# Pathways in Cybersecurity: Translating Theory into Practice

Susanne Wetzel

<figure><img src="image_1.png" /></figure>

## To cite this version:

Susanne Wetzel. Pathways in Cybersecurity: Translating Theory into Practice. 10th IFIP World Conference on Information Security Education (WISE), May 2017, Rome, Italy. pp.39-48, 10.1007/978-3-319-58553-6_4. hal-01690965

HAL Id: hal-01690965

https://inria.hal.science/hal-01690965

Submitted on 23 Jan 2018

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>
# Pathways in Cybersecurity: Translating Theory into Practice

Susanne Wetzel

Stevens Institute of Technology
Department of Computer Science
Castle Point on Hudson
Hoboken, NJ 07030, USA
swetzel@stevens.edu

**Abstract.** In this paper, we report on a pilot project which was geared to explore the possibility of enabling a pathway in Cybersecurity education between community colleges and four-year institutions where students enter the four-year institution with Junior status after graduating from the community college with a suitable Associate in Science degree. The pilot was carried out in the context of the Cybercorps®: Scholarship for Service program, also focusing on exploring whether it is possible to support students pursuing such a pathway through the Cybercorps®: Scholarship for Service program and successfully placing them in the government to complete their internship and post-graduation service requirements. The pilot included two students from a community college pursuing an Associate in Science degree in Computer Science/Engineering and then transferring to the Bachelor of Science in Cybersecurity degree program at a nearby four-year institution. This paper reviews the various components of the pilot project, discusses challenges and opportunities, and provides some suggestions for future directions from the perspective of the four-year institution.

## 1 Introduction

There is a reported shortage of professionals in Cybersecurity—not just in the United States (e.g., [6]) but around the world (e.g., [11, 9]). The challenge in addressing this problem is to not only identify a short-term solution for educating and (re-)training professionals to enter the field of Cybersecurity but instead establish sustainable options that will lead to a steady-state pipeline for workforce development in Cybersecurity. In the United States, one possible approach that is met with increasing interest is that of recognizing the role of community colleges and thus the establishing and fostering of pathways in Cybersecurity between community colleges and four-year institutions (e.g., [4, 16, 12]). The feasibility of such pathways from a curricular perspective has been studied in theory (e.g., [18]). Furthermore, a number of national centers have been established in recent years to foster Cybersecurity education on the community college level, to build partnerships, and to develop curricular guidelines
and standards (e.g., [10, 8, 5, 3, 14]). While great progress has been made already, there is considerable room and need for improvement and growth—in particular with regards to implementation in practice.

It is in this greater context that the paper at hand reports on a pilot project which was geared to explore the feasibility of a tightly time-constrained pathway in Cybersecurity between a community college and a four-year institution. The goal of the project was not just to establish the feasibility of students transferring from a community college into a four-year institution to pursue and complete a cybersecurity-focused degree program. Rather, the pilot was to explore whether it is possible for students to transfer to a four-year institution with Junior status, complete the cybersecurity-focused degree program within two years of joining the four-year institution, and secure employment in the government upon graduation. The results of the pilot project have provided interesting insights which are expected to further inform and shape the implementation of recent legislation [13] which calls for the inclusion of community colleges in the Cybercorps®: Scholarship for Service (SFS) program [7]. In particular, following the pilot project, the four-year institution is currently engaging in a collaboration with additional local community colleges in supporting two community college students under the new program criteria of the SFS program [7].

**Outline:** The remainder of the paper is organized as follows: In Section 2 we detail the various program components based on the three stages of the pilot program: final year of study at the community college; summer bridge program; and the two years of study at the four-year institution. This is followed by a discussion of encountered challenges and lessons learned (Section 3) from the perspective of the four-year institution. The paper closes with some general recommendations (Section 4) and some remarks on possible next steps (Section 5).

## 2 Program Components

In the following, we describe in detail how the pilot program was implemented at both the community college and the four-year institution. In particular, we detail the components that were put in place to support the students with the goal to maximize the chance for success—meaning students graduating from the four-year institution within two years of joining with a GPA $\ge$ 3.0 and securing employment in the government.

