Towards a Common ECSC roadmap

ABOUT ENISA

The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing cross-border communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

EDITORS

Adrian Belmonte, Fabio Di Franco – European Union Agency for Cybersecurity

AUTHORS

Tommaso De Zan — tommaso.dezan@linacre.ox.ac.uk Muhammad Mudassar Yamin— muhammad.m.yamin@ntnu.no

Both authors are listed alphabetically and they contributed equally to the report

ACKNOWLEDGEMENTS

The authors would like to thank the ECSC Sterring Committee for their participation in this research and their insightful comments.

LEGAL NOTICE

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to Regulation (EU) No 2019/881. This publication does not necessarily represent the state of the art and ENISA may update it from time to time.

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources, including external websites, referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknowledged.

For any use or reproduction of photos or other material that is not under ENISA’s copyright, permission must be sought directly from the copyright holders.

ISBN 978-92-9204-464-0 – DOI: 10.2824/657311

TOWARDS A COMMON ECSC ROADMAP

EXECUTIVE SUMMARY

This report aimed to identify the key factors enabling the success of a national cyber security competition and to give a snapshot of the current situation in the EU and ECSC partner countries. To do that, we conducted a dozen of interviews with national and EU experts, searched and reviewed the relevant scientific literature and collected data on these key enabling factors with a survey, which was filled by 90% of the countries attending the ECSC. This was done to provide preliminary insights and a discussion platform to determine a common ECSC roadmap.

In light of this research, we believe that establishing and implementing a common ECSC roadmap with a view to promote a standardisation of national cyber security competitions has the potential to make the ECSC the EU flagship policy in the field of cyber security education. This would place the ECSC in a primary position to support the objectives of the EU Security Union Strategy for the period 2020-2025. We believe so because we currently do not see many other policies that, like the ECSC, could potentially involve 20.000 students, provide solid cyber security training to almost 1.000 individuals and give such visibility to EU efforts in cyber security policies.

The interviews with national experts and the survey found that the main objectives a national competition should meet are:  Identify young cyber security talent  Increase interest in cyber security as a topic  Increase cyber security knowledge and skills  Increase interest in a cyber security career and connect participants with employers  Create a network of young cyber security specialist

National experts identified six main factors that are conducive to achieve these objectives (section 3), namely:

 Policy relevance  Governance and Public-Private Partnership (PPP)  Funding  Public relations and marketing strategy  Organization, training and cyber security challenges  Connection with employers and career outcomes

Based on the survey results on these key enabling factors (section 4) and an analysis of these results (section 5), this report provides recommendations for the establishment of a common ECSC Roadmap (section 6), if stakeholders wish to develop the ECSC to its fullest potential.

TOWARDS A COMMON ECSC ROADMAP

TABLE OF CONTENTS

1. INTRODUCTION 5

1.1 SCOPE OF THE REPORT 5

1.2 TARGET AUDIENCE 6

1.3 STRUCTURE OF REPORT 6

2. BACKGROUND AND CONTEXT 7

2.1 POLICY FRAMEWORK OF CYBER SECURITY EDUCATION IN THE EU 7

2.2 THE GENERAL CONTEXT OF CYBER SECURITY COMPETITIONS 8

2.3 SHORT HISTORY OF ECSC 10

3. IDENTIFICATION OF KEY ENABLING FACTORS 12

3.1 INTERVIEWS WITH NATIONAL EXPERTS AND LITERATURE REVIEW 12

3.2 RESULTS OF INTERVIEWS AND LITERATURE REVIEW 12

3.2.1 Policy relevance 14 3.2.2 Governance and PPP 14 3.2.3 Funding 16 3.2.4 Public relations and marketing strategy 16 3.2.5 Organization, training and cyber security challenges 17 3.2.6 Connection with employers and career outcomes 21

4. CURRENT STATUS OF NATIONAL CYBER SECURITY COMPETITIONS 22

4.1 NATIONAL CYBER SECURITY COMPETITION OBJECTIVES 22

4.2 POLICY RELEVANCE, GOVERNANCE AND PPP 22

4.3 FUNDING 24

4.4 PUBLIC RELATIONS AND MARKETING STRATEGY 25

4.5 ORGANIZATION, TRAINING AND CYBER SECURITY CHALLENGES 25

4.5.1 Recruitment and phases of the competition 25 4.5.2 Cyber security challenges, training and technological infrastructure 30

4.6 CONNECTION WITH EMPLOYERS AND CAREER OUTCOMES 33

TOWARDS A COMMON ECSC ROADMAP 5. OPPORTUNITIES AND CHALLENGES FOR A COMMON ECSC ROADMAP 35

5.1 NATIONAL CYBER SECURITY COMPETITION OBJECTIVES 35

5.2 POLICY RELEVANCE, GOVERNANCE AND PPP 36

5.3 FUNDING 37

5.4 PUBLIC RELATIONS AND MARKETING STRATEGY 38

5.5 ORGANIZATION, TRAINING AND CYBER SECURITY CHALLENGES 38

5.5.1 Recruitment and phases of the competition 38 5.5.2 Cyber security challenges, training and technological infrastructure 40

5.6 CONNECTION WITH EMPLOYERS AND CAREER OUTCOMES 41

5.7 ENISA’S ROLE 42

6. CONCLUSIONS AND RECOMMENDATIONS 43

6.1 POLICY RELEVANCE, GOVERNANCE AND PPP 45

6.2 FUNDING 45

6.3 PUBLIC RELATIONS AND MARKETING STRATEGY 46

6.4 TRAINING AND THE COMPETITION 47

6.5 CONNECTION WITH EMPLOYERS AND CAREER OUTCOMES 48

6.6 ENISA’S ROLE 48

TOWARDS A COMMON ECSC ROADMAP

1. INTRODUCTION

There is a shortage of cyber security professionals in the labour market. According to the latest figures, the 2020 cyber security workforce gap lies at 3.1 million worldwide, with 56% of security experts thinking that cybersecurity staff shortages are putting their organizations at risk. Other estimates suggest that the global cyber security workforce would need to grow by 89% if organizations were to defend their critical ICT assets effectively.

Against this background, governments have implemented various programs and policies to increase the number of professionals entering the cyber security labour market. National cyber security competitions (NCSCs), in the form of capture the flag events among teams of students, have been among the most widespread tools to address the cyber security skills shortage. There are now several national cyber security competitions worldwide, including in Asian, English-speaking and European countries. The European Union (EU) organizes through the European Union Network and Information Security Agency (ENISA) and the European Commission (EC), the European Cyber Security Challenge (ECSC). The ECSC is the pan- European cyber security competition that aims at enhancing cybersecurity talent across Europe and connecting high potentials with industry leading organizations. The latest edition of the ECSC, in 2019, took place in Romania and saw the participation of approximately 200 young cyber security specialists and 20 national teams.

In this context, ECSC stakeholders have started to reflect upon ways to strengthen and improve ECSC outcomes. At end of each year’s competition, ENISA produces an “ECSC Analysis Report” where it analyses lessons learnt about the current ECSC in relation to past editions. However, these reports focus only on the planning and implementation of the ECSC and not on the various national cyber security competitions that select the participants who will later attend the ECSC.

Against this backdrop, ECSC stakeholders aim to deepen their understanding of the key elements that make a national cyber security competition successful and therefore strengthen the outcomes of both national competitions and the ECSC.

1.1 SCOPE OF THE REPORT

The objectives of this report are to identify the key success factors of a national cyber security competition, collect data on these key factors and provide an overview of the current status of national cyber security competitions in the EU and ECSC partner countries.

The expected impact of this report is to provide national organizers with preliminary insights and an evidence-based platform to discuss the realization of a common ECSC Roadmap. In doing so, the report will highlight the technical and organizational factors that are necessary for the implementation of a Common ECSC Roadmap and will provide policy recommendations for both the short term and long-term implementation of this Common ECSC Roadmap.

TOWARDS A COMMON ECSC ROADMAP 1.2 TARGET AUDIENCE

The target audiences of this report are:

 The organizers of the national cyber security competitions that select team attending the ECSC;  The EU institutions involved in the organization and planning of the ECSC, most notably ENISA and the EC;  The stakeholders that benefit from the success of national cyber security competitions, including academia, national governments and the private sector.

1.3 STRUCTURE OF REPORT

This report is organized as follows:  Section 1, “Introduction,” gives an overview of the report, states its objectives and target audiences;  Section 2, “Background and context,” puts national cyber security competitions and the ECSC in perspective;  Section 3, “Identification of key enabling factors,” presents the most important elements that national and EU experts have identified as conducive to the success of national cyber security competitions;  Section 4, “Survey results,” collects data on these key factors from national cyber security competitions leading to the ECSC; in doing so, it provides an overview of the current status of national cyber security competitions based on the key factors identified by experts;  Section 5, “Opportunities and challenges for a Common ECSC Roadmap,” analyses the survey results in light of section 3;  Section 6, “Conclusions and recommendations,” summarizes the report and provides short- and long-term recommendations for the realization of a Common ECSC Roadmap based on the analysis of section 5.

TOWARDS A COMMON ECSC ROADMAP

2. BACKGROUND AND CONTEXT

2.1 POLICY FRAMEWORK OF CYBER SECURITY EDUCATION IN THE EU

The EU started to devote interest in cyber security education and skills since the publication of the of the first EU cybersecurity strategy in 2013, when member states were encouraged to increase efforts in education and awareness activities in network and information security topics.

In the 2017 Joint Communication “Resilience, deterrence and defence: Building strong cybersecurity for the EU,” the EU reiterated that “there is a strong education dimension to The EU has been an cybersecurity” and that “effective cybersecurity relies heavily on the skills of the people active player in the concerned.” In the Communication, the EU pledged to develop cyber security skills by building development of on the work of the Digital Skills and Job Coalition and by establishing a European cybersecurity cyber security skills industrial, technology and research competence centre, as well as a network of national and the new EU

5 Security Union

cybersecurity coordination centres.

Strategy puts skills

In 2019, four consortiums – CONCORDIA, ECHO, SPARTA and CyberSec4Europe – received and awareness financial support from the EU to run pilot projects for the establishment of a European raising under the cybersecurity competence network and the development of a common European cybersecurity spotlight. research and innovation roadmap. Since their inception, these consortiums have been conducting various activities in the field of cyber security education and skills. For example, they have produced reports on cyber security workforce diversity and a feasibility study on cyber security skills certifications; they plan to publish a cyber skills framework and an overall cyber security education and training framework.

