How the existence of a Cybersecurity Skills Certification Framework will help the market and what if the connection to the European Cybersecurity Skills Framework?

One of the main directions of the work performed by the CONCORDIA project is cybersecurity related education and training. Other posts such as [[1], [2], [3]] have already explained the process and the different activities already performed by the project on this subject. The purpose of this blog is to present the final results of the activities related to the certification of skills.

In the CONCORDIA Methodology for the creation and deployment of new courses and/or teaching materials for cybersecurity professionals the value and importance of certification of skills has been underlined and described as complimentary and essential to the education process. At the same time, various studies[4],[5] show that skills certifications are important for professionals and organizations alike and as actions to help address the cybersecurity skills gap.

One of the problems brought forth by the feasibility study conducted by the project, was the great number of skills certifications, some of them having almost the same name but offering little assistance in comparing or identifying if they fit the needs and career ambitions of the individuals. To tackle this issue, the project team decided

1. to implement a cybersecurity skills certification scheme and pilot it, in order to gather best practices and
2. to present the extracted best practices in a proposal for a Cybersecurity Skills Certification Framework.

For the Role of the Cybersecurity Consultant, the project has already implemented over the last 2 years three iterations of the exams process and is currently preparing for organizing the fourth one. The feedback collected from the participants and the lessons learned helped us finalizing the C³ by CONCORDIA Certification Scheme [link] and fed further the more generic Skills Certification Framework.

The Cybersecurity Skills Certification Framework describes (at a higher level) the adjustments that should be made on an ISO 17024 compliant certification process and resulting certification schemes, to better fit the specificities of cybersecurity skills domain. Specifically, the document includes a number of requirements and information split into the basic certification principles:

• Impartiality (8 requirements),
• Responsiveness (5 requirements),
• Confidentiality (8 requirements),
• Responsibility (5 requirements) and
• Competence (18 requirements).

it should be pointed out that one of the first requirements of the proposed Cybersecurity Skills Certification Framework, is the mandate to design Certification Schemes on the basis of established and recognized Role Profiles, with explicit reference to the ones proposed by ENISA[6].

By adopting a common European Cybersecurity Skills Certification Framework, different organizations (certification bodies) realizing Cybersecurity Skills Certification Schemes will share a common baseline of processes and activities, thus producing comparable certificates in the market.

In this way professionals will have a clear understanding on which skills and knowledge are being validated through each certification scheme and to which Role profile these correspond to. The same value can be also identified by HR professionals who need to hire individuals that possess the appropriate skills and knowledge to perform the allocated tasks effectively.

The Cybersecurity Skills Certification Framework can be found at https://www.concordia-h2020.eu/wp-content/uploads/2022/12/CONCORDIA_Certification_Framework_1.0.pdf and we welcome any comments at argyro.chatzopoulou@tuv.at.

[1] https://www.concordia-h2020.eu/wp-content/uploads/2020/06/CONCORDIA-SkillsFeasibilityStudy-forpublication.pdf

[2] https://www.concordia-h2020.eu/wp-content/uploads/2020/07/CONCORDIAWorkshoponEducation2020-forpublication.pdf

[3] https://www.concordia-h2020.eu/wp-content/uploads/2021/07/Pilot_Course_BCSC_Report_Final.pdf

[4] https://www.isaca.org/go/state-of-cybersecurity-2022

[5] https://www.isc2.org/Research/Workforce-Study

[6] https://www.enisa.europa.eu/topics/cybersecurity-education/european-cybersecurity-skills-framework/ecsf-profiles-v-0-5-draft-release.pdf

The post A proposal for a Cybersecurity Skills Certification Framework appeared first on CONCORDIA.

Edge computing has been one of the key digital transformations in the last year and it is reshaping health care by bringing medicine into a new direction. Bringing big data processing and storage closer to the source helps to better analyse and collect data as well as improving the accuracy and speed of diagnoses. Robust security and advanced virtualization technologies are crucial in these systems since they must ensure that critical operations are executed reliably and deterministically. Furthermore,   sensitive patient data must also be protected from leakage or exposure.

Medical applications and devices belong to most sensitive groups of the systems. Running these applications in the cloud is perceived as unsafe due to the sensitivity of patient data.

