University of South Wales national cyber security academy – creating cyber graduates who can ‘hit the ground running’: an innovative project based approach

ABSTRACT

Higher Education institutions understand that there is a need to embed professional skills within degree programmes. However, evidence shows that graduates, whilst having developed good theoretical knowledge, lack experience and confidence when entering the workplace. Employers view the importance of degree-related skills as only a part of the skills needed to be work ready. This opinion piece discusses an innovative approach to curriculum design in the field of cybersecurity, which uses a project-based approach with limited formal teaching to develop students’ skills, and engages them with industry from the very outset of their course. Early indications show that the course has many successes to celebrate, but that it is not without its challenges.

KEYWORDS:

• Cyber security
• project based learning
• pedagogy
• STEM
• work-ready

Higher Education institutions understand that there is a need to embed professional skills as part of their learning programmes – this can be seen through a range of initiatives designed to ‘help students make a more seamless transition to the workplace’ (Coleman, 20182018), such as Bangor University’s Employability Award experience (Bangor University, 2019), and Enhancement Themes at the University of Edinburgh (University of Edinburgh, 2019). Professional bodies recognise this need too: the BCS, for example, requires employability skills to be developed throughout the course of study in order to achieve accreditation of the learning programme (BCS, 2018). Employers, of course, value the degree the students have attained, but they also value skills such as self-sufficiency, confidence, curiosity and resilience – skills that cannot be ‘taught’ very easily. Mattis, 2018 (2018) suggests that ‘Employers generally see a graduate’s achievements related to the subject discipline as necessary but not sufficient for them to be recruited’.

Such professional skills may be embedded into programmes in a variety of ways, for example, as part of an existing module, or as a module in its own right, delivered through an immersive block, or through project-based learning activities, with or without the direct involvement of an employer. Alternatively, skills may be taught as a bolt-on to core modules. Whilst this can work well, there is a danger of being tokenistic in this approach (Knight and York, 2002) or of equipping students with too narrow an employability skill set (Moore & Morton, 2017). Embedding professional skills in a truly effective way can be challenging.

This is no less the case in the field of cybersecurity, where employees need to be creative, responsive, flexible and inventive. It is not just boys in hoodies tinkering with computers, and the National Cyber Security Centre (NCSC) is working hard to dispel this myth through initiatives such as CyberFirst. But getting STEM (Science, Technology, Education and Maths) graduates ready for employment can be difficult, because whilst they might have the theoretical and technical background, they lack the professional skills that are vital to ‘hit the ground running’. In a review commissioned by the Higher Education Funding Council for England in 2016 into the way computer science is taught in universities, Professor Shadbolt comments that they found ‘consistent evidence of employers articulating dissatisfaction with graduates’ soft or work readiness skills’ (Great Britain, Department for Business, Innovation and Skills, 2016). Commenting on a Chartered Institute of Personnel and Development policy report in 2017, Dr David Doherty says ‘It is vital we urgently improve the employability skills of all graduates, particularly those in STEM, to support young people as they move from education into the workplace’. Furthermore, given the skills gap identified in the National Cyber Security Strategy 2016–2021, the UK cannot afford to wait for skilled and capable graduates to become effective in the workforce. It is a matter of national urgency.

Aiming to address these issues, the innovative BSc in Applied Cyber Security course at the University of South Wales (USW) National Cyber Security Academy takes a hands-on approach to learning. Developed through collaboration between Welsh Government, the South Wales Cyber Cluster and industry, students work closely with industry partners, receiving significantly less formal learning than students on more traditional pathways, and developing their cyber security knowledge through industry-led projects and activities. This means that the teaching staff are confident the students are learning exactly what is needed alongside the opportunity to work collaboratively with professionals who are experts in the field. As students become more accustomed to working with industry, the complexity of projects is gradually increased, and these are then mapped across to assessment criteria, thus building up credits towards their degree. Employability skills are therefore naturally embedded as part of the projects in an authentic and effective manner. This approach is already used at FE level. The Welsh Baccalaureate, for example, contains community, enterprise and global citizenship challenges which require students to engage with people outside of their school or college environment (Welsh Joint Education Committee, 2015). Pedagogical research shows that experiential learning such as this is far more effective at developing a deeper understanding, critical thinking skills and self-sufficient learning (Dale, 1969; Kolb, 2015).

The programme ran as a pilot year in 2016–17, with 11 students from a traditional HE cyber course at USW taking a year out from their degree to work on the pilot. Of these 11, all but one are now employed within the technology industry, and most are working in a cyber-related field. Feedback from the first intake of the full degree programme which started in 2017 indicates that they value the contact with employers 'Having met with many industry experts, not only are my technical abilities constantly improving but my soft skills have also improved a considerable amount' (student, 2017 cohort), and ‘The work space is a relaxed, yet highly professional environment that encourages a positive attitude towards the extensive industry engagement’ (student, 2017 cohort). Industry partners have also expressed the benefits that the model brings. Damon Rands (of Wolfberry commented that ‘The USW Cyber Academy’s approach to learning and development has and will further transform how businesses interact with the students. As a company we have always struggled integrating graduates not because of knowledge but rather the softer skills required in their day to day to roles’ (personal communication, June 1, 2018). Projects worked on have also been highly successful, as Jem French (of JFrench Consultants notes ‘We have worked with the Academy on a number of projects over the past two years. The [students] have undertaken valuable research for us on forensic compliance as well as being instrumental in providing a forensic training package for some of our local enforcement officer customers’ (personal communication, June 1, 2018).

Of course, the model has not come without challenges. The teaching team underestimated the level of support students would initially need: speaking to CEOs, Chief Technical Officers, Directors and big name company representatives was significantly more daunting to them than was anticipated. Developing confidence and the skill to know how and what to question needed to be learned and encouraged. The staff are, in effect, doing the hand-holding that employers would usually need to do in their first year of employment.

Interest in the model is growing. There were 17 students in our first fully operational year after the pilot, and 49 students started in September 2018. Industry visits are a regular occurrence at the Academy to introduce the model to potential collaborative partners and also to showcase the format. It is a style of learning that will not suit everyone, but the interest received from employers, and the success of projects worked on so far has convinced the staff team that this creative approach is an extremely effective way to produce work-ready graduates.

Disclosure statement

No potential conflict of interest was reported by the author.