exercises, and delivery, for all formats of education. The quality will be evaluated by Cybercampus.
Cybercampus is the primary point of contact for professional education and training in cybersecurity in Sweden and will provide contracts and agreements for education for all partner organizations. Contacts with teachers and staff should be professional and responsive.
Principles for funding of education and priorities
Funding for courses and infrastructure
We refer to the educational objects provided by Cybercampus as courses; courses may be bundled or stacked into programs. The formats of courses and programs are not given a priori or limited by precedence from regular grant-funded education.
The education provided by Cybercampus and its partners are:
Cybercampus courses that follow the educational strategy and priorities of Cybercampus. They are developed, funded, maintained and promoted by campus resources. The courses are available to all partners; rights and curation of material reside with Cybercampus, if not agreed otherwise.
Partner courses are developed, funded and maintained by each partner or group of partners. The courses can be shared within and promoted by Cybercampus. Rights and curation of material reside with the partners.
The development of campus courses and inclusion of partner courses are decided and regulated by the campus management. Cybercampus monitors that the quality of the courses is of a high standard according to an agreed framework.
Infrastructures for education will be supported by Cybercampus both financially and operationally when they provide services of shared interest among two or more partners. Examples include testing facilities, learning management systems and cyber ranges. Decisions on support depend on foreseen usage and an economic plan for a proposed platform.
Priorities and discussion
Among professionals needing training, there are distinct categories.
- Non-executive decision makers: board members and investors.
- Executive and legal officers and heads of government agencies.
- Professionals working with cybersecurity in non-technical roles.
- Cybersecurity specialist in need of continuous updates and training.
- Basic awareness and skills for all employees.
In addition to professionals, Cybercampus collaborates with state agencies and civic organizations to increase the competences of all members of society to withstand cybersecurity attacks and with education providers to support students to become professionals.
We make the following prioritization timewise with respect to the resources of Cybercampus.
At first – urgency
Two prioritized activities target education for the first and last categories for the following reasons.
- We need societal and business leaders who are confident in addressing cybersecurity within their organizations. Their knowledge of cybersecurity will lead to further development of Cybercampus activities in education, innovation and research.
- All members of an organization are potential cybersecurity vulnerabilities. Workplaces must thus provide cybersecurity training to raise the lowest level in awareness and skills of everyone.
A third activity for the near-term addresses specialists and students: The establishment of a course catalog over available freestanding and contract-education partner courses and programs for the needs of specialists and non-technical professionals. The catalog is curated, and the courses are grouped into meaningful programs with tools for matching them to individual needs.
Intermediate concern – education in need of development
Non-technical work in cybersecurity requires in-depth understanding of a workplace and work practices to assess risks, commission work to mitigate them and to implement solutions. The need for training this category of professionals will be studied, and suitable educational activities will be developed.
Specialist training will develop by means of networking, online seminars and events to provide access to research and researchers at partner universities.
Outreach activities for improving competence for all members of society and civic organizations require resources and marketing of efforts beyond regular university education. Outreach will be addressed by appropriate campus events and cooperation with relevant stakeholders.
Not important or not urgent
Setting priorities also implies ranking activities low, either in importance, urgency, or both.
Focusing on education for professionals implies that Cybercampus will not address the capacity for, or volume of, grant-funded cybersecurity education in first and second cycles (for third cycle education see Cybercampus PhD Graduate School – Plan & Strategy).
It is not the concern of Cybercampus to meet individual organizations’ needs; only education that is demanded broadly and coheres with this strategy will be addressed.
Surveying the needs of cybersecurity competence in work life and society at large and to provide overviews of providers nationally and internationally is beyond the scope of the educational role of Cybercampus.
There will be expectations that cannot be met without deviating from the set strategy. The purpose of this plan is to communicate this clearly for contacts with Cybercampus regarding education. We will engage in discussion regarding any choice stated herein.
Actions for addressing the priorities and initial steps
The general structure for developing campus courses and other educational components is based on collaboration among partners and based on calls for application regarding a foreseen need. The selected partners offer the developed education under the auspices of Cybercampus; other partners may use it freely or on reasonable terms.
The ambition is to provide an extensive set of courses (in the broad sense used herein). This set needs to be managed to serve the targeted groups specified above: Courses may be organized into proposed tracks leading to specific professional roles, and guidance provided in matching courses to needs by means of AI, diagnostic tests and informative material. Credits should be transferable among all partner institutions for the common set of courses.
All courses are promoted by Cybercampus information, events and activities.
To promote novelty in education, proposals and ideas will be tested in small workshops, fictitious offerings, surveys and by other means to receive feedback; some proposals will then be developed to become available educational products. Sharing experiences and workable practices is encouraged.
Cybercampus will provide teacher exchanges, education platforms for learning management and practical training, open educational resources of any form, software and equipment as well as time for collaboration and coordination. The balance of these activities constitutes an important continual task.
Cybercampus will rely on state agencies, business associations, direct contacts and other sources of information for assessing the needs of education, such as requests from potential buyers and other parties in need of education. The compiled and prioritized list of needs, with subjects and course formats, serves as a basis for calls for developing courses and other educational material, not as official public surveys.