# Collaborative Cybersecurity Learning: Establishing Educator and Learner Expectations and Requirements

Steven Furnell, Gregor Langner, Teemu Tokola, Jerry Andriessen, Gerald

Quirchmayr, Carmela Luciano

► To cite this version:

Steven Furnell, Gregor Langner, Teemu Tokola, Jerry Andriessen, Gerald Quirchmayr, et al. Collaborative Cybersecurity Learning: Establishing Educator and Learner Expectations and Requirements. 15th IFIP World Conference on Information Security Education (WISE), Jun 2022, Copenhagen, Denmark. pp.46-59, 10.1007/978-3-031-08172-9_4. hal-05311501

HAL Id: hal-05311501

https://inria.hal.science/hal-05311501v1

Submitted on 13 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Collaborative Cybersecurity Learning:
Establishing Educator and Learner
Expectations and Requirements

Steven Furnell<fnref n="1" />(✉), Gregor Langner<fnref n="2" />(✉), Teemu Tokola<fnref n="3" />(✉), Jerry Andriessen<fnref n="4" />(✉), Gerald Quirchmayr<fnref n="5" />(✉), and Carmela Luciano<fnref n="6" />(✉)

**Abstract.** Effective provision of cybersecurity requires practitioners to work col- laboratively to solve practical real-world problems. However, the extent to which these skills are supported by current higher education programmes is potentially limited. This paper presents an investigation into the needs of related learners and the educators who support them, examining the provisions within current cyberse- curity education at degree level, and the extent to which they go beyond traditional knowledge transmission approaches. The findings illustrate a broad appreciation of the interdisciplinary nature of cybersecurity and recognition of the value of using collaborative learning approaches. At the same time, however, these aspects are not represented strongly enough within the current provision.

**Keywords:** Cybersecurity education · Cybersecurity Awareness · Collaborative learning · Educators · Learners

## 1 Introduction

Traditional forms of cybersecurity education are often focused on knowledge transmis- sion [1]. This means that knowledge is taken as something tangible that can be transferred from an expert (i.e., the teacher) to a beginner. When practiced well, the learner may acquire such knowledge, but not the resilience to apply it in various contexts [2]. This is especially troubling in cybersecurity, given the dynamic nature of the environment and the increasing need for collaboration, sometimes even required by legislation (cf. collaboration obligations laid out in the European NIS Directive [3]). We consequently need forms of education that understand the interdisciplinary nature of the field, as well as at the development of joint action in context: being able to act in a variety of situations and knowing how to do this together.

<footnote n="1">¹ University of Nottingham, Nottingham, UK</footnote>

<footnote>steven.furnell@nottingham.ac.uk</footnote>

<footnote n="2">² Austrian Institute of Technology, Vienna, Austria</footnote>

<footnote n="3">³ University of Oulu, Oulu, Finland</footnote>

<footnote n="4">⁴ Wise & Munro, The Hague, The Netherlands</footnote>

<footnote n="5">⁵ University, of Vienna, Vienna, Austria</footnote>

<footnote n="6">⁶ University of Salerno, Fisciano, Italy</footnote>
This paper is based on work from the Collaborative Cybersecurity Awareness Learn-
ing (COLTRANE) project funded under the European Union ERASMUS + programme
[4]. The premise of the project is that cybersecurity is recognised as needing more
practically relevant and applicable learning outcomes than merely the acquisition of
related knowledge. This is well illustrated by findings from the profession, with a recent
study from the Chartered Institute of Information Security indicating that analytical and
problem-solving skills are considered to be the most important skills for people enter-
ing the profession (selected by 53% of respondents, ahead of technical subject matter
skills, communication skills, and management skills, which were considered to be the
primary requirement by 24%, 22% and 1% of respondents respectively) [5]. The pro-
fession, therefore, needs support from more innovative forms of education that focus on
the development of joint actions. Cyber practitioners must be able to act in a variety of
situations and be able do so in collaboration with others.