In 2020, the EU Security Union Strategy dedicated an entire section on skills and awareness raising, which posits that awareness of security issues and the appropriate skills are necessary to build a more resilient society. In the context of the growing reliance on ICT following the Covid-19 Pandemic, threats to IT systems and networks show the need to improve human capacity to deal with such issues. The Strategy indicates that programs such as the Digital Education Action Plan, Digital Europe Program and the future European Research Area and European Education Area will need to include specific measures to build IT security skills in the population.

Against this background, ENISA has an important role in the development of cyber security education and skills in the EU. Besides applied research and studies in topics such as NIS education, public–private partnerships in education and workforce development, the EU cybersecurity agency has a leading role in the organisation and implementation of the European Cyber Security Month, an EU-wide awareness campaign fostering cybersecurity knowledge

TOWARDS A COMMON ECSC ROADMAP

among citizens through the promotion of education, sharing of good practices in data and information security.

Most recently, ENISA has also launched the Cybersecurity Higher Education Database, an interactive map that lists and provides useful information on cyber security degrees across Europe. The Database aims to become the main point of reference for all citizens looking to upskill their knowledge in cybersecurity in the EU . Furthermore, the Agency is in the process of developing a European Cybersecurity Skills Framework, whose objective is to create a common understanding of roles, competencies, skills and knowledge in the field of cyber security with a view to address the lack of cyber security professionals in the labour market.

Finally, and most importantly for the purpose of this report, ENISA organizes together with the European Commission and member states the European Cyber Security Challenge, the EU cybersecurity competition aimed at increasing talent across Europe and connecting highly skilled individuals with leading industry organisations.

2.2 THE GENERAL CONTEXT OF CYBER SECURITY COMPETITIONS

National cyber security competitions have been increasingly used as a tool by governments around the world. There are several objectives that national cyber security competitions are touted to achieve, including encouraging young people to pursue a cyber security career, nurturing students’ interest, attracting talented individuals to the field and, ultimately, meeting cyber security skills demands to generate a self-sustained cyber security workforce.

Table 1: Cyber Security Competitions Key Objectives according Countries in the Five Eyes Intelligence Alliance

Country and Author Quote

European Union

TOWARDS A COMMON ECSC ROADMAP

There are various examples of national cyber security competitions that are now an integral component of governments’ cyber security workforce development strategies, most notably in English-speaking and European countries.

For example, Australia extensively deploys cyber security competitions such as CyberTaipan, which is a competition open to young people between 12-18 years-old with an interest in cyber, Cybersecurity defence, puzzles and code breaking. It is organized in several rounds and the winning teams competiotions have represent their schools at the national finals. The objectives of the organizers are: 1) to improve been implemented both awareness of and interest in cyber security careers and education pathways; 2) improve worldwide with the

18 goal to reduce the

fundamental technical cyber security skills. According to a senior industry leader involved in the organization of such competitions: “STEM education is vital to the future of Australia and its shortage of cyber national security. Programs such as CyberTaipan play an important role in teaching not only security technical skills, but also professional skills such as leadership, communications, collaboration professionals and teamwork.”

In the UK, Cyber Discovery is a government-funded extracurricular programme for secondary students aged 13-18 to ensure that as many people as possible enter the cyber security profession in the coming years. Cyber Discovery is a free-online programme which is designed around four phases. Students who score the highest in the four phases are then invited to a final on-site bootcamp/capture-the-flag event. In the first edition of the programme in 2018, nearly 24,000 students signed up to the first phase, while 170 were then invited in a faceto-face training bootcamp in Manchester. The program is among the policy interventions foreseen in the “Initial Cyber Security Skills Strategy” and has a budget of £20 million. According to the UK government: “Cyber security is an integral part to the UK making the most of the digital age, and programmes like Cyber Discovery and the NCSC’s CyberFirst are helping young people develop skills that lead to dynamic and rewarding careers. Investing in these initiatives will make a huge difference for generations to come, and will help us to find and support motivated, high performers from all backgrounds who want to make a positive impact on the world.”

In the US, three national cybersecurity competitions: CyberPatriot, the Collegiate Cyber Defense Competition (CCDC), and U.S. Cyber Challenge (USCC), have been targeting different communities, from middle schoolers to professionals already in the workforce. The CyberPatriot program was introduced in 2009 to draw more young women and men to education and careers in cybersecurity and STEM fields with a view to meet the needs for an increasingly technical workforce. In the 2018-19 edition, 24,139 students participated in the cyber defense competition, significantly up from the 2010-11 edition when 3,635 students attended.

In the EU, the EC and ENISA coordinate and support the ECSC, which aims at “enhancing cyber security talent across Europe and connecting high potentials with industry leading organizations.” It is based on the premise that “growing need for IT security professionals is widely acknowledged worldwide” and many countries in the EU have organized cyber security competitions “with a clear aim to find new and young cyber talents and encourage young people to pursue a career in cyber security” and “to help mitigate this shortage of skills.” The ECSC also has broader goals: it places cyber security at the service of humankind by promoting a peaceful society, it fosters friendly relations among attending countries, it promotes diversity in

TOWARDS A COMMON ECSC ROADMAP

cyber security and overall it sustains EU policies to combat cybercrime and on cyber security more generally.

2.3 SHORT HISTORY OF ECSC

The ECSC is the annual pan-European and multinational cyber security competition where national teams of young individuals aged between 16-25 years-old compete against each other in a capture the flag (CTF) event, which typically involves challenges in domains such as web security, mobile security, crypto puzzles, reverse engineering, and forensics.

The first edition of the ECSC took place in Austria in 2014, when three national teams – Austria, Germany and Switzerland – competed against each other in challenges such as APT network forensic, java hash collisions, HQL injections and license key circumventions. In the same year, ENISA conducted a study to identify the status of cyber security competitions which were active 2525 at that time. The report described the experiences of 5 different national cyber security competitions (Austria, Romania, Spain Switzerland and United Kingdom) and outlined a roadmap for a pan-European cybersecurity competition. The study recommended to establish a European Cyber Security Challenge similar to the UEFA football league, whereby each member state organizes a local national competition and the winners of these competitions are then selected to attend the ECSC. The report provided guidelines and recommendations for the implementation of such competitions with a focus on the establishment of a public private partnership to increases cyber security awareness among Europeans and help identifying young cyber security talent.

Since then, the ECSC has expanded each year. In the second edition of ECSC (2015), 6 countries attended, namely Austria, Germany, Spain, Romania, UK and Switzerland. The number of participants rose to 10 in the 2016 edition. In the latest 2019 edition a total of 20 European countries gathered in Bucharest, Romania. The expansion of the ECSC with respect to the number of countries which participated and the top 3 position holders in those competitions is presented in Figure 1.

Figure 1: Number of countries attending the ECSC and top 3 position holders over the years

TOWARDS A COMMON ECSC ROADMAP

To participate in ECSC each country organizes a local national competition in order to select a national team,. Multiple factors are involved in the success of national competitions. One of the objectives of this report is to identify the key factors enabling the success of national cyber security competitions, which is the focus of the following chapter.

TOWARDS A COMMON ECSC ROADMAP

3. IDENTIFICATION OF KEY ENABLING FACTORS

3.1 INTERVIEWS WITH NATIONAL EXPERTS AND LITERATURE REVIEW

This research seeks to identify the key factors enabling the success of national cyber security competitions through two different methodologies, namely interviews with the national organizers of those cyber security competitions leading to the ECSC and a review of the relevant literature.

The researchers conducted 14 in-depth, semi-structured interviews with organizers of national cyber security competitions between June and July 2020. Questionnaires were sent to the national representatives who sit in the ECSC Steering Committee: 12 national organizations replied to the request for interview. The 12 national organizations which were interviewed represent 60% of countries sitting in the ECSC committee and approximately 282 million of the European population. In addition, 2 representatives from EU institutions involved in the ECSC were also interviewed.

This report

Interviews were divided in two parts. In the first part, interviewees were asked to list the objectives of their national competitions, pair them with the indicators that their organizations identifies the key use (or would use) to measure success and finally the most important factors to achieve these

factors enabling

objectives. In the second part, interviewees were asked to list the 5 most important objectives a

the success of

generic national cyber security competition should have (thus regardless of the objectives of their specific national cyber security competitions) and questions on important factors that had national cyber been identified in the literature.

security competitions

The researchers also identified key enabling factors for the success of competitions through a literature review. The relevant literature was found using a keyword-based technique: the through in-depth keywords “cybersecurity competitions” were searched in the “Google Scholar Database”, which

interviews with

provides the meta indexing of the most relevant academic databases such as IEEE, ACM and

national and EU

Springers. At the moment of the search (July 2020), the researchers found 265 entries related to the keyword “cyber security competitions.” Following a review, 25 publications were selected experts as well based on their relevance and were analysed in-depth.

as a review of the scientific 3.2 RESULTS OF INTERVIEWS AND LITERATURE REVIEW literature

Interviews found that national cyber security competitions generally attempt to achieve 4 main objectives:

 Increase participants’ cyber security skills and knowledge;  Identify young cyber security talent, including forming the national team attending the ECSC;  Develop interest in cyber security as a topic and career possibility;  Promote cyber security awareness among participants and the wider population.

Organizers also mentioned other objectives that their national cyber security competition try to achieve, but there was usually less consensus compared to the four objectives listed above. These other complementary objectives are:

 Increase the number of individuals attending the national competition;  Create a community of young cyber security experts;

TOWARDS A COMMON ECSC ROADMAP

 Promote diversity;  Promote moral values such as transparency and other ethical principles;  Encourage open knowledge.

