Certified Master s in Cyber Security. Certification of Master s Degrees Providing a General, Broad Foundation in Cyber Security

Transcription

1 Certified Master s in Cyber Security Certification of Master s Degrees Providing a General, Broad Foundation in Cyber Security Certification of Master s Degrees in Digital Forensics Questions and Answers from Briefing Day held on 14 th January What fields of work do we expect students on the certified Master's to go into? This will depend on the subject and there is work continuing within The Tech Partnership 1 around this. It would be expected that students could take up roles in industry, government and academia (PhD studentships, research assistants, etc.) in the UK and abroad. 2. Who is the customer for these certified degrees? The customers are the future employers of students in industry, government and academia. 3. Do we just want UK nationals to be students? No, we expect that degrees will have a mix of UK and non-uk students. The UK government is keen to attract overseas students to come to the UK to study. 4. Can you provide guiding units to help people from non-stem backgrounds to decide on a career path / degree? The initial certified Master s degrees are heavily based on STEM subjects. We do envisage that the certification will broaden its base in the future. Currently, our primary priority is technical and the career pathway guidance from The Tech Partnership (referred to in question 1) should help. 5. How is distance learning handled? The call document makes it clear that Master s degrees delivered by distance learning are in scope. Such degrees will of course have to meet all of the assessment criteria. 1 Tech Partnership: Page 1 of 6

2 6. How do we submit dissertations for Full certification if we only have hard copies? We would advise scanning such dissertations and sending the scanned versions, or contact us early if you have concerns about doing that. 7. Why do you want dedicated facilities for Master's? In section 2 of the application for Full and Provisional certification, we ask that the facilities for Master s students in general are described. We also ask that any facilities specifically for Master s students on the degree in question are also described. This gives HEIs the opportunity to highlight the range of experimental studies that Master s students on the degree will be able to undertake that will add value to the taught component of the degree. 8. If we have new investments coming along but were not provided during the cohort who have been through will we be disadvantaged? In section 2 of Full and Provisional applications, please describe recent investments as well as planned and committed investments. Future investments provide a good indication of the commitment of the HEI to the Master s and the importance the HEI attaches to cyber security. 9. Do we need to supply CVs for external staff? In section 2 of the Full and Provisional application, we ask HEIs to describe the composition of the team delivering the Master s. If external staff (who could be from other academic institutions, industry or government) are used to deliver elements of the Master s then please provide their CVs. Our general advice for CVs still applies: CVs should highlight the knowledge and expertise of people in cyber security. 10. What about CVs for people who were in the team but are not now? If there were people in the team during the cohort years then include them and describe why the team has changed, who has replaced them, and discuss why the team has the same or better capability. 11. What about changes in the module structure? It is recommended that you clearly describe the changes, why they were made and what it means for the degree. If the change is substantial then it is likely that applying for Provisional certification is appropriate. In addition, please refer to question 22 in the Q&A document from the briefing day held on 14 th April Page 2 of 6

3 12. When you say you want a strong academic team who are active in cyber security do you include people covering subjects like Law? We would like to know that someone teaching law as it relates to cyber security has some knowledge of working in cyber security law or has that experience. 13. When you ask for a response plan to the external examiner is our internal plan good enough? We need to see the external examiner s report and your response to it, with the steps you are taking to respond to any recommendations from the external examiner. This may be a plan or an agreed set of actions. It may be your view that the external examiner s report is not correct in some parts in which case you need to detail your views and why you are taking the actions you are. 14. We have a rolling programme of external examiners and it may be that the external examiner in the cohort year was not a digital forensics person. We will have a digital forensics external examiner at some point what do we do? It is important that you clearly describe the process that you use for appointing an external examiner including the last time you had a DF person and the next time you will have a DF person. As required by the call document, please provide the external examiner s report for the requested academic year. We would recommend that you also provide the most recent external examiner s report from a DF person. 15. Does the external examiner need to be an expert in digital forensics? We appreciate that external examiners are often required to cover a number of Master s degrees within a university. Ideally, we would prefer that the external examiner has experience in digital forensics. If that is not possible, then the next options would be cyber security expertise or a very experienced person in computer science. 16. Do we need to submit the external examiner s notes and comments? You need to submit is the official report from the external examiner to the university and your response to it. 17. Do we need to submit the university s Full module descriptions? As described in the call document, we recommend that you tailor the module descriptions to the requirements of the call. In particular, we suggest that you signpost the information required by the assessment panel. If your university will not allow you to submit anything other than the approved Full module descriptions then please make sure that you state this in your application. 18. Why don't you visit the university? We believe that we have a very rigorous and fair process for the assessment of applications and do not consider the absence of university visits to be a limitation. At this point, we do not have the Page 3 of 6