The COLTRANE consortium consists of six partners across five countries (Austria, Finland, Italy, The Netherlands, and the United Kingdom). The project aims to contribute by using cyber-ranges and collaborative learning platforms to create hands-on activities, as well as opportunities for collaborative reflection. It will ultimately support the co-design of learning activities, with a toolkit for teachers and evaluation of learning activities by students. However, the starting point for the work was to determine the views of related educators and learners, in order to establish where COLTRANE's intended approaches could offer opportunities for improvement. To this end, the paper presents the findings of related data collection from sample participants in the partner countries, leading to the analysis and resulting recommendations that will inform the COLTRANE work as it moves forward. The findings presented build directly on data collection activities that included a session at a previous WISE event [6].

## 2 Approach

While education relating to cybersecurity can be identified at several levels, the target
groups of interest for COLTRANE are educators and learners working and studying at
higher education institutions within Europe. A necessary foundation for later work, it
was appropriate to investigate how these groups currently understand and experience
cyber security education. For the purposes of this study, the target groups are more
specifically defined as follows:

* Educators: Representatives from selected higher education institutions in Europe. They are involved in teaching delivery to students, with a focus on cybersecurity in the field of computer science. They contribute actively to the education at their institution through lectures, exercises, and combinations of both.

* Learners: Both graduate and undergraduate students, coming from the field of computer science as well as related disciplines.

Additionally, the choice of target institutions was focused on those with specific cyber-
security degree programmes, or those where cybersecurity was significantly represented
within the teaching in wider degrees (e.g., related units/modules in a more general com-
puting or computer science or information systems programme). This paper presents
the details of the resulting investigation and is based upon two rounds of data collec-
tion, which were undertaken across the COLTRANE partner countries. The first was
a questionnaire-based survey activity, which was intended to establish a broad under-
standing of how cybersecurity education is currently delivered and experienced by the
participants involved, as well as to explore the perceived relevance and appetite for the
collaborative learning approaches that COLTRANE seeks to pursue. The results from
this phase were then supplemented by a series of discussion-based workshops, which
sought to enable further exploration, drawing upon themes emerging from the survey
findings, as well as allowing the stakeholders to introduce further issues from their own
experiences.

3 Surveying Cybersecurity Educators and Learners

The work began by identifying several broad issues that it would be relevant to investigate with the educator and learner communities, including:

* Topics encompassed within, and related to, cybersecurity (i.e. what is cybersecurity perceived to be and how is it related to different disciplines?)

* Topic coverage and delivery techniques in current deliveries (i.e. what do institutions currently cover and how do they do so?).

* Perceived sufficiency of use of / exposure to different learning methods (i.e. are the current approaches to delivering cybersecurity education based upon appropriate techniques and meeting expectations?)

Two questionnaires relating to the above themes were prepared, with questions
framed to address educators and learners as distinct audiences (i.e., questions to educa-
tors were presented in terms of how they provide cybersecurity education, while those
addressing learners were framed in terms of how they had experienced it in their stud-
ies to date). In responding to the survey, educators were expected to answer from the
perspective of their institution's overall provision rather than only their individual con-
tribution. Learners were asked to reflect upon their expectations and experiences to date,
recognising that students early in their studies would be responding more from the former
perspective, whereas graduates would be able to reflect on a wider experience.

The questionnaires were promoted directly via the COLTRANE partners’ research
networks and contacts. For example, in the UK promotion was supported by the Char-
tered Institute of Information Security (CIISec) and the National Cyber Security Centre
(NCSC), with both sent out via their academic partner networks. In total this opportunis-
tic sampling yielded responses from 62 educators and 322 learners (65% undergraduates,
32% Masters, and 3% at doctoral level). While these numbers were judged to be suffi-
cient to get a broad sense of overall opinions and experiences, they did not enable any
meaningful analysis of country-based sub-samples, or indeed to cut the data according
to other parameters (e.g., level of study). In both groups, the sample populations proved
to be 75% male. While this is not a balanced sample, it can be argued to be a broadly rep-
resentative one, insofar as it reflects the recognised problem of gender-imbalance in the
digital sector in general and the cyber sector specifically. For example, looking at wider
findings from the UK, it is reported that females account for 28% of the workforce in the digital sector and 16% in the cyber sector [7]. Also, in Europe it is known that the vast majority of persons employed as ICT specialists are men [8] and the situation is similar for the cybersecurity sector where women represent fewer than 20% of cybersecurity professionals in Europe [9].