Finally, national experts also mentioned other higher-level aims such as influencing the modernization of the national education system and protecting a country’s IT infrastructure. National organizers identified several indicators to measure whether the competition achieves “success” according to these objectives. This report concentrates solely on the first 4 objectives:

 Indicators of success for “Increase participants’ cyber security skills and knowledge”: o Participants can compete and complete most challenges provided o Number of challenges that are solved by participants The report o Participants better understand cyber threats and risks

identified six

o Higher ranking in international challenges and competition (including the

ECSC) main factors that

o Amount of new learning content produced each year are conducive to o Participants’ performance in future CTFs

the success of a

o Number of participants with above average results in each competition’s round NCSC o Results of feedback questionnaire sent to participants  Indicators of success for “Identify young cyber security talent, including forming the national team attending the ECSC”: o Number of participants attending the national cyber security competition o Number of new participants attending the national cyber security competition o Number of participants and actively involved in solving challenges o Ranking in international challenges and competition, including the ECSC  Indicators of success for “Develop interest in cyber security as a topic and cyber

security careers”:

o Participants establishing new local CTF teams o Participants founding new companies o Participants are actively involved on the competition’s platform o Career fairs are organized and are well attended o Participants obtaining internships or receiving job offers after the competition o Participants enrolling in a cyber security degree o Increased demand for cyber security educational programs o Number of interviews for cyber security jobs that participants undergo  Indicators of success for “Promote cyber security awareness among participants and the wider population”: o Number of participants in the first round of the competition o Number of cyber security discussions in schools o Diffusion of communication strategy and social media presence o Awareness conferences are organized and well attended

National organizers identified six main factors that are conducive to achieve the objectives listed above, which are:

1. Policy relevance 2. Governance and Public-Private Partnership (PPP) 3. Funding 4. Public relations and marketing strategy 5. Organization, training and cyber security challenges 6. Connection with employers and career outcomes

Below, we explain why each of these factors is relevant for the success of a competition based on the explanations provided by national experts during interviews. These factors are not listed or described in order of importance and are presented independently from any of the objectives

TOWARDS A COMMON ECSC ROADMAP

above. This is done because many of these factors could help reach more than one objective at the same time and therefore should be not seen in isolation from each other.

3.2.1 Policy relevance

Although not everyone considers it necessary or even desirable, organizers generally suggest that it is a good sign for a national cyber security competition to have a certain “policy relevance” and for it to be aligned with or mentioned in the country cyber security strategy. This because a national cyber security competition is viewed as a potential solution to mitigate a country-level issue such as the cyber security skills shortage. According to one national expert: “A competition is a relatively easy and practical way to address the cyber security skills shortage, in a qualitative as well as quantitative sense. It would be one of the interventions under the more general topic of capacity building.” Another interviewee adds that “cyber security education should be in the strategy of every country. Enhancing the average knowledge in cyber security and addressing the skills-gap in this area is paramount for the security of a Experts believe

country.” that a NCSC should be

A competition that is policy relevant has the benefit to: “gain credibility and prestige; obtain a

aligned with a

bigger impact and scope; be more stable and adopt a medium-long term strategy; obtain

country national

financial resources more easily.” According to one organizer, a national competition should be coordinated with the government's strategy on the basis of market demands and the country cyber security needs, so that “the competition can be improved and adapted every year, in a changing and strategy rapidly evolving environment.” A national cyber security competition that selects the team attending the ECSC should be a strategic national policy and goal and should clearly distinguish itself from any other CTFs. As one interviewee notices, countries should “make the competition stand out by being THE official qualifier for the ECSC.”

As an example of “policy relevance”, one organizer pointed out that the Italian Minister of Defence and the National Intelligence Chief usually participate in the award ceremony of his national competition and later the national team attending the ECSC is received by the Prime Minister. Policy relevance is also achieved when the various national ministries, and not only the main national cyber security agency, are on board and collaborate to support the competition. One interviewee feels that overall the “support of national institutions is essential.”

3.2.2 Governance and PPP

It was clear from interviews that a perfect governance setting does not exist and that the governance formula of any national cyber security competition depends on several national factors such as for example the presence or not of a dedicated national cyber security agency, funding arrangements, maturity of the national cyber security industry and overall cyber security posture of a country. As one interviewee put it “there is no ideal approach in our view. They all have positive and negative aspects.”

Nonetheless, it is important for a national cyber security competition to have a clear governance structure in place as this heavily shapes the competition’s objectives and outcomes. Even though there was consensus on the absence of a fixed governance formula, there was a certain convergence on the idea that a Public-Private Partnership (PPP) involving the key actors of the national cyber security ecosystem provides numerous benefits to a national cyber security competition. One interviewee stated that the majority of “success stories come from partnerships between government, academia and NGOs,” while another interviewee reflected that “it does not matter who is the leader, it is important to work together.”

TOWARDS A COMMON ECSC ROADMAP

The scientific literature has also highlighted various benefits of a public-private partnerships. According to researchers, a PPP can play a vital role in managing and updating the competition according to workforce requirements and provide a win-win collaboration scheme for both the 2627 public and the private sector. For example, researchers found that technical capabilities and expertise from different academic and non-academic institutions could further assists the development of challenges in future cyber security competitions. This may include incorporating real life cyber security incidents happening in government and private sector, thus making cyber security competitions more relevant to different stake holders.

Organizers also perceive that it is important for governments to be in the front line and support national competitions, especially when these are in their “start-up phase.” Initial government support is needed to avoid the overall message being “hijacked” in favour of other competing Governments objectives that other actors might have. In sum, “the best way would be a balanced or mixed should be model where the government leads the national competition in cooperation with the cyber supporting ecosystem.” Ideally, some sorts of grassroots community/NGO/foundation or academia should

NCSCs,

be responsible for the organization and implementation of the challenge, provided they have the

especially when

necessary know-how. The benefit of having such actors sitting in the front seat would be their independence. Moreover, interviews underlined that it is of essence to involve the private sector they are in their and cyber security practitioners in the competition through various activities, although there is “start-up” phase no consensus on the type of involvement industry should have. For some, companies should provide trainings to participants, for others they should provide the online infrastructure or directly fund the competition.

Against this background, national organizers think that national cyber security competitions should be well connected to the rest of the national cyber security ecosystem. In this sense, it is not only a question of governance and who “controls” or implements a cyber security competition. Rather, it is a question of whether and to what extent a national competition is systematically connected to other relevant cyber security actors and the kind of synergies that these connections create. Because competitions bring together security researchers, professionals, academia, students and companies they contribute “to the reduction of the complexities of the public–private cooperation and increase the visibility of cybersecurity in public strategies on a national level.” Moreover, having links with the rest of the ecosystem is important to build a network of “friends” willing to contribute to the development of young cyber security experts and to look for synergies in the identification of the best talent in the country.

Connecting the various dots of the ecosystem can be advantageous for participants, who will potentially fill roles required by any national cyber security strategy in the future. For the competition, it is an advantage to be part of the ecosystem too as this can be helpful to find other sources of funding and to connect participants with companies. Endorsement of key ecosystem players can help to attract newcomers and make the competition more exciting for senior participants. But this relationship can be valuable to the industry as well, as “involving more actors is the right way, not only in cost saving terms but also because of the importance that this relationship with the ecosystem brings up to promote and foster the cybersecurity industry.”

TOWARDS A COMMON ECSC ROADMAP 3.2.3 Funding

National experts inevitably stressed the importance of having appropriate funding to achieve the competition’s objectives. This is felt particularly among national organizers who do not receive a regular, medium to long-term budget from their respective governments or in those countries where it is difficult to attracts sponsors, mostly because of the absence of a well-established cyber security industry.

As per the governance structure, a perfect funding arrangement does not exist. The financing model usually depends on the country peculiar situation in terms of economic fundamentals, government’s support and private sector sponsorships. However, also in this case there is a convergence towards a mixed/combined model where costs are shared among the key actors that are involved in and benefit from the competition, most notably the government and the private sector. A combined approach is preferable mainly because “a national competition, and a national education program in cybersecurity is profitable for everyone involved” and because “the development of cyber security talent is not solely the responsibility of one of these parties.” According to The obvious benefit of having different sources of funding is to limit the disruption which may national experts, occur when the competition’s main sponsor stops providing funds and to limit potential disputes

the EU should be

between funders who might also be industry competitors.

co-sponsoring member states’

In the national organizers view, an initial investment by the government is needed to start off on the right foot and “to give the competition a sense of neutrality and importance.” Furthermore, NCSCs according to one interviewee, a national government must support a national cyber security competition “as it is its duty to ensure the future of its young people, to cultivate and utilize their knowledge and skills and to help them in any way it can, so that they can succeed their professional goals.”

Being the national competition generally the first step in the creation of national teams that later compete in the ECSC, national organizers feel that the European Union should also co-fund national cyber security competitions: “The European Union, from the beginning of its creation, has as a goal to empower the progress and development of every country that it represents, by cultivating culture and the economy. Therefore, financing a national competition which cultivates and promotes the talents of young people seems as an obligation on the one hand; on the other hand, it seems necessary for member states to share the European Union’ knowledge about organizing, conducting and coordinating such a competition.”

3.2.4 Public relations and marketing strategy

Organizers emphasize that national cyber security competitions should have a public relations and marketing strategy: it is “very important to assure an overall promotion. (There is) No need to organize a competition when nobody knows about it.” According to one interviewee, “public relations are about sending the right messages at the right time, to the right people and creating a dynamic interaction with the general public. A major goal of public affairs is to communicate an event to ensure that it will be covered by the press and to create a presence on the Internet and other media.”

A public relations and marketing strategy help achieving multiple purposes. First of all, it is important for the promotion of the event and to reach out to potential participants. It is crucial at the beginning for raising interest among students, but also later when information on the training and the final challenge is released and when it is necessary to keep the interest of students high. This in turn helps achieving another potential objective of the competition, namely, to increase the yearly number of participants and possibly diversify their gender and educational backgrounds. An effective strategy is helpful to reach out to communities of individuals that may have the necessary skills and knowledge to join but are not aware of institutionalized cyber

TOWARDS A COMMON ECSC ROADMAP

security competitions. This market strategy is also important to ensure that the event achieves

visibility for the sponsors and the rest of the national cyber security ecosystem. As one

A public

interviewee acknowledged “a good PA strategy provides visibility to the event and consequently

relations and

attracts more sponsors. This would allow to provide better resources and even organize better events for the participants.” Finally, a communication strategy might also be paramount if a marketing

competition was designed to raise cyber security awareness in the general public. strategy is

essential to

Because a public relations and marketing strategy is useful to achieve different objectives, it

achieve

should be clearly articulated in order to target the right kind of audience. An interviewee stated

important

that there are at least 5 different groups that such a communication strategy should take into account, namely the public, the industry, the education sector, the (potential) participants and NCSC’s goals,

other countries involved in the ECSC. Therefore, “the key to this matter is to know your including

audience well and be able to identify the appropriate channels to reach them.”

recruiting participants and

A communication strategy is also valuable to build a positive narrative around cyber security as

give visibility to

a topic and as a craft, dispelling the myth of hacking as a criminal activity. The strategy would also be important to create a narrative about the competition’s success stories, for example the event and

when former participants go on to found a company or obtain a highly coveted cyber security sponsors

job.