From an institutional perspective, the pilot project spanned across four years—from the time that the first student was selected and admitted into the program until the second student graduated from the four-year institution with a Bachelor of Science (B.S.) in Cybersecurity degree and was placed in the government to fulfill the post-graduation requirements of the SFS program [7, 15]. From a student's perspective, the involvement lasted for a total of five years: during the first year, each student completed his/her Associate in Science (A.S.) degree in Computer Science/Engineering at the community college. During the following two years, the student pursued the undergraduate degree program in Cybersecurity at the four-year institution—graduating with a B.S. degree within
two academic years of joining. Subsequently, each student was required to secure placement in the government to complete the two-year post-graduation scholarship requirement.

## 2.1 At the Community College

Faculty from both the community college and the four-year institution worked closely in identifying suitable candidates and eventually selecting the two students to participate in the pilot project. Specifically, the community college faculty reviewed student transcripts and progress after the students' first year at the community college. The focus was on students pursuing computing and math-centric degree programs. The main criteria included a high GPA, student progress w.r.t. completed courses that could not just be transferred to a four-year institution but would count towards obtaining Junior standing in the B.S. in Cybersecurity program at the four-year institution, and the likelihood of completing the A.S. degree by the end of the second year at the community college with a high GPA. The students meeting the criteria were encouraged to consider the opportunity and submit an application. As part of the application, students were asked to prepare a statement describing their interest in pursuing a career in cybersecurity and government service. The latter was due to the fact that the students were expected to receive funding through the four-year institution's SFS program. Subsequently, candidates were interviewed by faculty from the community college and the four-year institution. One student each was selected for two consecutive years to pursue the opportunity and receive the scholarship.

### Faculty Support at the Community College and the Four-Year Institution

From the very beginning, the students were supported by faculty at the community college and the four-year institution. Following the selection as participants in the pilot project and scholar, faculty from both institutions worked closely in tailoring the course of study for each student such that the students would meet all program requirements to complete the A.S. degree at the community college as well as ensuring that a maximum number of courses would transfer to the four-year institution to count towards obtaining Junior status in the B.S. in Cybersecurity program.

The students met with the faculty at the community college frequently in order to guarantee progress and allow for possible problems to be identified and remedied early. Similarly, the students and the community college faculty were in touch with the faculty from the four-year institution on a regular basis—also visiting the campus of the four-year institutions on multiple occasions throughout the academic year.

All faculty supported the students in the application process as transfer student to the four-year institution—reviewing application materials, providing letters of recommendation, and preparing the students for the in-person interviews. Given their academic standing (including grades, progress, and honor society membership), the students did not face any major challenges in obtained admission to the four-year institution.
## Student Mentor

As soon as the students were selected to participate in the pilot program, they were assigned a student mentor at the four-year institution. On purpose, we selected a student as mentor who had also come to the four-year institution as transfer student and as such had first-hand experience that could be shared with the community college students. The mentor was charged to be in touch with the community college students on a regular basis, invite them to campus, and be generally available to answer questions and address concerns. Starting with the second year, the first community college student participating in the pilot project was also able to support the mentor activities for the second student in the pilot project.

## Financial Support

Many community college students hold at least part-time employment in order to support themselves or their families. As such, it was crucially important for the pilot program to provide the students with substantial financial support—especially also during their final year at the community college in order to allow them to fully focus on their studies. The pilot program was funded through a supplement to the SFS program at the four-year institution. The financial support to the students included tuition, books, and some stipend. In return, the students were required to quit the jobs they held previously.

## 2.2 Transferring to the Four-Year Institution

The selection of courses transferring to the four-year institution was somewhat different for each one of the two students participating in the pilot project. This was due to the fact that the students had chosen slightly different paths for their A.S. in Computer Science/Engineering degree at the community college [2], including the selection of courses to fulfill math, science, and general education requirements (see Appendix for details). Both students had eighteen courses that transferred to the B.S. in Cybersecurity program at the four-year institution [1]. Generally speaking, Junior status at the four-year institution means that a student has completed twenty major courses in the first two years and needs to complete another twenty major courses during the Junior/Senior years in order to graduate with a B.S. in Cybersecurity degree.