Looking at the experience of the respondent groups in the surveys, the significant majority (74%) of educators had over five years of experience in delivering cybersecurity, and only 11% had less than two years. Meanwhile, the learners were at varying stages of study, but more than three quarters were beyond their first year (the stage of study is likely to have some bearing on their ability to offer fully informed opinions about the extent and style of cybersecurity coverage in their programmes, as some will have had only partial exposure in practice).

While the length constraints of the current paper preclude a full discussion of all findings, some key points are relevant to highlight. The main body of the questionnaires for both audiences began by asking them to rate a series of topics in terms of their perceived relevance to cybersecurity. Figure 1 depicts the result of this activity from the perspective of the learners, and these suggest that while people (unsurprisingly) make a primary association between cybersecurity and computer science, clear links are rightly perceived with a range of wider topics (and even the topics that would be less obviously associated, such as drama and history, can be related if considered from a suitable perspective – e.g. the use of drama to support the delivery of education and awareness, or the historical context for the evolution of security incidents and safeguards). The findings from the educator audience were broadly similar, and the only area of significant difference was that a much higher overall proportion (80%) considered Psychology to be highly or often relevant.

Having established the interdisciplinary influences that may feed into the topic, another significant finding was the appreciation of sub-topics that fall directly within the cybersecurity domain. The nature of this coverage was assessed using the categories and Knowledge Areas (KAs) from the Cyber Security Body of Knowledge (CyBOK) [10] as a frame of reference, with educators being asked which areas their courses covered and learners being asked to indicate which topics were important to them<fnref n="1" />. The results in Fig. 2 clearly show that some topics are more likely to be receiving coverage than others. Meanwhile, their perceived importance to learners appears broadly similar, with no topics standing out as significantly more critical than others and only Formal Methods falling below a quarter of learners viewing it as important.

Having established a sense of *what* is delivered, the survey was also able to gather some insights into perceptions of *how* the delivery is achieved, with respondents being asked about the perspectives covered and the methods used to do so. The related findings are summarized in Fig. 3, and it is interesting to note that the use of traditional lectures is the only aspect where both audiences generally believe that provision is appropriate. In various other cases, we can see that significant proportions of learners were inclined to feel that they were receiving too little exposure to the aspects in question. Indeed, there are some aspects (e.g., collaborative learning and interdisciplinary activities) for which

<footnote n="1">¹ Note that CyBOK's Applied Cryptography KA is not listed as it had not been released at the time of the study.</footnote>
<figure><img src="image_3.png" /><figcaption>**Fig. 1.** The extent to which learners considered different discipline areas to be relevant in contributing to the topic of cybersecurity.</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>**Fig. 2.** Comparing the extent to which educators indicated that CyBOK knowledge areas were covered in their degrees to and the extent to which learners felt the topic was important to them.</figcaption></figure>

only around half the audience believes the current provision is appropriate. Meanwhile, learners and educators notably diverge in their perceptions about whether the coverage of technical topics is appropriate but have a more similar view in terms of the (in)sufficient
coverage of non-technical content. Given that there are many instances where the educa-
tors and learner views agree about shortcomings, the observations collectively suggest
that there is some potential to reconsider and rebalance the provision.