As a national cyber security competition usually caters to participants in their schooling age, the

communication strategy should directly involve the national ministries of education as well as high schools and universities. A communication strategy should use different tools to achieve its

objectives. While it is important to focus on social media to enthuse younger generations, using

traditional media such as the TV and radio might be useful to reach a broader audience, especially the older generations as “all these groups need different approaches.”

National experts 3.2.5 Organization, training and cyber security challenges think that the

3.2.5.1 Recruitment and competition’s phases initial

Notwithstanding the possibility of having different approaches based on specific national recruitment

objectives, organizers tend to agree that the initial recruitment and admission process of a

should include

national cyber security competition should include the largest and most diverse group of

the largest and

individuals possible. This is true regardless of whether their countries are able to implement

28 most diverse

such principle. One organizer stated that his national cyber security competition is open to any individual from 9 to 24 year-old. Furthermore, more than one organizers stress the importance group of

of increasing the participation of females and individuals with an educational background

individuals in an

different than computer science: “In the online phase, what we are looking for is the largest

effort to attract

number of participants, promoting equal opportunities around the country. Everyone should

more young

have the chance to take part.” The importance of involving a diverse group of participants has

29 30 31 32 33 talent to cyber

been highlighted in the literature as well namely the ratio of the different genders involved in the competition, their performances in solving different kind of challenges, security

differences and commonalities in their problem solving approaches and weather a special

TOWARDS A COMMON ECSC ROADMAP

measure is taken to encourage the participation of diverse groups and participants from non- STEM backgrounds to increase awareness in public.

To do this, national competitions should design a communication campaign that reaches out to potential participants in a timely manner, focusing on schools and being potentially supported by coaches and former alumni to attract newer recruits. Even in the recruitment and admission process “having a public affairs strategy is decisive.” When planning the recruitment process, it is important to win the trust of potential participants, which means gaining the acceptance of the local CTF teams and communities that would not normally attend institutionalized national cyber security competitions. One interviewee posits that “finding the best hackers is a nice slogan,” but there is a lot of talent who is not attending national cyber competition because “they do not like the word cyber, mainly for its military or governmental connotations.”

While it is again recognized that different approaches are possible depending on a country specific objectives, organizers generally think that national cyber security competitions should comprise of at least two phases, namely a national qualifier and a final challenge: “The

NCSCs should

admission process should involve two phases of selection, which gradually lowers the number

have at least two

of potential participants. The final goal is a small group of elite students.” These two main

phases: one to

phases may be preceded by an additional admission process with a view to pre-screen candidates, although this would need to be balanced against the objective of creating the recruit largest possible interest in the competition and have the highest possible number of participants participants and at least at the beginning.

teach cyber security

Especially when a longer initial first phase is foreseen, a two-phase competition is considered

knowledge and

appropriate as the first part is concerned primarily with teaching cyber security knowledge and skills and raising awareness, while the second part has the objective to identify and choose the skills and one to participants who are going to be part of the national team attending the ECSC. Regarding the select an elite logistics of the two phases, one organizer suggests that “the first selection should be remote;

team of students

the training phase ideally distributed/remote; and the finals on-site.”

attending the ECSC

3.2.5.2 Cyber security challenges, training and technological infrastructure

The creation of the challenge(s) is also a key factor to ensure the success of a national cyber security competition. This will depend overall on the design and the objectives of the competition, but the types of challenges usually range from jeopardy style, attack-defence and online wargames. Organizers underlined the need to plan the creation process of the challenge well in advance. According to one interviewee, the optimal challenge creation process consists of mainly 4 phases: 1) design/brainstorming phase, when challenge creators produce a rough draft; 2) collaboration/deployment process, when the challenge is deployed in the competition environment; 3) review process, when someone other than the creators attempt to solve the challenge(s) to verify it is solvable; 4) a final phase when the reference solutions are created. Moreover, it is important to create challenges that support the improvement of cyber security skills of all participants: “challenges should be prepared so that everyone is able to enjoy the competition. There should be a wide range of difficulty so that both beginners and proficient players can solve some challenges. Enjoyable competitions are a good advertisement for future events.”

TOWARDS A COMMON ECSC ROADMAP

The importance to create appropriate challenges according to different skill levels has been 34 35 36 37 38 found in the literature as well. Researchers investigated participation of individuals in cyber security competitions based on the technical skills they were required to show. 28,37 Researchers investigated whether the difficulty of task performed using specific skills was

accurately reflected in the final scoring. Dynamic scoring depends on multiple factors which include the time it took for the task to be completed and how many participants completed it. 39 40 Based on this variables, the task score changes. Researchers investigated the age group and prior experience of competition participants and how these effect their final ranking in the 41, competition. As different age groups have different competencies level, researchers

investigated how to create balanced challenges for participants and adapt the difficulty level of the competition. In turn, this will motivate beginners to attend and build self-efficacy as they Cyber security

increasingly master cyber security challenges.

training should 42 43 44 be a core

Researchers found that other factors that may motivate people in participating the

element of a

competition is how the competition is represented. In CTFs, most of the time one can find a scoreboard with very little or no audience engagement. For motivating people, there should be NCSC, improving

visible and understandable actions going on and a commentary, which can help make sense of both cyber

things for people with little or no understating of cyber security. This can be used to raise

security

awareness and motivate individuals to participate in similar competitions. National organizers

technical

tend to underline the importance of training as one, if not the main, component of a national

proficiency and

cyber security competition: “Apart from the participants’ skills, the training is, without doubt, the most important factor for a cyber security competition, since the team is educated to collaborate, soft skills

practice under pressure and get deeper in cyber security issues.” For another interviewee,

training should not be considered as an added value to the competition, but it should be viewed

as a core element.

Organizers suggest that “the main purpose of cybersecurity education and any other training program must be to build technical proficiency in their students,” although there is unanimity in

considering the training of the so-called “soft skills” (leadership, teamwork, self-learning etc.) as

important as teaching them core computer science/cyber security skills. Traditional subjects of

training include topics such as software security, cryptography, web security, hardware security etc. At least one organization takes this one step further by designing “the preselection and

training challenges taking into account the ECSC Curriculum, NIST-NICE categories, and most demanded skills in the sector,” with the objective of “building tomorrow’s workforce.”

Apart from this common understanding, however, organizers highlighted very different approaches on several key aspects of training, which profoundly shapes not only how the

training is designed and delivered, but also how the whole national cyber security competition is

conceptualized and its outcomes. It is important to stress that these differences are most of the

TOWARDS A COMMON ECSC ROADMAP

time enhanced or due by the presence (or lack thereof) of appropriate funding as well as suitable human and technical resources. The main differences concern:

 Type of training: This can range from solving challenges online that are permanently accessible and playing CTFs, to more theoretical and conceptual lectures delivered face-to-face. In the middle, there are often combined approaches with a mixture of online training, on site lectures, CTFs and other online gamified activities. The type of training/challenge depends on how the national cyber security competition is conceived. For example, an interviewee pointed out that the difference between permanently accessible online games versus CTFs. In the interviewee’s opinion, using online games improves domain specific knowledge as there is usually more time to understand the concepts behind the game; on the other hand, CTFs improve collaboration between participants and communication skills, but they are not necessarily conducive to learning because of the time pressure participants are usually

There is no

under to solve puzzles.

agreement

 Duration: The duration of the training/challenge depends again on how the national

among national

cyber security competition is conceived. In some countries, the national competition is used only to select participants for the ECSC national team. In this case, the “training” experts on a should be considered more like a CTF competition, which may last for as little as 24-48 standardized hours. In other countries, where increasing cyber security knowledge and skills is a top

cyber security

priority, a formalized in-person training may last up to 6 months. Again, in between

training. National

these two extremes, there are different approaches, ranging from 1 week to some

approaches vary

months of training.  Target group: Again, the target group of the training/challenge is chosen depending greatly on how the national cyber security competition is conceived. In some countries, all depending on participants signing up to the national qualifier receive some sort of “training,” often in

NCSC’s

the form of online CTFs that are designed according to different skills levels; in other

objectives and

countries only the participants who win the final challenge who are then selected to form the national team receive training; in the middle, there are different variations resources which might entail, for example, online training/competition for people signing up to the national qualifier and on-site training for a smaller group of individuals who then attend the ECSC.

Last but not least, national organizers need to make some choices around the kind of technological/technical platform to deliver the training and/or the challenge . To some organizers, the platform choice is crucial when designing the training of the national competition: “the most crucial factor to the national competition’s success is the online platform that is used. Such a platform should allow its users to test, train and enhance their penetration testing skills, as well as to exchange ideas and methodologies with other members.” The platform should be reliable in order to support the challenge, as well as to be secure so that it is not compromised during the event. It should also offer a good communication tool for participants and organizers. Lastly, it should provide consistent report for the correct assessment, selection and follow up of the participants.

In general, national cyber security competitions have been relying on a variety of technological tools, ranging from self-developed cloud-based platforms to commercially available solutions. Again, this will vary according to the competition’s nature, objectives, number of participants but above all the intended goal of the training/challenge. Organizers do not seem to agree on a specific type of infrastructure over another: “This could be a self-developed platform, an open source platform or challenges provided on a server with the solutions sent to an e-mail address.” However, some of the requisites are: “online environment with different level

TOWARDS A COMMON ECSC ROADMAP better 3.2.6 Connection with employers and career outcomes understand

As one of the objectives of a national cyber security competition is to increase interest in cyber

cyber security

security careers, national experts agree that establishing and strengthening relations with

employers careers and jobs

is a key factor, especially so if it is true that “we do not need hundred thousands of cybersecurity experts, but we need hundred thousands of cybersecurity workers.” The importance of cyber security competitions’ career outcomes is highlighted in the literature as well. Cyber security competitions are organized not just for personal gratification of individuals and teams but to encourage people to choose cyber security as a career option and reduce the ever-increasing cyber security workforce shortage. According to researchers, providing mentoring and career counselling to participants during the competition will motivate them to choose cyber security as a career path.

Organizers believe that this is achievable by creating a network of people and organizations working in cyber security. This network would make possibilities in cyber security careers more visible and/or make it easier for participants to find internships and other job opportunities after the event. Being part of this network yields clear benefits to employers as well, who are often able to meet and evaluate students who have undergone a rigorous selection process as well as have received relevant training.