4 resources required to visit every university that wants to apply for certification. In the future, we will explore whether the certification programme could be run by a third party university visits may then become part of the application process. 19. Is this a 1-year Master's? The certification is for postgraduate Master s degrees which typically take one year of full time study (or equivalent for part time students) and comprise 180 credits. 20. How do you handle semesters delivered overseas? The call document states that certification is for post-graduate cyber security Master s degrees (including distance learning degrees) delivered, examined and awarded in the UK by UK HEIs and which typically take one year of full-time study (or equivalent for part-time students). Thus, an application which included mandatory overseas semesters and modules would be out of scope. If the semesters and modules were optional, there may be other pathways through the degree that would be within scope though these pathways would have to meet the assessment criteria. 21. What about providing classified esteem indicators? In the first round this was not a problem and none of the universities needed to rely on classified information. The application process does not allow for the use of classified material so if you would like to include classified information in your application you need to inform us as early as possible so we can work out to handle it. Most likely, one of our team will need to visit the university to see the classified information and then relate it to the assessors accordingly. 22. What about part-time degrees? Part time degrees are within scope but the application needs to demonstrate that the taught content is equivalent to a 1-year full-time Master's. 23. What do you mean by pathway we don t have those but we do have optional modules? A pathway is a set of modules that meet the scope criteria e.g., the 70% criterion and 9 out of 13 skills groups criterion. Pathways typically apply to Master s degrees with a number of optional modules. In your application, you need to identify the pathways that meet the scope criteria. Degree certification only applies to the pathways. If a student chooses a set of modules which does not correspond to a pathway they will not be studying a GCHQ certified Master s. It is the university s responsibility to make it clear to such students that they cannot say they are undertaking a GCHQ certified Master s degree. Page 4 of 6

5 24. What about entry requirements for the Master s? We do not require a STEM subject for entry onto a Master's. At the moment we believe that the technical content of both the Generalist and DF Master's requires the majority of students to have a good technical grounding in a STEM subject or equivalent experience. If you do not require a STEM background, then we would recommend that you describe your entry criteria and the reasoning behind them. 25. What about people who have completed MOOCs? It is up to the university to decide whether a MOOC provides a sufficient foundation to undertake a Master s. By way of example only, someone with a STEM degree, industrial experience and who had recently completed a relevant MOOC might be considered to have sufficient background. An introductory MOOC only might be considered to be insufficient. It is up to the university to describe and justify its entry requirements. 26. Do we need to provide CVs for people who are invited in to speak on specific subjects such as Law? If the speaker is just brought in to provide an expert lecture on a specific subject then you do not need to provide a CV but you should detail how you use these experts within your team and why. If you rely on the expert speaker for part of the assessed taught content then you should provide a CV. 27. How do we use the student certificate in the Provisional application? We do not award certificates to students of Master's with Provisional certification. This is in case the future Full application is unsuccessful. However if the Provisional certification is subsequently awarded Full certification then we will allow retrospective certificates to be awarded to the students who studied during the provisionally certified years. 28. I need to get my legal department to review the T&Cs how can I do this? Please requesting a copy of the T&Cs for review. 29. When do I submit a Full application if I have Provisional first? Once we have awarded the Provisional status we will agree T&Cs with you and in the T&Cs we will agree a date by which a Full application needs to be submitted. 30. What font size do we use? The call document states that the minimum font size is 10pt. 31. Is the ratio of UK to international students relevant to the assessment? No. We ask for the numbers of UK and non-uk students for information purposes only. Page 5 of 6

6 32. Is there a pre-requisite in terms of the size and membership of the team delivering the degree? We have not specified a minimum team size. We are looking for a coherent team with the appropriate knowledge and expertise. However, assessors may well look to see if there is sufficient critical mass in the team to ensure that degree delivery is not critically reliant on just a few individuals and to ensure that students experience a broad range of technical viewpoints. 33. How is the required depth of coverage ascertained? (Answer from question 6 in the Q&As from the briefing day on 14 th April 2014.) Successful certification requires the Assessment Panel to be happy that technical content is covered in sufficient depth appropriate to the time constraints of a 1-year Master s. The Panel also needs to be happy that students are rigorously assessed on their understanding of this material. The panel will base its decisions on the evidence an HEI provides, including: module descriptions, examination and assessment materials, research dissertations, distribution of grades. 34. What Master s are you considering next? The current plan is re-issue calls for general cyber security and digital forensics in June We are also in the early stages of developing the call document for Integrated Master s in Computer Science and Cyber Security. 35. What about undergraduate degrees? We have no current plans to certify undergraduate degrees. 36. Inconsistent terminology: Security disciplines and skills groups The terminology for Security Disciplines and Skills Groups is introduced in Appendix B and is taken from the IISP. There are Security Disciplines A to H and Skills Groups i to xiii. We hope it is being used consistently, though please let us know where this is not the case. 37. Question of terminology: information security and information assurance Appendix A, section 2 of the call document describes theses terms. 38. When submitting dissertations do we need to provide any practical work that formed part of dissertations e.g., software systems that were developed? No, the dissertation itself is sufficient. However, if other elements of a dissertation have been taken into account in awarding the overall mark (e.g., demonstration of software system during the viva examination) then you should describe these. Page 6 of 6