<figure><img src="image_5.png" /><figcaption>**Fig. 3.** Comparison of educator and learner perceptions about the extent of use of different delivery methods and the coverage of different topic perspectives.</figcaption></figure>

Recognizing the interest of educators in collaborative activities, we also investigated
how collaboration is reflected in their practices. This revealed 31% claiming to make
extensive use, 50% making some use, 16% not making use but able to see the potential,
and only 3% indicating that they did not feel it worked for their topic. Thus, the overall
picture clearly suggests an openness to the use of collaborative learning approaches,
even though only a minority are already making extensive use of it.

## 4 Workshop-Based Exploration

Having used the survey to gain a broad appreciation, the investigation then explored some
of the key issues in more detail via a series of related workshop sessions. As with the
questionnaires, these targeted both educators and learners, seeking further insights into
the perceived effectiveness of the current provision and the potential for enhancement
via collaborative awareness. It was expected that participants would come from differ-
ent backgrounds (e.g., learners could be studying at different levels, and some would
be from dedicated cybersecurity degrees, whereas others would be taking related mod-
ules within wider programmes). A series of resulting seven workshops (each averaging
around 90 min and involving 6–7 participants, plus convenors) was staged between May
and August 2021. Of these, three were specifically with educators (in Austria, Finland
and the UK), two with learners (Finland and UK), and two were mixed sessions (held at
the 14th World Conference on Information Security Education – WISE, and 16th Interna-
tional Conference on Availability, Reliability and Security - ARES). As with the surveys,
this gave a broad range of backgrounds in terms of their specific experiences but offered
a suitably comparable group for the level of discussion being sought. Specifically, follow-
ing an outline of the COLTRANE project the sessions addressed four main themes
of discussion, as follows:

1. Interpreting cybersecurity - exploring participants' interpretation of what cybersecurity is in order to establish their starting point in the later discussion.

2. Delivering cybersecurity education - developing an understanding of what the participants currently do in their cybersecurity education delivery.

3. Reflecting on existing approaches - reflective discussion, comparing the described delivery activities to employer needs and identifying the breadth of approaches.

4. Looking ahead – considering what could be changed or done better, and identifying opportunities for COLTRANE to contribute.

The workshop convenors guided the discussion, with the focus tending to be placed
on the discussions and reflections relating to current approaches. The sub-sections below
summarise the key points arising. The discussion does not seek to distinctly call out find-
ings from educators or learners, as in many cases, the general nature of their comments
was in broad alignment. However, where specific views or perspectives came from a
particular audience, this is denoted in the text.

## 4.1 Interpreting Cybersecurity

The aim here was to establish a foundation for the later discussions by exploring the
participants' interpretation of what cybersecurity is and what it includes. The aim was
to get a sense of whether it was perceived to be a technical, computing-led topic or
if there was already an appreciation of it having a broader basis and a relationship
with other disciplines. This aspect was allocated a relatively small proportion of the
discussion, as it was mainly intended to get the participants 'warmed up' and comfortable
to start interacting. Nonetheless, there were some relevant learning points from how the
discussions tended to unfold and the perceptions that were revealed. For example, the
discussions generally tended to begin with people attempting to offer a short definition
of the term rather than get under the surface of what it encompasses. Consideration of
technical topics seemed to emerge more naturally, and the following UK response reflects
the sort of points that were being made: "*Strong foundations in computer science, deeply
*technical discipline overall*”. At the same time, there was recognition of the wider, non-technical perspective and reference to the protection of people and the notion of risk were also forthcoming without convenors needing to steer the participants in those directions. The interdisciplinary aspect emerged as an essential consideration and was particularly recognised by those learners coming into the topic from other subject areas (and therefore did not have computer science as their primary background).

Overall, while the breadth of cybersecurity did seem to be generally recognised, the way in which the acknowledgement of non-technical/non-technology aspects emerged in the discussions perhaps suggests that they are regarded as ‘secondary’ elements (this broadly echoes a survey of cybersecurity programmes reported in [11], which found that topics lacking sufficient coverage were typically in organisational, human, social, operating and maintenance subjects). It is worth considering how related awareness and educational materials are constructed because the more desirable position is for the breadth of topics to be considered equally, and to recognise that non-technical aspects can be just as crucial in practice.