Networking events and career fairs are perfect venues for connecting participants with employers. For example, one national cyber security competition runs a “cybersecurity employment and talent forum,” which is a meeting point for young talents, future professionals, and the most relevant entities in the field of cybersecurity.” It comprises many activities designed to show students what it is like to work in the industry and inspire them to consider a cyber career. It gives students the chance to meet experts, explore potential jobs and educational opportunities and learn about practical next steps. In this forum, actions are taken “to normalize and not mythicize cyber security careers.” This shall be done by presenting the different career options and making sure there is support for any student with the skills for a career in cyber security. When connecting to employers, the national competition should inform participants about the different types of cyber security roles available and the career paths leading to those.

Ideally, in the design phase, the national competition should consider what profiles and skills employers are looking for and help them communicate their critical workforce needs and skill shortages. According to one interviewee, “if the communication between learning institutions and companies (employers) is improved, this will lead to a consensus between the needs of the industry and cybersecurity talent.”

TOWARDS A COMMON ECSC ROADMAP

4. CURRENT STATUS OF NATIONAL CYBER SECURITY COMPETITIONS

Based on the key enabling factors in section 3, the researchers created a survey to collect data on these factors and provide a picture on the status of national cyber security competitions in the EU and ECSC partner countries. The survey was sent to the ECSC steering committee on 14th July and closed on 28th August. It was filled by 20 countries out of 22 countries that are listed on the ECSC’s website. Given the response rate (90%), the survey provides a reliable indication of the status of national cyber security competitions. The results from the survey are presented below.

4.1 NATIONAL CYBER SECURITY COMPETITION OBJECTIVES

The survey asked national organizers to identify the 4 most important objectives that their national cyber security competition is set to achieve. The graphic below shows what the organizers consider the five most relevant objectives.

Figure 2: Most relevant objectives

Another important objective which however did not make the top five is “raise cyber security awareness” (11%), whereas other objectives such as increase diversity (5%), promote ethics (3%) and modernize the education system (1%) do not seem as popular.

4.2 POLICY RELEVANCE, GOVERNANCE AND PPP

Only 40% (8/20) countries report their national cyber security competitions to be mentioned in or aligned with their national cyber security strategy. Another 40% (8/20) of countries say their competitions are “somewhat” mentioned or aligned. The remaining 20% of countries either are not aligned, or organizers are not aware of it.

In most countries (55%), national cyber security competitions are organized and implemented by a combination of actors. As an example of this arrangement, the ACSC Austria Cyber Security Challenge is organized by Cyber Security Austria (CSA) a private non-profit

TOWARDS A COMMON ECSC ROADMAP

organization, the Ministry of Defence, the Ministry of Internal Affairs, the Ministry for Digitalization and Economy, the Ministry of Education and the Federal Chancellery, as well as most Austrian universities of applied sciences.

In Belgium, the competition originally started as a private sector initiative with support from the government, but it is now a separate non-profit organization which is in charge and has a strong support from multiple government departments. In 35% of countries, it is either the education sector or an NGO that have a pivotal role in the organization and implementation of the competition. In only 10% of countries this is done by either the government or the private sector only.

Most governments (60%) support cyber security competitions through partnerships and/or collaborations and 20% provide support “somewhat;” 20% of governments do not provide any support. For example, the Cyprus National Team receives funding from the Cyprus Digital Security Authority and the whole competition is promoted to all schools through the Ministry of In more than half Education, Culture, Sports and Youth. In 2021, the national competition will be promoted also

of NCSCs, it is a

by the Ministry of Defence to all armed forces. The Digital Security Authority, the Ministry of

combination of

Defence and the Cyprus Police are part of the competition’s advisory board. Moreover, officers from the above organizations participate as mentors. actors that

organizes and

In Italy, the national cyber security competition is organised by the Cybersecurity National implements the Laboratory who signed strategic agreements with the Security Intelligence Department and the

competition. This

Ministry of Defence. In the Netherlands, the government has a leading part in building and

is in line with

hosting online CTFs to be used during the national competition, which is similar to what

what experts

happens in Switzerland where the government is an official partner supporting the competition with funding and occasionally with human resources and/or locations for events. suggest

Academia is involved in most countries’ national cyber security competitions (65%), providing an array of services and performing multiple tasks. In 25% of countries the education sector is “somewhat” involved. For example, in Estonia, the education sector directly organizes and implements the national cyber security competition. In France, it is responsible to provide training to the students selected to attend the ECSC, which is similar to what happens in Norway, where the Ministry of Justice and Public Security tasked the Norwegian University of Science and Technology to select and train the Norwegian national team for the ECSC.

In Germany, the Cyber Security Challenge Germany (CSCG) has been founded by the Institute for Internet-Security in Gelsenkirchen, which is well connected to the Westfaelische Hochschule, a university of applied sciences in Gelsenkirchen. The CSCG is also connected to several universities to promote the national competition. In Italy, 28 academic institutions (27 public universities and 1 military academy) are in charge of the 3-month long training within the cyber security competition.

Private sector is involved in the vast majority (80%) of national cyber security competitions; in 15% of competitions, the private sector is only “somewhat” involved. In most cases, the main role of the private sector is to provide sponsorships and financial resources. For example, in Cyprus, the private sector participates with mentors (individual volunteers), gives financial support through sponsorships and provides free access to training platforms to the team members and some mentors; they also participate in the National Advisory Board. In Ireland, private companies sponsor the competition, with some providing logistical support and bespoke challenges. In Romania, the private sector supports the competition with financial, technical, and human resources.

TOWARDS A COMMON ECSC ROADMAP 4.3 FUNDING

The survey asked national organizers to state the overall budget of their national cyber security competition, but only 12 out of 20 countries provided estimates. Although it is unclear to what extent the Covid-19 health emergency had an impact on these figures, the (total budget estimate for these 12 national cyber security competitions is €733.000. If one dismisses the highest and the lowest amounts, the average budget for 10 competition is approximately €37.000.

In this context, only 25% of national cyber security competitions declare to have enough financial resources to achieve the competition’s objectives. Most competitions (40%) state to have “somewhat” enough resources while 30% say to not have enough resources.

The survey also asked what activities would be implemented if more resources were made available. The four most mentioned activities are:

 Further development and provision of cyber security training, including quantity and

There are several

quality of challenges, but also training platforms and trainers;

activities that

 Increase in the number of students attending the competition, including larger on-site

events; NCSCs would

 Support ECSC’s travel and accommodation costs; improve if they  Promotion, communication and awareness raising activities.

received more financial

Most (65%) national cyber security competitions are funded through a combination of sources.

resources,

The most popular formula is usually a combination of resources coming from the government and the private sector, although it is not unusual to have the education sector and/or some including further NGOs contributing to the budget. Overall, from the limited data provided by countries, it seems developing their that when the competition is funded by a combination of actors, the private sector is the one

cyber security

contributing the most. For example, in Switzerland the national completion organizer receives

training

their funding from a combination of government, private sector and a philanthropic entity. They also organize side events like cyber security conferences during the completion and sale tickets’ events for funding.

Only 35% of national cyber security competitions rely on a single source of funding: 25% rely on only government funds and 10% rely on private sector resources. Interestingly, one country mentioned that it is planning on shifting from a funding model based exclusively on government support to a financial model based entirely on private sector sponsoring.

Most national organizers (80%) believe that the EU should fund national cyber security competitions and 53% of them believe the EU should cover at least 40% of national cyber security competitions total costs. They provide several reasons why this should be the case. According to one organizer, “the ECSC is a European event that can be a force multiplier for Europe by building both formal and informal networks of cyber security specialists. This is of value for both EU as a whole and for each nation.” By supporting national cyber security competition, the EU would invest in a more resilient cyber future for Europe. For another organizer, by already funding its own competition, a country shows its commitment to make a national challenge part of the country’s cyber security capacity building effort and EU cosponsorship would contribute to this objective. This would be useful as “a part of a pan- European action/plan. It would encourage more collaboration, more integration, more networking and a closer working relationship between states.” Moreover, in countries where cyber security is not considered a priority, EU co-funding would help raise the attention on the topic. Finally, in a post Covid-19 era, it is possible that resources will be redirected towards other sectors and tasks, despite the importance of educational cyber security activities.

TOWARDS A COMMON ECSC ROADMAP 4.4 PUBLIC RELATIONS AND MARKETING STRATEGY

Most national (60%, 12/20) cyber security competitions have a communication and public affairs strategy; 40% of competitions claim to have “somewhat” of a strategy. For example, in Austria, the communication strategy addresses 4 main target groups: public and private sectors, academia (teachers and professors), potential participants (students from 14 up to 30 years-old) and mass media (primarily online media).

In Germany, the national competition is working together with some news outlets like heise.de and golem.de, which are well known it-news pages in Germany. The competition is also working together with an influencer with 500.000+ follower on YouTube. In Italy, the communication of the national cybersecurity competition is managed by a specialist social media manager and journalists in charge of public affairs and communication management.

In Poland, there is a communication plan which describes: a) target audience, i.e. universities and faculties from which potential participants come from; b) social media, blogs, news websites that should know about the competition; c) schedule and content of the information the competition provides before it takes place. In Spain, INCIBE, the organization in charge of organizing the Spanish national cyber security competition, has been building strong visibility on traditional and social media channels during and after the event last year.

Almost half of national competitions (45%) have an audience engagement platform, while another 45% do not have any; for 10% of competition is unknown whether they have it or not as indicated . For example, in Belgium, there are announcements and there is a scoreboard, but this is more aimed towards participants and not for the public. In Germany, there is an official scoreboard for the online qualification as well as the finals. In Ireland, the competition actively uses use social media, especially Twitter, for updates and engagement and it is planned to have a commentator on site to give updates.

In the Netherlands, there is a live streaming throughout the day with interviews with organizations, sponsors and jury. Rankings are shown during competition as well as the final results. In Spain, there is speaker who encourages the participants and audience during the finals, but there is no engagement platform in the online rounds.

