1. Andrew McGettrick ACM Education Council, Denver CO March, 2013 Report on Cyber Security Meeting

2. Cyber Security Meeting - Background The Education Board had been approached by the National Science Foundation (NSF) with a request to become involved in shaping and stimulating cyber security education in colleges and universities The Education Board accepted this challenge A proposal was sent to NSF for some initial studies; this has been approved A team of experts was to be assembled and asked to provide guidance on how higher education can best support the development of a highly skilled workforce in cyber security Team has been approached and (essentially) all accepted. Date was 21 st and 22 nd February 2013 and venue was Atlanta.

3. Expert Team and Attendees Expert Team Hsinchun Chen, Melissa Dark, Ron Dodge (by phone), Beth Hawthorne, Cynthia Irvine, Stephen Northcutt, Chuck Pfleeger, Fred Schneider, Parisa Tabriz, Ray Vaughn Reporter Victor Davis From NSF Victor Piotrowski, Keith Marzullo and, from Ensemble, Boots Cassel and Lois Delcambre From ACM Andrew McGettrick, John Impagliazzo, Mehran Sahami (by phone) Yan Timanovsky, Cameron Wilson Non attendees (but remain involved) Matt Bishop, Deborah Frincke, Eugene Spafford, Jane Prey (NSF)

4. Format of meeting Presentations interspersed with group discussions Discussions were based on a set of pre-prepared questions Pre-meeting documentation aimed to provide some background and draw attention to important contributions from ITICSE workshops, to views from ACM (education not training, systems emphasis, etc), to some UK developments, etc. Presentations from –Victor Piotrowski on an NSF perspective –Beth Hawthorne and Ron Dodge on the CS 2013 view –Beth Hawthorne on CCECC developments –Parisa Tabriz on aspects of cyber security within Google –Stephen Northcutt on his reflections, and –Boots Cassel and Lois Delcambre on possible contribution from and involvement of Ensemble

5. Brief Overview of Questions What does the group see as the way forward in terms of education for cyber security? Should the emphasis be on Masters provision, on baccalaureate degrees, on two year college provision, etc.? Does the expert group recommend the production of cyber security guidelines along the lines of CS 2013? Has the group got any further guidance to offer?

6. Some Conclusions - 1 The group saw the priorities to be on the provision of high quality Masters degrees. Two different kinds were mentioned –High quality technical courses building on sound first degrees in computer science, for instance; so these were the technical cyber security degrees –Courses with a business perspective –The provision of these needed to be encouraged It felt that the two year colleges were doing excellent work and should be encouraged in their endeavours It made a range of comments about baccalaureate provision (see next slide) The establishment of cyber security community was important and Ensemble could have an important role here, e.g. it could provide a focus

7. Some Conclusions - 2 The group did wish to encourage greater attention to security issues in undergraduate programs It saw CS 2013 assisting with this, e.g. by distribution security issues into many classes thereby drawing attention to the area It saw faculty having to play an important role in continually stressing the importance of security issues It felt that all students (of computing and even beyond) should have at least one course in security. Further they would welcome institutions having credentials in cyber security, and suggested the designation of security advocates within departments There was a role for undergraduate courses in cyber security, both technical and courses on cyber security for society It did not recommend the production of curricular guidelines along the lines of CS 2013 –The area was still immature –CS 2013 contained a lot of important information

8. Towards Recommendations What recommendations should be made to encourage provision of suitable Masters degree programs? What should be said to help two year colleges? What other recommendations should be made? Are there any recommendations for further work (by Ed Board / Council) or others?