## 4.2 Delivering Cybersecurity Education

Having discussed what the participants considered cybersecurity to be, the focus then moved to develop an understanding of what they currently *do* in terms of their cybersecurity education delivery (concerning the educators) or how it is currently experienced (from the learners’ perspective). To some degree, the comments here continued to reflect the technical bias that had been observed in the initial discussion. For example, feedback from one of the Finnish educators commented upon the “lack of cyber content outside the technical domain”, while many comments from Finnish learners tended to focus on the technical aspects explicitly:

- “Many technical aspects covered with hands-on focus”

- “Technical concepts well covered and requires deep knowledge”

- “Possibility to go deeper in focused topics, e.g., forensics or individual tool usage”

Looking at the current practicalities of delivery, educators suggested several challenges to further extending the provision:

* There is a lack of academics confident in cybersecurity education, limiting the ability to deliver it. Additionally, while teachers might appreciate the importance of collaboration, they may not know how to conveniently incorporate it in their delivery of courses in their specialty area. This aligns with the challenge-related findings from the educators in the survey, and the workshop participants suggested the need for some further ‘train the trainer’ provision for academics.

* There is sometimes a lack of teaching resources, particularly in relation to hands-on activities.

* Although it is recognised that further integration is needed (both in terms of integrating additional topics into cybersecurity degrees and integrating cybersecurity coverage
into other, non-specialist programmes), a practical barrier is often that the curricu-
lum/programme is already full and does not have space for more content. As such,
new content can only come at the expense of something else.

* When looking at provisions outside of computer science, it was felt that academics running the degree programmes may be resistant to cybersecurity being added into their courses, and there would be concerns about the pitching of the delivery (e.g. technical level) not matching the needs of the non-computing audience.

Another challenge is the lack of practice-oriented teaching resources, especially for hands-on activities, and while the value of providing exercise-focused activities is recognised, the time required to develop them was observed as a significant obstacle (e.g., “*Creating scenarios sounds good, but the maintenance of such clusters is too time-consuming*” – Austrian educator).

The challenge of time limitation was also a factor raised in the ARES workshop, but from the perspective of what it is feasible to fit within the formal, educator-led delivery (“*Challenging to offer sufficient exposure to topics in the limits of the formal hours available*”). This should not be overlooked as an underlying factor, and ultimately if the content of a programme needs to be changed to incorporate something new, it is often going to be at the expense of something else.

The learner experience tended to vary quite significantly depending upon the degree they were studying. This included a distinction between undergraduates and postgraduates, as well as between programmes where cybersecurity was the primary focus versus those in which it was a topic of study amongst a wider set (e.g., for students encountering it within general computer science degrees). The learners tended to refer to practical activities and hands-on labs, further illustrating the value that is clearly placed on such aspects. This implicitly acknowledges a need to ensure that programmes are fostering learners’ cybersecurity skills rather than increasing their related knowledge.

The educators were almost exclusively from computing-related backgrounds and departments, and so their experience of delivering the topics primarily related to having computing students as their audience. While some had the occasional experience of delivering to students outside the topic area, this tended to prompt observations around the difficulty of delivery to those who lack the ‘necessary’ background (noting that the necessity in this case refers to the educators’ interpretation, and the knowledge prerequisites therefore assumed in their materials).

There was special recognition from learners that awareness and education around cybersecurity should extend further than currently occurs. To quote from the Finnish learner workshop: “Technical institutions could organise different content for a wider audience, but should be separate from technical content”; “The wider audience should know of the existing risks”.