4.5 ORGANIZATION, TRAINING AND CYBER SECURITY CHALLENGES 4.5.1 Recruitment and phases of the competition

The survey asked how many people signed up to the initial admission phase/round of the latest edition of national cyber security competitions and how many are “active” users. Results are provided Table 2:

TOWARDS A COMMON ECSC ROADMAP

Table 2: Number of participants in national cyber security competitions

Country Signups Active users

There are big

Austria 600 250 (40 “very” active) differences in the Cyprus 157 65 ability of

Czech countries to

Over 5.000 From 3.000 to 4.500

Republic

recruit

Estonia 300 100

participants and France 2.000 - keep them active

770 (junior and senior category) throughout a Germany 200 (junior and senior category 1068 (open competition)

NCSC

Greece 50 - Ireland 300 - Italy 4.452 518 Malta 20 - Netherlands 145 145 Norway 158 55 Poland 77 38 (solved at least one challenge) Portugal 42 - Romania 500 250 Spain 1.792 168 Switzerland 1.000 200-100

17.363* 1.989* Total

(*17 countries) (*11 countries)

Overall, the 17 national cyber security competitions providing data totalled 17.363 signups; of these, 1.989 were “active” users although it is important to notice this figure is the result of data provided by only 11 countries only (Table 2).

There is a variety of means, instruments and targets that national cyber security competitions use to recruit students to attend their activities and, most of the time, the recruitment is part of a larger communication and public affairs campaign. As the competition is geared towards students, collaboration with the education sector (mostly higher education and secondary schools) and use of social media are widely spread. Some competitions also rely on their network of former contestants and word of mouth.

For example, in the Czech Republic, dissemination activities to encourage participation are done through different channels and using different approaches: 1) Direct contacts with schools and their students; 2) via founders and owners of the schools including government and regional government institutions; 3) Through former competition participants, their friends and contacts 4) via NGO with focus on ICT teacher, English language teachers, etc. 5) Using social media and national media (TV, radio) etc.

In Estonia, there is a direct communication channel with schools, which sometimes allow to organize promotional events inside classrooms. Communications are also sent to university students through university mailing lists. Another strategy is to look for networks of young talents and gaining access to them in order to supply relevant information about the competition. Finally, information about relevant activities are sent also to those who already have attended previous events.

TOWARDS A COMMON ECSC ROADMAP

In the Netherlands, in addition to schools and universities, the national competition also reaches out to student organizations and NGOs that support young hackers. Last year's ECSC team members played an important role in reaching out to potential participants.

In Poland, dissemination activities are done mostly through social media and local CTF teams.

In Portugal, the national competition is open to all levels of education (school pupils and university students), therefore the dissemination is made through school, universities and Internet (websites and mainly social networks).

The survey asked what pre-existing knowledge and skills participants need to possess to be able to participate in the first admission round. National cyber security competitions require:

 Cyber security (10%)

With the

 Math (15%)

exception of the

 Basic computer science skills such as web searches and the Office suite (25%)

Czech Republic,

 Intermediate to advanced computer science such as programming (20%)

most NCSCs

 A combination of the above (30%)

tend to have a

Qualitative data show that when national cyber security competitions require a combination of low pre-existing skills most of the time it means that students are initially asked to solve easier

representation of

challenges, but then the expertise level required to advance quickly increases. As one organizer

females

describes one “can start without any pre-existing knowledge but the chance to reach top ranks or mastering the qualifying for the final are not too high - so we recommend having basic network and scripting skills as well as basic cybersecurity skills (early red-teaming).”

Figure 3: Diversity in national cyber security competitions

TOWARDS A COMMON ECSC ROADMAP

National cyber security competitions are mainly attended by male participants. Organizers often report to have only between 5%-10% or lower of female participants attending the first qualifying round as indicated in Figure 2, with this percentage usually dropping even further in the final rounds of the competition.

An exception is the Czech Republic, where the percentage of female contestants in the first qualifying round has been “above average” compared to the rest of national cyber security competitions and on the rise since 2016:

Table 2: Percentage of female contestants in the first qualifying

2016 2017 2018 2019 27% 29% 32% 33%

Against this background, 35% of national cyber security competitions do not have a specific policy with the aim to increase the gender and education diversity of its participants, while 25% state to have one; 40% of competitions declare to have a specific diversity plan “somewhat”. The result of the survey question about promoting gender diversity through specific polices is presented in figure 2.

For example, in Austria a greater participation is encouraged by promoting role models. In Belgium, the national competition works with various female cyber security professionals and other organizations to try to motivate more girls to participate and provide some coaching. In Norway, the national competition reaches out to potential female participants through existing organisations and networks that work on recruiting females to study STEM subjects In Spain, the national competition employs a combination of elements, including a public affairs strategy that targets kids at a young age, and engages with female role models to motivate young women to take part in technical careers.

Only 25% of national cyber security competitions keep involving the participants who do not make to the final round; 25% of competitions declare to keep involving them “somewhat,” while 35% of them do not involve them in further activities. There are different ways that national competitions use to involve the participants who do not qualify, even though the evidence provided by survey results is scarce. For example, in Belgium the challenge writeups are shared by creators to allow all participants to learn as well and not just the participants who have to tackle them in the final round In the Czech Republic, the competition includes an educational component, which engaged over 10.000 in 2019 (but only 3000 in 2020 due to the Covid-19 health emergency).

In Italy, the national cyber security competition started the OpenCyberChallenge.IT (OCCIT) programme in 2020. The OCCIT was open to participants who were not admitted to the cyber security training at the local university and the local/national challenge. Through this programme, participants had the possibility to access cyber security online lectures, crash courses and challenges. Approximately 1.300 students were invited to enrol and 511 accessed it. In Germany and the Netherlands, the competitions foresee a Discord channel where participants can interact.

The survey also asked details about the “admission process” of national cyber security competitions. National cyber security competitions are generally based on one or multiple qualifying rounds/phases, where participants compete against each other in solving cyber

TOWARDS A COMMON ECSC ROADMAP

security challenges, and a final challenge. These qualifying rounds are usually online. It can be argued that the biggest difference among countries lies in the length and number of qualifying rounds. During this initial qualifying round, the best contestants are selected depending on their scores (i.e. number of challenges solved, but also interview performance in certain countries) and are usually invited to attend a final national challenge/CTF. The final national challenge usually takes place on-site (except for 2020 competitions due to the Covid-19 health emergency). There are some variations to this model, for example when a formal training period is incorporated as an integral component of the competition before a national final challenge.

France is an example of competition with a “short” single-phase admission plus a final challenge. There, an “open admission challenges platform” is open for two weeks, where everyone can participate and try to solve the 20 CTFs in the platform. Then, the best 30 candidates are selected for the final bout, which lasts for a full day. There are about 10 challenges and the best 5 junior and 5 senior players are selected to form the French national team.

Germany and Austria are examples of competitions with a “long” single-phase admission and a final challenge. The German national competition foresees an online three-month long qualification round. After this, 20 participants are invited for an on-site final event. A long qualification phase from May to September (4-5 months) is also foreseen in the Austrian

There are several

competition. In this phase, the competition consists of 12 remote challenges,. The best 10

approaches

juniors and 10 seniors are then invited to compete in the ACSC final in November. The best candidates (both juniors and seniors) are then invited to the ACSC centre of excellence where regarding the they are supported beyond the challenge in their cyber security carriers. number and

length of phases

Switzerland is an example of competition with a “permanent” single-phase admission plus a final

that a NCSC

challenge. There, a challenge platform is open all-year-round, where beginners, intermediate

should have

and expert level contestants can find challenges in their respective sections. Those reaching expert level by collecting enough points qualify for the final round. To maintain expert status, these contestants must remain active each year (i.e., solving a challenge or sending in a new challenge etc.). In the final round, the best candidates are selected for the ECSC team.

The Czech Republic is an example of competition with a multi-phase admission plus a final challenge. This competition consists of two rounds and a final: 1) qualification round, which is accessed by approximately 400.000 students each year; 2) second round, which is accessed by 2000-1000 students and 3) a final round, which is accessed by 50-40 students. From this smaller group, there is another screening process involving two bootcamps, where 15 students are selected to form the Czech national team.

The Netherlands and Italy are examples of competitions integrating a formal training period before the final challenge. In the Netherlands, after the national competition round (phase 1), there is a bootcamp/training week involving 22 participants, the best achievers of phase 1 in addition to two “wild cards.” Then, the competition foresees a final event where 10 players are selected for the national team. The Italian competition comprises a first qualifying round which is divided in three tests (an online pre-test and two onsite tests, involving logic and programming quizzes). In 2020, 4.452 students signed up online and 560 students advanced from the qualifying round to the next phase. The following phase is a formal training taking place in 28 universities and centres across Italy lasting for approximately 3 months. At the end of the training period, participants attend local cyber challenges, which usually further decrease by approximately 70% the number of candidates who later attend the national final. In the final challenge, the best contestants are then selected to form Team Italy.

TOWARDS A COMMON ECSC ROADMAP 4.5.2 Cyber security challenges, training and technological infrastructure

The survey also asked the type of challenges that are included in the competition. There is a great variety of cyber security topics and skills that competitions use. Very few competitions seem to be teaching non-computer science topics such as cyber security law and policy, ethics and/or data protection. Those that are most often mentioned are:

 Forensics  Cryptography  Incident response  Cracking and reversing binaries  Threats and vulnerabilities  Social engineering  Attack/defence tactics  Pwning and reverse engineering  Web security  Binary exploitation and mobile apps exploitation

Interestingly, in Belgium, there are challenges put forward by the competition’s sponsors. All major sponsors provide a challenge relevant to how they use cyber security, which “can range from theoretically finding a backdoor in one of the companies’ products, to working with a threat intel platform or role-playing an incident response process.”

In Spain, challenges/categories are defined considering ECSC Curricula, NIST-NICE categories, and skills most in-demand in the labour market. In Norway, the challenges in the qualifying round are based on the ECSC curricula. In preparation to the ECSC, almost every country (90%) organizes extensive special training sessions for participants, while two countries Ireland and Poland organize team meetups before the competition. Countries have different training methodologies, especially regarding the training length and the number of participants trained (Figure 4):

 35% of countries train their national teams (and “backup participants” if needed) for 1 to 4 weeks  25% of countries have less than a week of training  20% of the countries have 1 to 3 months of training  15% of countries provide more than 3 months of training  5% of countries provide more than 6 months of training

TOWARDS A COMMON ECSC ROADMAP

Figure 4: Training provided by national completion organizer with respect to time and number of participants trained for ECSC

In terms of the number of trained participants, Czech Republic and Italy are an exception as they train a larger number of individuals than most countries. When qualitative data were analyzed, it was found that the Czech Republic trains a wide range of individuals, from school children to university students, thus having a larger portion of the student’s population covered.