Processing data at the Edge (at devices or networks in the clinic, hospital, or even directly on patient devices outside of clinical settings) can successfully reduce the amount of sensitive data transmitted between patient and healthcare provider. Edge processing can also reduce the cost and strain on bandwidth by limiting the amount of data that is sent to healthcare providers. All this enables healthcare providers to diagnose and to begin treating patients earlier and faster, increasing the treatment success and patient satisfaction rate

Edge helps with transmission times

Latest advancements in technology allow the generation of massive quantities of data. The need for transmitting this data faster and more secure is growing in order to prevent access to malicious individuals.

Edge computing has potential to improve data transmission times based on the speed of fifth generation (5G) communication which transmits data with low latency and high bandwidth. This would significantly help obtaining a quicker and faster respond from healthcare entities. Reducing the distance of data transmission can lower the chances for cybercriminals to intercept it. Therefore, Edge computing can pave the way for the highest levels of medical security and regularity compliance.

Safe processing of medical data with Edge

Processing of digitalized medical data is increasing together with the risk of cyberattacks and  data breaches. Different technical solutions are needed in this regards in order to ensure an adequate protection of medical data. One of such solutions, proposed by ENISA, is pseudonymization.

Big data, AI and Edge processing are becoming major players in health care. The future of medical technology is bringing faster and more accurate diagnosis and treatment by paramedics. Furthermore, Edge processing can assist doctors in their tasks or even take over some of them . For this reason, it critical to address all potential cybersecurity attacks and work further on patient data protection.

Together with universities and industrial partners, we are focusing on building a strong competence network to bring benefits that will promote Europe’s digital sovereignty, boost security and improve quality of life. 

(By Anja Majstorovic, eesy-innovation GmbH)

The post New shape of health care with Edge devices appeared first on CONCORDIA.

Difficult to understand the trainings big picture

The needs to protect oneself against threats to information and operations, to maintain the cybersecurity posture of an organization and to increase the resilience against such threats, are still urgently felt by all interested parties. A core component to fulfilling these needs, is the existence of cyber – competent professionals. And competence regarding cybersecurity is not only needed for the dedicated professionals (external or internal to an organization) but also for all staff members of an organization even if they are not directly involved in cybersecurity processes and activities.

When it comes to the cybersecurity professionals, various publications still report a cybersecurity skills gap, flagging that the top 3 competencies missing or not enough covered by the existing professionals varies from one year to another [1]. On the other hand, a considerable amount of Cybersecurity related courses and trainings are offered by various European and international organisations. A simple search on the internet will reveal many courses that relate to the cybersecurity domain, without providing a clear picture on the competencies offered or how they could relate to a specific role. To add to this confusion, there are training courses that seem to address one specific role (e.g. CISO), have similar titles but have different curriculum.  

Hence, in several cases, the information provided is confusing the trainee on what and how they should perceive cybersecurity concepts, as well as how to use them to cover their professional needs. Besides, the courses for professionals are promoted on a variety of platforms and they are difficult to be compared with respect to the competencies covered and role profile addressed. This makes difficult for an individual to build a clear career path and identify development opportunities.

The CONCORDIA map of courses for cybersecurity professionals

In an attempt to address these challenges, we have built the CONCORDIA map of courses and trainings for cybersecurity professionals [2]. The map is displaying structured information on existing European offer for short courses/trainings and provides different filters as to help match easier the specific need for skills development with the offer.

One can choose to sort the courses based on the cybersecurity level addressed (Device-, Network-, Software/ System, Data/ Application-, User-Centric), or on the relevance to an industry sector (eg. Telecom, Financial, Transport e-mobility, e-Health or Defence), but also on the format (face-to-face, online, blended), and the timing of the course/training.

Missing a key ingredient – Solution enabled by ECSF

Although we are offering on the CONCORDIA map a large plethora of filters to help the users identify easier the course(s) of interest, the database lacks a key ingredient – the links to role profiles that each of the courses are addressing through the knowledge and skills covered. The e‑CF European Competence Framework for ICT professionals available at the time of building the map defines 30 role profiles and 40 associated competencies but they are difficult to be associated to the specificities of the cybersecurity domain.

This was a challenge of the cybersecurity education ecosystem we flagged already two years ago and captured in the CONCORDIA Roadmap for Education [3] under the heading C5: Heterogeneity of competencies related terminology. This lack of a cross‑domain and cross‑industry agreed terminology related to the cybersecurity skills necessary for a specific role makes it difficult for companies to fill in open positions. They find it hard to match the recruitment criteria with the studies and the qualifications listed in the CVs of the applicants because of the use of non‑standard terminology. Individuals, in turn, cannot easily identify the skills they need to possess or develop to match market demand. And, finally, course providers have difficulties in designing curricula that answer to the market needs.