## 4.3 Reflecting on Existing Approaches

Having collected the views of the participants, the next stage was a reflective discussion, considering the breadth of delivery approaches and the likely alignment to employer needs. This linked into considering whether existing delivery supported collaborative cybersecurity awareness, in the manner envisaged by COLTRANE.
With technical skills having been prominently discussed in the discussion of existing delivery, it was notable that this follow-on discussion saw some explicit acknowledgment of the need for broader aspects:

- “Theoretical knowledge also needed to keep technical content learning effective” (Finnish learner)

- “Reporting, communication and documentation not covered” (Finnish learner)

- “Soft skills are taught at work, not at university, which is later than it would be necessary to teach them” (ARES participant)

While soft skills were acknowledged as necessary, it was not considered appropriate to try to ‘teach’ them in isolation (to quote one UK educator, “*Teach and practice soft skills within assessments*”). Additionally, an ARES participant observed that specific delivery structures do not lend themselves to the delivery of broader skills (“*where there are short, focused courses on particular topics (e.g., OT security) they don’t cover the wider angle*”).

Perhaps unsurprisingly, it was recognised that a variety of delivery and learning approaches help students engage more. Although it was not directly stated, a point that was implied by some of the comments (“*Students like the skills that help them to find a job in the future*”) is that it is often necessary to strike a balance between what learners want and expect, versus what educators believe they need. A relevant comment from an educator in the ARES session was that they had given specific attention to career development (e.g., career paths, salaries, etc.) which was of interest to the students and would perhaps not normally have been considered as part of their expected delivery.

The attitude of learners was also significant in informing what educators felt it relevant and valuable to provide for them. The following comment illustrates the point, while also highlighting a positive approach to tackling the issue: “*Our students often see modules as being just about ‘getting credit’ - using ‘real world examples/case studies’, as mentioned, helps - but have also found that utilising cybersecurity industry professionals - in particular alumni - to chat to the students about what they do and the importance of their job (as related to the module), shows the students the relevance of what they’re learning*”.

## 4.4 Looking Ahead

The final segment of each workshop session focused on what could be changed or done better in view of the earlier discussion. While the not strictly limited to the needs of the project, this was intended as a means of identifying opportunities for COLTRANE to contribute and the context of collaborative awareness-raising.

Prompted by the experience of moving to online, remote delivery during the COVID-19 pandemic, the flexibility of delivery was an important aspect moving forward. There was also a general recognition of the need to keep content relevant and updated – e.g. “*We need to review security in new technologies and add new modules to our curriculums*” (UK educator).

One notable comment, offered by an educator in the WISE session, suggested “*Having a lot of people do a small bit perfectly instead of having everyone doing a*
*lot (and the same thing)*". This aligns strongly with the notion of collaborative provision and COLTRANE's plans for providing a repository. For example, it makes perfect sense for case studies that one teacher researches and prepares the materials, and then makes the resulting slides, assignments etc. available to others (in exchange of other cases provided by them). Indeed, this would also go some way to addressing the resourcing challenges associated with creating activities that were highlighted in Sect. 4.2.

Sharing work and national collaboration in providing cyber education were both factors that received support. Educators in the WISE session mentioned using materials from external sources, such as OWASP and from GitHub. Meanwhile, the benefit of collaboration was also recognised in the learner community, with one of the participants in the Finnish session suggesting the *"Possibility for inter-institutional co-operation"*. At the same time, other comments were clear that this is not always straightforward. For example, when considering reusing teaching materials, one of the Austrian educators observed, *"It is more difficult to use other people's slides than your own"*.

Interdisciplinarity was an issue that garnered support, with the following quotes, all taken from the Austrian session, illustrating aspects of this recognition:

- "Interdisciplinary [is] very important"

- "No business process is possible without cybersecurity"

- "Awareness must also be created among educators!"

Having said this, enhancing the *provision* of interdisciplinary perspectives would require attention to the design of appropriate case studies in which different disciplines could contribute, and where related learners could participate: *"Advice and case studies on delivery across multidisciplinary programmes"* (UK educator).