Consequently, both students had a gap of two courses to Junior status. Furthermore, while both students had completed the typical CS 1 and 2 sequence [17] at the community college, at the four-year institution all students in the B.S. in Cybersecurity degree program must also complete an Algorithms course during their second year of studies which builds on the Freshmen CS 1 and 2 sequence and is a prerequisite for many Junior and Senior-level courses in the major.

Given the gap in the number of courses as well as the material (i.e., the Algorithms course), the pilot program included a summer bridge program which the two students had to complete during the summer in between graduating
from the community college and joining the four-year institution for the Fall
semester of following academic year.

*Summer Bridge Program*

For each of the students, the summer bridge program included two courses. The courses the students had to take were determined based on the courses they could transfer from their A.S. degree and what was most needed in order to bring them to Junior status. Both students completed the Algorithms course as part of the summer bridge program.

Aside from the academic merits, the summer bridge program also served another important means namely that of providing the students with more opportunity to get to know the four-year institution and starting to settle in before they had to “hit the ground running” at the beginning of the Fall semester. While both students had already visited the four-year institution multiple times during the previous academic year, the summer bridge program allowed them to further explore the campus—no longer just as visitor but as students, yet in a more quiet setting in the summer taking some classes but not a full course load like during a regular semester.

**2.3 At the Four-Year Institution**

In the Fall semester following the summer bridge program, both transfer stu-
dents started to pursue their studies at the four-year institution with Junior
status. Eventually, both transfer students graduated from the four-year insti-
tution within two years of first joining the institution for the summer bridge
program. In between their Junior and Senior years, both students completed
an internship as part of fulfilling their scholarship requirements. Furthermore,
both students secured final placement in the government upon graduation. While
one student secured the placement starting immediately after graduation, one
student started the government employment within a few months of graduation.

*Faculty Support at the Four-Year Institution*

The faculty at the four-year institution were involved in the supervision of the transfer students from the very beginning of the selection process. Their role grew in importance once the students joined the four-year institution as part of the summer bridge program. The faculty at the four-year institution served as academic advisor for the students, being responsible for the tailoring of the students' course of study, and providing help and guidance as necessary. In particular, the faculty was also responsible for recruiting the student mentor and tutors and overseeing the respective activities. The faculty met with the students on a regular basis.

*Student Mentor and Tutors*

While at the four-year institution, the students continued to work with the
student mentor who had already provided guidance to them during their final
year at the community college. In addition, the second student was able to greatly
draw on the experience and knowledge of the first student in the pilot project. Furthermore, the students were assigned tutors for the various classes they had to complete during their Junior and Senior years at the four-year institution. Initially, the first student was offered the opportunity to work with a tutor as soon as the student felt that it would be beneficial to get some help. This approach was changed during the second year. Specifically, a tutor was then recruited from the onset for classes that tend to be challenging for students—especially classes that are heavy on theory and math. The experience with the first student showed that if the decision is left to the student to seek help from a tutor, then there is a high risk that this help is requested too late and catching up proves difficult—if not impossible. Instead, working with a tutor from the beginning preemptively addresses the problem and has generally resulted in the students obtaining better grades in the challenging courses.

## *Financial Support*

Upon joining the four-year institution, both students were awarded a scholarship through the four-year institution's SFS program. Through this program, both students had their tuition covered and received other benefits such as a stipend, books, etc. as per the scholarship guidelines [7]. In addition, the pilot project included funding for the student mentor and the tutors.

## **3 Challenges, Successes, and Lessons Learned**

Generally speaking, a transition from a community college to a four-year institution is challenging for the students. Courses at a four-year institution tend to be more rigorous and fast paced than at a community college. Furthermore, while Freshmen typically have some time to ease into college life at the beginning of their college experience, transfer students have to “hit the ground running” from the very first day as they enter the four-year institution at a point where the other students are already well-settled into the college life and routine.