As part of the CONCORDIA roadmap, we pledged for one single platform hosting all the existing Cybersecurity related programs (university level and Ph.D. programs, short courses and trainings for professionals).

The platform should consider collecting the content by using categories based on a standard terminology (specific skills framework included). The categories would be further used as filters for different enquires of the courses database. The 12 role profiles defined in the current version of the European Cybersecurity Skills Framework[1] (ECSF) seem to be a natural solution.

The benefit for stakeholders

The adoption of a standard lexicon such as the one proposed by the ESCF, including cybersecurity role profiles will help companies identifying the right talent for the jobs as well as education providers to better shape their curriculum to match the cyber workforce needs. By applying the same terminology and using an EU wide skills framework to job descriptions, course description and role profile would help individuals selecting the right education modules to support their career path, and filtering better the jobs openings according to their competence and level of expertise. Finally, the policy makers would be able to collect more structured data at country/regional level in support of future policy development and have a solid basis when coordinating with external countries towards addressing global scale cyber security challenges.

Towards an integrated platform for skills

Building on the CONCORDIA database of courses and trainings for cybersecurity professionals, the REWIRE project [5] attempts to make further steps towards integrating the relevant cybersecurity skills related content. The REWIRE CyberABILITY platform – currently in design phase – will provide up-to-date information regarding the job market, competences, training courses, certification schemes and a career roadmap.

References

[1] E.g. The Current (2022) State of the Cybersecurity Workforce ISACA Research, indicates that respondents are looking for a range of skills in candidates, noting the top skills gaps they see in today’s cybersecurity professionals are soft skills (54 percent), cloud computing (52 percent) and security controls (34 percent). Soft skills also top the list of skills gaps among recent graduates, at 66 percent. The 2021 report of the same research activity indicated that the top three skills gaps they see in candidates are soft skills (56 percent), security controls (36 percent) and software development (33 percent). https://www.isaca.org/why-isaca/about-us/newsroom/press-releases/2022/state-of-the-cybersecurity-workforce-new-isaca-research-shows-retention-difficulties-in-years

[2] https://www.concordia-h2020.eu/map-courses-cyber-professionals/

[3] https://www.concordia-h2020.eu/wp-content/uploads/2021/10/roadmaps-05-Education.pdf

[4] https://www.enisa.europa.eu/topics/cybersecurity-education/european-cybersecurity-skills-framework

[5] https://rewireproject.eu/

(By Felicia Cutas, EIT Digital)

The post Towards an integrated platform for skills in cyber built on the European Cybersecurity Skills Framework appeared first on CONCORDIA.

The C³ by CONCORDIA Certification and the preparatory Course are back in 2022!

What do we have for you?

This year we will open again the C³ by CONCORDIA Certification exams and run the preparatory course. And we will, again, offer this for free! But we have a limited number of places available.

The Course “Becoming a Cybersecurity Consultant” (support in preparing for taking the C³ by CONCORDIA Certification exam) has the following structure:

• Online module – covering theoretical concepts linked to threats, technology, economics of cybersecurity; the lessons are hosted on the COURSERA platform
  • Prerequisites: fill in the registration FORM
• Webinar over 3 half days containing a set of hands-on exercises ran on KYPO cyber-range platform
  • Prerequisite: The participation to the webinar is conditioned by the finalization of the online module of the course; an overall pass mark of the quizzes of 70% is required

The C³ by CONCORDIA Certification could be briefly described as follows:

To be accepted to sit the exam, the candidate would need to fulfill the following prerequisites:

• 3 years of practical experience in the subject of Cybersecurity (Including but not limited to Cybersecurity Consulting, Cybersecurity Management etc) or a relevant Post -graduate Academic Degree
• Basic knowledge of data structures and algorithmic principles, regular expressions, database principles, shell scripting, networking principles, tools and architectures, operating systems basics, security controls, mechanisms and practice and risk management theories and methods is required.

Structure of the Certification exam

• Theoretical exam hosted on ISOGRAD platform
  • Prerequisites: being accepted to sit the exam after providing the proof of fulfilling the prerequisites via FORM
  • Structure of the exam – 50 questions of different difficulty level, addressing 3 areas: threats, technology, economics and business; pass mark 70%, with at least 60% per individual areas
• Practical exam hosted on KYPO cyber-range platform
  • Prerequisite – only participants who managed to pass the theoretical exam will be accepted to take the practical exam
  • structure of the exam – Practical Exercises implemented through the KYPO Cyber Range Platform; pass mark 80%

The certificate will be issued via the EduCTX blockchain based platform after the candidate successfully passed both exams and signed the Declaration of Honor. More details on the Certification scheme can be found on the dedicated page.