Countries

In Italy, several education institutions signup to train at least 20 individuals for 3 months. The

generally

trained individuals then compete in a national final for the selection of national team.

organize cyber

Half of the countries (50%) also teach non-technical skills in their training like teamwork and security training collaboration, leadership, presentation, stress management, writing, etc.; 40% of countries as a part of their include non-technical skill in their training programs “somewhat,” while10% declared to have no

NCSCs, but the

information about the non-technical skills are taught in their training programs . Belgium and the

length and target

Czech Republic use social activities to teach these skills, while Italy uses game-based skill

of these trainings

teaching and assessment; Malta uses mockup presentations for certain tasks. Romania, Spain and Slovenia teach these skills within their overall training programs for national teams. vary vastly

among them

Austria, Cyprus, Estonia, Ireland, Poland and Norway reported that they “somewhat” teach soft skills in their trainings. Austria uses a single day before the final to teach presentation skills;

TOWARDS A COMMON ECSC ROADMAP

Estonia provides social activities to participants for team building. Ireland and Cyprus have identified the importance of such skills and are working to integrate them in their training program. Poland discusses previous CTF writeups as a team to share experience from previous challenges. Finally, Norway uses training weekends as team building events where the focus is on building teamwork and trust among the participants.

Most countries (60%) use online platforms to train participants. Some of them (Austria, Cyprus, Ireland, Norway, Portugal, Romania, Spain, Switzerland) use public commercial platforms, (Table 3). Belgium, Germany, Italy, Czech Republic, and Poland use proprietary and selfdeveloped platforms for online qualification and training. Estonia outsources the development of qualification and training challenges to private companies every year. Instead, 15% of countries (Netherlands, France and Malta) don’t use any online platform, but they provide onsite training.

Table 3: Platforms used to provide training and challenges

No. Name Training Platform

National teams that attend the ECSC are usually formed by a combination of junior and senior players, which tend to have different levels of cyber security understanding and skills. Therefore, national cyber security competitions should have balanced challenges so that each participant is challenged with cyber security games at its own level.

Austria, Belgium, Cyprus, Greece, Ireland, Malta, Netherlands, Portugal and Switzerland include in their national cyber security competitions challenges with different difficult levels, (easy, medium and hard) to accommodate participants with different skill levels. In the Netherlands, more difficult challenges are left for the top players. Switzerland has defined difficulty levels with corresponding challenges and the selection of the right level is done by the participants when they join the platform and are evaluated based upon their overall performance.

Italy, Romania and the Czech Republic specifically align and adjust the competition’s difficulty level and include challenges with increasing difficulty level each year. They have a feedback mechanism whereby they take onboard the input of previous years’ participants based on an assessment of their knowledge and skills, and develop new challenges based upon this assessment. Poland uses dynamic scoring for assessing the difficulty of challenges as well as participants’ feedbacks.

In France, the competition organizers make some challenges deliberately easy to encourage the participation of juniors, which is similar to what happens in Germany, where organizers make special tutorials for juniors to ensure that beginners have at least the chance solve some

TOWARDS A COMMON ECSC ROADMAP

easy challenges. Finally, Spain uses a threefold approach. First, they consider participants age and experience before designing the competition. Second, they develop competitions that are not linear, whereby participants can explore different challenge categories in which their knowledge and skills can be assessed based upon their performance. Finally, they conduct awareness raising sessions for juniors in schools with the goal to inspire them to join the cyber security sector by providing necessary educational tools that are required for cyber security.

Conducting cyber security competitions requires a lot of technical capabilities, including setting up the necessary infrastructure, defining evaluation and monitoring mechanisms. The survey asked participating countries whether they have sufficient capabilities to conduct such competitions and whether are willing to assist other countries that do not possess such capabilities: 29% reported that they have sufficient capabilities and are willing to provide assistance to other countries; 57% stated that they have sufficient capabilities but are not able

40% of NCSCs

to help due to administrative and time constrains; 14% stated that they do not have the required

have limited or

technical capabilities.

no activities in 4.6 CONNECTION WITH EMPLOYERS AND CAREER OUTCOMES which their

One of the main objectives of national cyber security competitions and the ECSC is to identify participants are young cyber talent and to increase interest in a cyber security career among young people.

linked with

Most of the participating countries recognized the importance of achieving such objective and

employers

attempt to actively engage participants with potential employers: 60% of national competitions have already integrated participants-employers engagement platforms, while 20% have some sort of informal engagements; only 20% do not have any kind of engagement.

For example, Germany and Czech Republic organize special recruiting fairs for competition participants, while Austria, Belgium, Cyprus, and Ireland actively involve sponsors to provide job opportunities in the competition. In Romania, training to the national team is provided by the private sector with the possibility for trainees to get hired at the end of it. In Malta, the national cyber security competition offers placements as a summer job to participants.

Two countries that are concretely focusing on the employability of their competition’s participants are Italy and Spain. In Italy, all participants' CVs are made available to the private sector sponsors of the competition via a custom-made platform. In addition, after each on-site competition a recruitment fair is organized, involving both public and private sector actors. In Spain, the main goal of the competition is to identify, attract, train, recruit, and place the next generation of cybersecurity professionals and the national competition achieves this by organizing the “Cybersecurity Employment and Talent Forum,” which is designed to show participants what it is like to work in the industry and inspire them to consider a cyber career.

Countries like Estonia, Norway, Switzerland, and other countries have not integrated this concept in their competition yet, but they organize networking events like conferences and workshops with public and private sector actors to provide competition participants with opportunities to engage with potential employers. In the Netherlands, the private sector organizes some events, no employers-participants engagement especially designed to increase job opportunities is present at the moment. Similarly, Poland has not established a direct link between participants and employers, although some former participants were hired by the national CERT. Portugal is planning on starting to develop a participants-employers connection in the future.

TOWARDS A COMMON ECSC ROADMAP

Alumni networks could provide newcomers insights into a new field and sector, which might help them navigate complex skills development and career choices like those that cyber security presents. Hence, the survey asked whether national competitions have established alumni networks to help with this aspect: half of competitions (50%) have already such networks in place, whereas 40% of national competitions have not.

Countries like Estonia, Austria, Czech Republic, and Romania actively engage former competition participants in the organization of the competition, coaching and advertisement campaigns. Cyprus have mentors that provide guidance to newcomers. Germany encourages former participants to join their nonprofit organization as members. Greece and Ireland have alumni networks, while Malta and Netherlands organize social gatherings between former participants, the private and the public sectors to share different ideas and opportunities.

A formal alumni network does not exist in countries like, Belgium France, Italy, Norway, Poland, Portugal, Spain, and Switzerland, although Belgium and Switzerland report the existence of informal settings populated by some competition participants. Norway is currently working on the development of such a network.

As stated earlier one of the main objectives of national competitions is to identify young cyber talent and to promote cyber security as a career choice for young people. Against this backdrop, the carrier progression of former participants can provide key insights on cyber security and career development of young specialists. Hence, the survey asked whether national competitions collect data about the career choices of former participants.

Most countries (55%) do not collect such data, while 20% do; and 15% “somewhat” collect such data. Romania, Switzerland, and the Czech Republic remain in contact with former participants who supply information about their career progression. Austria, Spain, Greece and Estonia collect such data, but did not provide further details on how this is done. They use this data for sharing career opportunities as well as training and coaching purposes.

TOWARDS A COMMON ECSC ROADMAP

5. OPPORTUNITIES AND CHALLENGES FOR A COMMON ECSC ROADMAP

This chapter provides an analysis of the survey results (section 4) while considering the identification of key factors as outlined in section 3. The aim of this chapter is to provide tangible elements for the establishment of a common ECSC Roadmap (section 5).

5.1 NATIONAL CYBER SECURITY COMPETITION OBJECTIVES

Results show a certain consensus among organizers about the 5 main objectives that a national cyber security competition should have, namely:

 Identifying young cyber security talent  Increasing interest in cyber security as a topic  Increasing cyber security knowledge and skills  Increasing interest in a cyber security career and connect participants with employers  Creating a network of young cyber security specialist

Results are in line with what found in section 3 and aligned with ENISA recommendations for

According to the

the ECSC , except for the objective “to create a network of young cyber security specialists.”

survey results,

This objective did not strongly emerge in section 3 and it is overall considered more important

identifying young

than “raise cyber security awareness,” which instead was regarded as highly important during interviews with some national organizers. cyber security

talent and

Considering the results of the survey, it can be argued that a common ECSC roadmap should

increase interest

be based on these five main objectives. Whether resources should be distributed according to

in cyber security

the ranking provided by the survey is an aspect that countries should reflect upon.

topics are the

It is interesting to note that, despite the cyber security skills shortage being a policy problem most important frequently mentioned as a rationale behind the establishment of national cyber security objectives a competitions, increasing interest in a cyber security career is ranked only as the fourth objective.

NCSC should

The authors of this report wonder whether this objective should deserve more attention in the

reach

organization and implementation of national cyber security competitions, if countries consider the shortage of cyber security professionals a serious issue that cyber security competitions could tackle. Similarly, and still against the same background, perhaps a common ECSC roadmap should also reflect whether the objective “increasing the number of participants” should be also formalized and given more attention vis-à-vis other objectives.

TOWARDS A COMMON ECSC ROADMAP 5.2 POLICY RELEVANCE, GOVERNANCE AND PPP

A common ECSC roadmap should make sure national cyber security competitions are more “policy relevant” as only 40% of competitions are mentioned in countries’ national cyber security strategies. Although not all national organizers consider it desirable, it is generally considered valuable for a national cyber security competition to be regarded as a national instrument enabling a better national cyber security posture. Competitions that are “on the policy radar” are, according to organizers, more likely to gain credibility, have a bigger impact and might obtain financial resources more easily. Make cyber security competitions more “policy relevant” would also have the welcomed consequence to make countries more aware of the need to have a more systematic policy and vision on cyber security education. If it is agreed that the lack of

There should be

cyber security professionals is an important issue as, for example, the lack of coordination in

a recognition of

case of a cyber-crisis, then policies in the realm of cyber security education – such as national

the importance

cyber security competitions – should have the same level of attention that other cyber security policies receive. of NCSCs in

achieving

The survey found that in 55% of countries it is a combination of actors that organizes and

countries’ cyber

implements a national cyber security competition. This in line with what found in section 3 and

51 52 security

what suggested by ENISA , which posit that, despite the absence of a universal governance

objectives when

structure, a public-private partnership involving the key actors of a national cyber security ecosystem is usually considered a favourable governance solution for a national cyber security it comes to cyber competition. As 45% of national competitions are reported to be organized and implemented by security only one organization/actor, a common ECSC roadmap should encourage more countries to

education and

involve more actors in national cyber security competitions and reap the benefits of a PPP.

skills

The survey found that governments support cyber security competitions through partnerships and/or collaborations in most countries (60%), whereas governments provides a more limited or no contribution in 40% of countries. Section 3 found that government’s support is essential, especially when national competitions are in their “start-up phase,” which nowadays seems to be the case for many competitions in the EU and ECSC partner countries. Because of these findings, a common ECSC should encourage governments to more firmly support national cyber security competitions, especially when these are newly established and when the rest of the national cyber security ecosystem cannot adequately support them. This is especially true given that academia (65%) and the private sector (80%) seem to be overall more involved in national cyber security competitions than governments (60%).