Also, oftentimes transfer students are at the top of their class at the community college, mastering any and all program requirements with ease (i.e., “being a big fish in a small pond”). In transferring to a four-year institution, they are then suddenly faced with a lot of uncertainty and competition (i.e., “being a new fish in a new large pond”). This change in perspective is challenging for the transfer students to cope with. The student mentor, tutors, and faculty play a crucial role during the transition in providing the necessary support to the transfer students.

Moreover, transfer students typically face a more challenging course sequence for their Junior and Senior years than their peers. This is due to the fact that the courses that transfer to the four-year institution generally cover (almost) all science and general education requirements—which for students at the four-year institution are spread across their curriculum in order to balance their course of study. Instead, transfer students tend to leave little to no such means for balance but their course of study rather includes only computing and security-focused courses. Consequently, we have seen the transfer students' GPAs drop
by as much as half a grade point. It is crucially important that the course of
study for a transfer student is well-designed and that the transfer student is
provided with suitable mentor and tutor support so that the challenging course
sequence can be mastered as best as possible. In looking towards job placement
in the government to fulfill the SFS program requirements, we noticed a direct
correlation between the GPA and how challenging it was for the students to
secure such placement—the higher the GPA was, the easier it was and a GPA
below 3.0 seems to literally make placement in the government impossible.

The transfer students must feel at home on campus by the time they are
expected to successfully carry a full course load at the four-year institution. As
such it is necessary to have the transfer students visit the campus frequently
before joining and make good use of the summer bridge program to have the
students familiarize themselves as much as possible with the campus, resources,
and social activities.

## 4 Recommendations

*Support Infrastructure:* In order to allow the transfer students to succeed, it is necessary to build a comprehensive support structure including faculty, student mentors, and tutors. In order to remove the burden or need to ask for help and potentially risk procrastination, it is better to simply impose measures such as mentor and tutor support, as well as regular meetings with the faculty.

*Campus Environment:* Similarly, it is important for the transfer students to be involved in on campus activities such as students organizations and clubs. Ideally, transfer students will have the opportunity to get to know future classmates already during visits to campus or as part of the summer bridge program. While upper classmen oftentimes opt for off-campus housing, it has proven beneficial to require for transfer students to stay on campus for at least one year as it will make fitting in, finding friends, and exploring extra-curricular activities on campus easier.

*Selectivity:* The challenge with achieving a graduating GPA $\ge$ 3.0 at the four-year institution can be addressed preemptively by adjusting the selection criteria, e.g., by requiring the transfer students to achieve a graduating GPA > 3.5 at the community college. Obviously, this directly impacts the size of the candidate pool.

*Areas of Study:* Depending on the characteristics of the Cybersecurity curriculum at the four-year institution, not just computing-focused studies at the community college should be considered. For example, for a four-year Cybersecurity degree program with core components in math and theory it might be better to recruit students pursuing an A.S. degree in Mathematics as these students typically have to complete extensive calculus requirements and do calculus-based sciences. Oftentimes, it proves less challenging for students to acquire computing skills based on a sound foundation in Mathematics than the other way around.
*Transfer of Courses and Summer Bridge Program:* While [18] provides some general guidance for identifying courses that can possibly be transferred from a community college to a four-year institution in the context of establishing pathways in Cybersecurity, in practice the courses of the respective degree programs must be evaluated in greater detail. Courses at the community college which generally lend themselves more easily for transfer to the four-year institution are science courses (such as Physics, Chemistry, or Biology), calculus courses, or courses to meet general education requirements (e.g., Sociology, Psychology, English Composition, History). For a computing-focused A.S. degree, courses which typically transfer include the CS 1 and 2 sequence [17], a Computer Organization/Assembly course, or a Systems Analysis course. For a math-focused A.S. degree, courses which may transfer include Discrete Mathematics or Probability and Statistics. In most cases, courses which are taught at an introductory level at the community college but are part of the curriculum in Junior or Senior years at the four-year institution (i.e., are taught at an advanced level) generally do not count for transfer credit. Typical examples include introductory vs. advanced courses in Operating Systems, Architecture, and Database Management Systems.