Whom is it for?

The Certification is addressed mainly to European cybersecurity professionals, cybersecurity middle managers and freelancers looking into having specific knowledge and skills validated via a certificate. For an overview of the knowledge and skills we consider a Cybersecurity Consultant should have, I invite you to check the specific page [link].

The candidates to enter the C³ by CONCORDIA Certification are strongly encouraged to follow first the dedicated course “Becoming a Cybersecurity Consultant” whose first edition is presented here. To take full advantage of the content covered and be able to solve the short quizzes included in the course, the participants should have basic knowledge of data structures and algorithmic principles, regular expressions, database principles, shell scripting, networking principles, tools and architectures, operating systems basics, security controls, mechanisms and practice and risk management theories and methods.

When would this happen?

The next dates and the process to follow are presented in the timeline below.

The story behind

It’s been quite a venture to setup and pilot the Cybersecurity Consultant Certification scheme and the associated Course but here we are.

• One of the first activities of the CONCORDIA project was an Assessment of the EU’s educational portfolio for cybersecurity professionals including the CONCORDIA ones [link]. This activity revealed heterogeneity both on the cybersecurity jobs market and on the cybersecurity courses offer, and underlined the importance of certifications in the area. The conclusion regarding heterogeneity was further expanded to certification after we concluded a study on existing certification schemes [link].
• The above led to the design of the first version of the Cybersecurity Skills Certification Framework of CONCORDIA, with the aim to become a common reference for Cybersecurity Skills Certification Schemes. Moreover, to put theory into practice and evaluate the effectiveness and applicability of the proposed framework, we decided to pilot the entire process for a specific role.
• Since the Cybersecurity Consultant role profile (medium level) was not specifically covered by any of the existing certification schemes. We took this opportunity (to be read “challenge”) within CONCORDIA and started working on it. We developed the relevant certification scheme in alignment with the Cybersecurity Skills Certification Framework of CONCORDIA, we created the content for the certification theoretical and practical exams, and we put together a set of lessons and practical exercises to help candidates acquire the relevant competencies before taking the certification exams (if they so desired).
• Last year we piloted both the Course and the Certification, asked for feedback from the participants, improved the content and ran it again. So far, more than 94 individuals took the course and 17 of them made it to the Certification exam.

Would you dare to take this challenge?

The participation to the next Course and Certification are still free but we have a limited number of places. So, hurry up!
Register to the next Certification exam [link]
Register to the next preparatory Course [link]

(By Felicia Cutas (EIT Digital))

The post Would you like to be certified as a cybersecurity consultant? appeared first on CONCORDIA.

It is news to no one that everyday organizations experience incidents related to Cybersecurity. Cyber threats follow an increasing progression for the last five years. What can organizations do in order to be better prepared and more resilient?

Having identified this rising threat, in the last years organizations have started investing in creating more cyber-resilient structures and operation. A major part in these activities is played by people. Each year more people are employed in the area of Cybersecurity. This statement is verified by various studies showing that although there is still a lack in Cybersecurity talent within the organizations, this deficiency is not as bad as was recorded the previous years. On the other hand, although the need is great, hiring managers state that they have low confidence on the competencies of the candidates especially in the positions where practical skills and abilities are needed.

The CONCORDIA team identified this issue and decided to address it by developing a Cybersecurity Skills Certification Framework (to be published soon). This framework, based on international best practices and standards, will validate the theoretical and practical Cybersecurity knowledge, skills and abilities needed by the organizations per sector to effectively fulfil the relevant Roles. The implementation of the Framework (through different specific certification schemes) will allow

• organizations to gain the confidence needed regarding the competence of a professional prior to hiring
• organizations to independently verify – through the use of e.g. blockchain technology- the claimed credentials of the professionals
• professionals to produce undisputable, objective and recognized evidence of their competence
• professionals to test themselves in a controlled, practical and simulated environment

Whether small or large, public or private, operating in a critical sector or not, organizations need to fortify themselves against Cyber threats also by investing professionals with proven hands-on and practical skills. The CONCORDIA team envisions to pilot the Cybersecurity Skills Certification Framework through specific Cybersecurity Skills Certification Schemes currently missing from the market based on the conclusions of our Feasibility study on Skills Certification Schemes [link]. The first such Scheme is the one of the Cybersecurity Consultant. The CONCORDIA team has already started this effort by defining the Role Profile of the Cybersecurity Consultant – A role profile contains the competencies or/and skills, knowledge, abilities and tasks that the role should have in order to be effective, and is the basis for any Skills Certification Scheme. The CONCORDIA Skills Certification scheme for Cybersecurity Consultant will be doubled by CONCORDIA course specifically designed to helping participants prepare in view of passing the exams.