The issue of learner-centred provision was also emphasized in the discussion by Austrian educators, with the term 'edYOUcation' being used to reflect the need to address learners from their own backgrounds and standpoints. Other workshops also reflected aspects of this, and in particular the need for extending provision to learners outside the computing area was also flagged, with examples such as the following being offered as thoughts for future directions:

- "Cyber Hygiene courses for varying audiences outside the technical domain" (Finnish educator);

- "a more introductory level course with medium level technical skill expectations would be useful" (Finnish learner).

At the same time, broader delivery already happens in some cases. As an example, an educator from the ARES workshop described having had the opportunity to present cybersecurity content to students in the law department. Meanwhile, educators in the Austrian workshop commented on the potential challenge (*"how to bring cybersecurity to people without much knowledge of cybersecurity?"*), while also highlighting where collaborative approaches could help (*"shared repository of cases for educators and learners to learn basics and lower entry threshold"*).
# 5 Analysis and Discussion

While varying in the specific levels of participation in the different activities across the partner countries, the overall data collection activity represents a significant body of work when considering both the survey and workshop findings. Moreover, there was a notable level of consistency in some of the findings and messages emerging from the educator and learner communities involved, which provide a useful basis to feed-forward and inform further COLTRANE activities.

The overall findings determined that while cybersecurity education is now a recognised and established topic within both undergraduate and postgraduate studies, there is an apparent skew towards technical areas in the delivery of the topic. Additionally, while both learners and educators recognise interdisciplinary overlap with various other topic areas, the delivery of cybersecurity is currently dominated by the computing perspective. While this is unsurprising insofar as it is relating to the protection of computing-related assets in computing systems and devices, there is potential for other topic areas (e.g. business, economics, law, psychology) – which are often highly relevant to addressing security in practice - to be better represented than is currently the case.

The findings suggest a potential disconnect between the theory and practice of cybersecurity delivery. While the survey and workshop findings from both the educator and learner communities appeared to recognise the importance of cybersecurity as an interdisciplinary issue, the reality of delivery appears to be more grounded in considering it a computing-focused subject and skewed towards technical aspects of the topic.

Given the number and breadth of knowledge areas represented within CyBOK, it is not realistic to expect any cybersecurity degree - at undergraduate or postgraduate level - to fully cover all of them. This was clearly reflected in the survey results from both the educators and learners, and it was also apparent that some knowledge areas are more likely to receive coverage than others. Programmes need to be clear on what they are aiming to deliver and for learners to have a similarly clear idea of what programme will best meet their needs (if they already have a particular aspect of cybersecurity in mind as a target at that stage).

At the same time, cybersecurity education must not result in insular and siloed approaches. The survey and the workshop highlighted recognition of interdisciplinary perspectives that are not necessarily reflected in current provision. Even if someone has elected to focus their study on a particular technical subset of the discipline, there would still be value in their education exposing them to a broader context and showing where this topic 'fits' into the broader picture - of both cybersecurity and the business and societal needs that it serves. Facilitating this through collaboration with other learners representing these wider elements would arguably be the most effective means of introducing a parallel to the real-world situations that will be encountered in practice.

# 6 Conclusion and Recommendations

The findings from the task as a whole lead to a number of recommendations that should be considered in the subsequent COLTRANE activities, as well as for the provision of cybersecurity education more widely.
* Ensure that approaches and materials are holistic and represent the breadth of topics relevant to cybersecurity. This should specifically include non-technical aspects of cybersecurity, as well as appropriate emphasis toward fostering and supporting soft skills.

* Technical and non-technical aspects should each receive clear recognition in terms of their contribution to cybersecurity, and one should not be presented (implicitly or explicitly) as being secondary to the other. While specific provisions may focus attention upon some topic areas and not others, this should ideally still be done in a manner that shows where these topics fit within the wider context.

* Mapping the topic coverage to an appropriate reference framework (e.g. CyBOK) will be advantageous in enabling learners to understand which aspects of cybersecurity will receive attention in particular courses/programmes or modules/units.