Based on the outcome of the transfer credit evaluation, the summer bridge program must be tailored on a per student basis to provide an effective means for remediation of individual deficiencies before the transfer student can take on a full course load at the four-year institution.

# 5 Conclusions and Next Steps

The pilot project showed that it is possible for transfer students to complete a B.S. in Cybersecurity degree within two years of joining a four-year institution if a suitable and tailored support structure is in place. However, it is not a-priori clear how such pathways can be easily scaled to accommodate a larger number of transfer students. Even if baselines for the transfer of standard courses (or transfer agreements) are established with a number of community colleges, there still is the need for individualized support and oversight of the transfer students in order to ensure timely graduation with good GPAs. This is due to the fact that there are always some deviations in the students' transfer credits (and thus their respective course of study) as well as the different strengths and interests that students exhibit.

In order to increase the candidate pool and ease the burden on the students, faculty, student mentors, and tutors alike, we suggest the exploring of a so-called super-sophomore model where transfer students join the four-year institution during the second half of their Sophomore year with the goal to complete their B.S. in Cybersecurity degree within three years of joining the four-year institution (i.e., pursuing undergraduate studies for a total of four and a half years instead of just four year). In order to complete the A.S. degree, the students would then transfer credits back to their community college. Such an earlier transfer to the four-year institution will allow the students to spread some of
the science and general education requirements throughout their studies. Similarly, a three-year timeframe to graduation from the four-year institution will result in some easing of the students' course of study—which is also expected to positively impact the students' GPA. Alternatively, a high-achieving transfer student may be able to use the extra time to obtain a graduate certificate and as such earn some advanced qualification that is expected to be of advantage when entering the workforce. Furthermore, the super-sophomore approach may also simplify the funding, e.g., through the SFS program of the four-year institution. In receiving one year of funding while at the community college with an additional two years of funding at the four-year institution, transfer students take on a considerable financial liability in case issues arise with the transfer to the four-year institution. With the earlier transfer as part of the super-sophomore model, the three years of funding would be exclusively received at the four-year institution only after transfer admission was already successfully obtained.

## Acknowledgments

The author would like to thank Elizabeth Hawthorne and Cynthia Roemer from Union County College for their collaboration in this pilot project.

This material is based upon work supported by the National Science Foundation under Grant No. DUE 0830846. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author and do not necessarily reflect the views of the National Science Foundation.

## References

1. Academic Catalog Stevens Institute of Technology—B.S. in Cybersecurity, https://www.stevens.edu/academics/academic-catalog

2. Academic Catalog Union County College—A.S. in Computer Science/Engineering, http://onlinecatalog.ucc.edu/preview_program.php?catoid=2&poid=381&returnto=128

3. Centers of Academic Excellence in Cyber Defense 2-Year Education, https://www.iad.gov/NIETP/reports/cae_designed_institutions.cfm

4. Community Colleges Are New Gateways to Hot Cybersecurity Jobs, https://www.edsurge.com/news/2016-04-28-community-colleges-are-new-gateways-to-hot-cybersecurity-jobs

5. CSSIA National Center For Systems Security and Information Assurance Innovation in Cyber Security Education, http://www.cssia.org/

6. Cyber-Security Skills Shortage Leaves Companies Vulnerable, http://www.informationweek.com/strategic-cio/security-and-risk-strategy/cyber-security-skills-shortage-leaves-companies-vulnerable/

7. CyberCorps® Scholarship for Service (SFS) Defending America's Cyberspace, Program Solicitation National Science Foundation NSF 15-584, https://www.nsf.gov/pubs/2015/nsf15584/nsf15584.htm

8. Cyberwatch West, http://www.cyberwatchwest.org/
9. Global Study Reveals Businesses and Countries Vulnerable Due to Shortage of Cybersecurity Talent, https://newsroom.intel.com/news-releases/global-study-reveals-businesses-countries-vulnerable-due-shortage-cybersecurity-talent/