More information on the Subject of Cybersecurity Skills Certification and the Cybersecurity Consultant Role Profile creation can be found by following the links below:

• https://www.concordia-h2020.eu/wp-content/uploads/2020/06/CONCORDIA-SkillsFeasibilityStudy-forpublication.pdf
• https://www.concordia-h2020.eu/wp-content/uploads/2020/07/CONCORDIAWorkshoponEducation2020-forpublication.pdf

Follow our social media channels or register to our newsletter to be kept updated with the launch of the pilot course and the associated pilot certification scheme!

(By Iro Chatzopoulou,TÜV AUSTRIA)

The post Preparing to fight Cyber Threats – The Human aspect appeared first on CONCORDIA.

Be part of the European Education Ecosystem for Cybersecurity. Are you a professional providing cybersecurity related services, a Chief Technology Officer, an HR representative, a mid-manager, or a cybersecurity professional working in a company? Get involved in shaping the certification framework for cybersecurity skills and in developing relevant courses for cybersecurity consultants or alike.

The issues at stake

Nowadays cybersecurity is not only a trending issue but also a very dynamic one. Under the light of many cybersecurity attacks that have caused havoc at European and International level and produced considerable damages, it became evident that cybersecurity shifted from an IT matter only towards a business risk which needs to be continuously monitored and properly addressed.

Several studies show in colorful terms that there is a shortage of related competences in existing personnel within the organizations while at the same time, there is an increasing difficulty to find competent professionals on the market. At the same time, there are a plethora of organizations providing courses and in some cases Certifications of skills in the subject of cybersecurity.

The assessment of the EU cybersecurity educational portfolio for professionals and of the CONCORDIA one we ran in 2019 revealed heterogeneity both on the cybersecurity jobs market and on the cybersecurity courses offer. The courses are various but not necessarily industry specific, especially the ones addressed to middle managers and executives, the main audience CONCORDIA is targeting. Besides, they cover mainly academic and technical knowledge and to a lesser extent business aspects and hands-on components for which the industry actors are interested in. The issue at hand becomes even more complex since there is no Cybersecurity Skills Framework in the European Union. Hence the existing courses lack a structured approach in their design against a competence framework and a career path thus making difficult the effort of the individuals to choose the right course to cover their professional needs.

What we propose for year 2020

First of all, we are collecting information on existing courses for cybersecurity professionals, mid-managers and executives interested in learning about cybersecurity and plot them on the CONCORDIA map of courses. The information is structured around the specific cybersecurity levels, industry, target audience, content and format type.

Then we will build on the expertise of EIT Digital Professional School and put in place an effective methodology to develop courses for professionals by starting from the needs and challenges of a specific industry. This approach would ensure that the competences developed, and the skills acquired via the courses would be applicable immediately.

We will go further by piloting the methodology developed via the creation of new courses for professionals for a selected profile and specific industries. When doing so we will ensure to align the learning objectives to the cybersecurity skills framework currently under development within CONCORDIA.

But above all, we are looking for further getting engaged with you as to build together the European Education Ecosystem for Cybersecurity.

Get involved!

Be part of the European Education Ecosystem for Cybersecurity. Let us know your opinion about:

• The certification of Cybersecurity skills
• The development of new courses for Cybersecurity professionals by filling-in this quick 5 min. survey: https://ec.europa.eu/eusurvey/runner/ConcordiaCertificationCourses

And fill free to forward the survey to other colleagues within your organisation (CTO, HR, mid-managers, cybersecurity professionals, …). The more views from different angles we get on the topic, the better our work will address the needs of the ecosystem.

Check the CONCORDIA Service Catalogue for more options of getting informed of the EU Cybersecurity landscape and/or getting involved by engaging with CONCORDIA partners

(By Felicia Cutas, EIT Digital)

The post Let’s talk about Education in cyber appeared first on CONCORDIA.