* Delivery methods should incorporate an appropriate level of practical activities (including problem/scenario-based approaches) in order to ensure that learners have the opportunity to go beyond knowledge acquisition and develop at least a baseline level of accompanying skills.

* While it is important to ensure that soft skills receive specific attention, they should not be approached as a distinct and separate topic in their own right. They should be seen as being implicit within cybersecurity more generally, and the coverage and assessment of them should be integrated alongside the more discipline-specific material.

* Incorporate opportunities for educators from outside the computing topic area to provide input into delivery, to evidence both the relevance of cybersecurity within their discipline and how approaches from their disciplines can be relevant in addressing it. Correspondingly, look for opportunities to the computing-based educators to offer contribution into the delivery for other disciplines that need to understand cybersecurity in the technology context.

* Incorporate opportunities for cybersecurity learners to interact with learners from other related disciplines. This may be achieved within programmes, where there are learners from multiple backgrounds, or between programmes through specifically constructing opportunities for collaborative learning.

* Consider means by which learners with backgrounds in other disciplines can be offered opportunities to contribute their wider perspective.

These provide a basis to inform both the methodology and approach for the COLTRANE educational framework: a conceptual account of principles and guidelines for designing educational building blocks, including the use of technology. The framework will therefore be implemented as educational scenarios through which educators in higher education can exploit the platform technology to design their materials.

**Acknowledgements.** The authors would like to thank the ERASMUS+ project COLTRANE (grant number KA2-Projekt 2020-1-AT01-KA203-078070) for supporting the research presented in this paper. The European Commission support for the production of this publication does not constitute an endorsement of the contents which reflects the views only of the authors, and the Commission cannot be held responsible for any use which may be made of the information contained therein.
## References

1. Cybint. Why Hands-On Skills Are Critical in Cybersecurity Education. 5 August 2021 (2021). https://www.cybintsolutions.com/hands-on-skills-in-cyber-security-education/.

2. Bereiter, C.: Liberal education in a knowledge society. In: Liberal education in a knowledge society (2002)

3. European Union. Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. Official Journal of the European Union, 19 July 2016 (2016). http://data.europa.eu/eli/dir/2016/1148/oj

4. COLTRANE Homepage. https://coltrane.ait.ac.at. Accessed 11 Dec 2021

5. Wilson, P.: The Security Profession 2020–2021. Chartered Institute of Information Security (2021). https://www.ciiisec.org/White_Papers

6. Andriessen, J., Furnell, S., Langner, G., Quirchmayr, G., Scarano, V., Tokola, T.: Foundations for collaborative cyber security learning: exploring educator and learner requirements. In: Drevin, L., Miloslavskaya, N., Leung, W.S., von Solms, S. (eds.) Information Security Education for Cyber Resilience. WISE 2021. IFIP Advances in Information and Communication Technology, vol. 615. Springer, Cham, pp. 143–145 (2021). https://doi.org/10.1007/978-3-030-80865-5

7. DCMS. Cyber security skills in the UK labour market 2021 - Findings report. Department for Digital, Culture, Media & Sport, 23 March 2021 (2021). https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2021

8. Eurostat. ICT specialist by sex' in ICT specialists in employment. 13 July 2021 (2021). https://ec.europa.eu/eurostat/statistics-explained/index.php?title=ICT_specialists_in_employment

9. (ISC)². Women in Cybersecurity: Young, Educated and Ready to Take Charge (2019). https://www.isc2.org/-/media/ISC2/Research/ISC2-Women-in-Cybersecurity-Report.ashx

10. Rashid, A., Chivers, H., Lupu, E., Martin, A., Schneider, S.: The Cyber Security Body of Knowledge. Version 1.1.0, 31 July 2021 (2021). https://www.cybok.org/media/downloads/CyBOK_v1.1.0.pdf

11. Blažič, B.J.: Changing the landscape of cybersecurity education in the EU: will the new approach produce the required cybersecurity skills?, Educ. Inf. Tech. (2021). https://doi.org/10.1007/s10639-021-10704-y