10. National Cyberwatch Center, https://www.nationalcyberwatch.org/

11. One Million Cybersecurity Job Openings In 2016, http://www.forbes.com/sites/stevemorgan/2016/01/02/one-million-cybersecurity-job-openings-in-2016/

12. Protecting Information—The Role of Community Colleges in Cybersecurity Education, https://www.nationalcyberwatch.org/ncw-content/uploads/2016/03/Workshop_Rpt-Role_of_CCs_in_Cyber_Ed-2002.pdf

13. Public Law 113-274 - Cybersecurity Enhancement Act of 2014, https://www.gpo.gov/fdsys/pkg/PLAW-113publ274/content-detail.html

14. The C5 Project—Catalyzing Computing and Cybersecurity in Community Colleges, http://www.c5colleges.org/

15. U.S. Office of Personnel Management—CyberCorps® Scholarship for Service, http://www.sfs.opm.gov

16. Virginia's 21st Century Career Pathway Cybersecurity, http://www.doe.virginia.gov/administrators/superintendents_memos/2016/040-16a.pdf

17. Joint Task Force on Computing Curricula Association for Computing Machinery (ACM) & IEEE Computer Society: Computer Science Curricula 2013: Curriculum Guidelines for Undergraduate Degree Programs in Computer Science. ACM, New York, NY, USA (2013)

18. Pérez, L.C., Cooper, S., Hawthorne, E.K., Wetzel, S., Brynielsson, J., Gökce, A.G., Impagliazzo, J., Khmelevsky, Y., Klee, K., Leary, M., Philips, A., Pohlmann, N., Taylor, B., Upadhyaya, S.: Information Assurance Education in Two- and Four-year Institutions. In: Proceedings of the 16th Annual Conference Reports on Innovation and Technology in Computer Science Education - Working Group Reports. pp. 39–53. ACM, New York, NY, USA (2011)

## Appendix

List of sample courses which transferred from the A.S. in Computer Science/Engineering program at the community college [2] to the B.S. in Cybersecurity program at the four-year institution [1]:

<table><thead><tr><th></th><th>Community College<br>UCC</th><th></th><th>Four-year Institution<br>Stevens</th></tr></thead><tbody><tr><td>MAT 171</td><td>Unified Calculus I</td><td>MA 121</td><td>Differential Calculus</td></tr><tr><td>MAT 172</td><td>Unified Calculus II</td><td>MA 122/123</td><td>Integral Calc., Series, Vectors, ...</td></tr><tr><td>MAT 271</td><td>Unified Calculus III</td><td>MA 124</td><td>Calc. for Functions of Two Variables</td></tr><tr><td>MAT 267</td><td>Discrete Mathematics</td><td>CS 135</td><td>Discrete Structures</td></tr><tr><td>PHY 111</td><td>Mechanics</td><td>PEP 111</td><td>Mechanics</td></tr><tr><td>PHYL 111</td><td>Mechanics Lab</td><td>PEP 221</td><td>Physics Lab I</td></tr><tr><td>PHY 201</td><td>Electricity and Magnetism</td><td>PEP 112</td><td>Electricity and Magnetism</td></tr><tr><td>CSC 101</td><td>Computer Algorithms</td><td>CS 115</td><td>Introduction to CS</td></tr><tr><td>CSC 102</td><td>Data Structures</td><td>CS 284</td><td>Data Structures</td></tr><tr><td>CIS 210</td><td>Principles of Info. Security</td><td>CS 306</td><td>Introduction to IT Security</td></tr><tr><td>CSC 222</td><td>Comp. Org., Arch. and Assembly</td><td>CS 383</td><td>Comp. Org. and Assembly</td></tr><tr><td>ECO 201</td><td>Principles of Economics</td><td>BT 243</td><td>Macroeconomics</td></tr><tr><td>ENG 111/112</td><td>English Composition</td><td>CAL 103</td><td>Writing and Communication</td></tr><tr><td>SOC 101</td><td>Principles of Sociology</td><td>HSS 141</td><td>Introduction to Sociology</td></tr></tbody></table>