TOWARDS A COMMON ECSC ROADMAP 5.3 FUNDING

Section 3 found that appropriate funding is one of the key factors enabling the success of a national cyber security competition. Only 12 out of 20 countries provided estimates regarding the cost of their national cyber security competitions and, based on these, the survey found that on average national cyber security competitions have a budget of approximately €37.000.

However, this average should be contextualized and taken with great caution. First, it is unclear to what extent the Covid-19 health emergency had an impact on the costs provided in the survey. For example, it is possible for this estimate to be on the lower end of the spectrum given that the health emergency has moved many activities online, therefore decreasing the costs of certain events which would normally be on-site and face-to-face and thus generally more expansive. Secondly, and most importantly, costs vary according to the nature of the competition. In this regard, it is impossible to not notice that only one country accounts for 49% of the total budget, out of the 12 countries who provided data, which is due to the fact that the country in question provides a “long” training to a large number of participants. To generalize from this example, the budget of a competition which provides a 6-month training to over 1.000 students with a mix of instruments (online and face-to-face) will clearly cost more than a competition which does not provide any training and only foresees a 48-hour CTF. This example reveals that the there is no “one size fits all budget” and this will ultimately vary according to the nature and the ambition of the competition. This means that if a “common

Appropriate

ECSC Roadmap budget” was to be established, it is possible that the estimate would change,

funding is key for

depending on the level of ambition that this common ECSC Roadmap would have, especially in terms of number of participants involved, length of training, type and quality of challenges the long-term

provided etc. sustainability of NCSCs. National

Against this background, survey results show that only 25% of countries state to have enough

governments and

financial resources to achieve their objectives. Moreover, if more resources were available,

the EU should

national competitions would use them to deliver core activities such as more cyber security training, increasing participants’ attendance and paying for travel and accommodation costs consider related to the ECSC competition and communication activities. These are important activities increasing their which, if enhanced, would make national cyber security competitions likely more successful. It

financial support

comes as no surprise then that most national organizers (80%) think that the EU should co-fund

to NCSCs

cyber security competitions, with 53% of national organizers believing that the EU should sponsor at least 40% of national cyber security competitions total costs.

Against this backdrop, a common ECSC Roadmap should:

a) make sure national competitions have appropriate financial resources to meet their current objectives; b) encourage the 35% of countries who receive funding from a single source to attempt to diversify the sources of their budget, when this is feasible and practical; c) consider whether governments and the EU should increase their financial support to further develop national cyber security competitions. We believe that an increased governmental and EU support would have several benefits, including: 1) making the establishment and implementation of competitions more stable, allowing national organizers to focus on medium-to-long term goals rather than having to fundraise; 2) diversifying the origins of funding, especially if the economic crisis induced by the Covid-19 pandemic would reduce financial resources that are usually made available by other actors; 3) helping competitions gaining more prestige and credibility in the eyes of their stakeholders. d) encourage national competitions to follow ENISA’s recommendations in overcoming funding issues by pitching attractive sponsorship scheme to the private sector, engaging with governments by highlighting the strategic importance of national competitions leading to the ECSC, and setting entry fees for side events during the competitions like conferences or job fairs.

TOWARDS A COMMON ECSC ROADMAP 5.4 PUBLIC RELATIONS AND MARKETING STRATEGY

Most national cyber security competitions (60%) reported to have a communication and public affairs strategy. Section 3 found that such a strategy is essential to ensure an overall promotion of the event in order to reach out to potential participants, raise interest and help the event to achieve visibility for the sponsors and the rest of the national cyber security ecosystem. Moreover, such strategy is also fundamental to create a positive narrative around cyber security and to promote the competition’s success stories. To increase awareness, ENISA highlighted the importance of a media strategy for cyber security competitions and encouraged them to leverage the possibilities that are offered by social media.

Additionally, engaging the audience during the competition in an interactive manner using commentary and different competition visualization techniques other than scoreboards will help in increasing public awareness about cyber security.

While most of national cyber security competitions report to have a communication and public affairs strategy, a common ECSC roadmap should encourage the 40% of national competitions who said to have it “somewhat” adopted to develop a fully-fledged communication plan, when resources are available. Given the importance of such a strategy to achieve multiple vital objectives, a common ECSC Roadmap could benefit from an enhanced coordination of competition’s public affairs and marketing campaigns with the support of ENISA’s public affairs team and activities. Moreover, additional research could be done to create a repository of best practices which could be accessed by those countries who have not had so far the resources or the know-how to put in place wide-ranging communication campaigns.

5.5 ORGANIZATION, TRAINING AND CYBER SECURITY CHALLENGES 5.5.1 Recruitment and phases of the competition

Section 3 advanced that a national cyber security competition should involve the largest and It is estimated most diverse group of people, at least at the beginning of the competition. The purpose of

that NCSCs

involving a larger group of individuals would be to expand the pool from which to select the

across Europe

team attending the ECSC, but also to increase interest in cyber security and its careers in a

involve almost

larger group of young people in the context of the cyber security skills shortage.

22.000 students

Based on data provided by 16 countries in the survey, national competitions totalled slightly and 3.500 of more than 17.000 signups. Therefore, it estimated that the 20 national cyber security

them are active

competitions who took part to the survey could potentially involve almost 22.000 students, of

users

whom approximately 3,500 could be “active users.”

As for the funding, this estimate should be put in context. In fact, out of the approximately 17.000 signups totalled by 16 national competitions 66% come from only 3 countries (Czech Republic, France and Italy). Similarly, out of the approximately 2.000 active users totalled by 11 national competitions, 51% are active users from only 3 national competitions (Austria, Italy and Romania). Participation data varies greatly among countries and some national cyber security competitions like those in Italy, Spain, France, Germany, Switzerland and Czech Republic were able to sign up thousands of participants,while other countries struggled to do so (Table 1).

Hence, a common ECSC Roadmap should set guidelines on how to assist countries that are currently struggling to attract a higher number of participants. Multiple factors such as budget, government support and media strategy likely affect the number of participants that are initially involved in the competition so suggesting only one solution to this issue would mean not understanding its complexity and the multiple elements that influence it. However, a reasonable initial measure could be to involve the education sector and the ministry of education in

TOWARDS A COMMON ECSC ROADMAP

spreading information related to the national cyber security competition, given the fact that in most countries the target of these initiatives are secondary school and higher education students. A practical example is given by the Czech and the Italian cyber security competitions, which have the highest number of participants and have effectively involved the whole education system in the promotion of their events.

Another a possibility could be to lower the entry requirements to access the competition, as only 25% of competitions require “basic” computer science skills in their qualifying rounds. Most of the time, competitions require intermediate computer science or cyber security skills (30%) or a combination of higher-level skills in computing and math. Higher and specialised entry level requirements make it more difficult for people with no experience to even signup to these competitions and get a taste of what cyber security might entail. Therefore, lowering entry level requirements could help more students to enter the field and decide whether cyber security is something that is of interest to them.

In the same vein, but also to balance a sector which is heavily male dominated, more work could be done to increase the gender diversity of competitions. In fact, only between 5-10% of national competitions’ participants are female. In this regard, a useful first start could be to look at the experience of the Czech-Republic, where, despite the absence of a specific policy to promote diversity, the national competition can boast a male to female ratio of approximately 70:30, which can be attributed to a strong public affair strategy and NGO involvement in competition’s organization. In a context where increasing the number of participants should be

NCSCs should

among the goals for the majority of national competitions, a common ECSC Roadmap would have to solve an intrinsic issue: how can a national competition involve the largest and most have one long or diverse group of individual, at least initially, and later be able to select a small elite of gifted multiple phases students to enter the ECSC? where

participants are

A possible solution to this issue could be for a common ECSC Roadmap to encourage a greater

first taught new

standardization of the competition’s organization, namely in the number and length of phases a

cyber security

competition should have. Section 3 proposed that national competitions should adopt a model with at least one qualifying round and a final, which indeed seems the case for most of the knowledge and national competitions in the survey. However, there are still serious differences within this skills and then model, most notably in the length of the competition’s phases, whether a formal training is

are selected to

incorporated before a national final and who it targets. As it is not hard to see how competitions

attend the ECSC

that last for longer can be more beneficial to students in terms of increased learning opportunities, the authors of this report believe that national competitions should have one long or multiple qualifying rounds, where participants are ideally taught new cyber security knowledge and skills as they progress and before entering a final competition. The final challenge should then be concerned with selecting the best young talent to attend the ECSC. This model would help to involve a larger set of individuals in the first phase, and then progressively screen more candidates until a small team of elite student is found. The benefits of having longer national cyber security competitions is also supported by the hands-on experience of some national organizers. One interviewee stated that recently his organizations changed his format from the traditional 24-48h CTF format to a 2 week-event, which gave participants more time to study on their own and solve more challenges: “This is important with regards to our objectives stated above in cultivating the knowledge, skills and culture of individuals, albeit at the cost of narrowing down the selection for the final ECSC team.” Similarly, another national expert revealed that his organization has recently changed the training format, from a two-weekend onsite bootcamp to a continuous online training and participation in international competitions, based on the realization that “in such a short time (two-weekend onsite bootcamp), it is very difficult to teach cybersecurity, especially to the youngest participants.”

Finally, an important element of this model would be to make sure that participants who are “hooked” and at least initially involved in the competition are kept involved throughout the event.

TOWARDS A COMMON ECSC ROADMAP

It is understandable that a competition whose goal is to identify cyber security talent could be “impatient” to select its dream team and send it to compete in the ECSC. However, it is probably counterintuitive trying to encourage more and more young people to participate in a national competition and then not engaging them if they do not manage to pass the first round. If a student is interested in cyber security, but he/she is given no chances to nurture this interest, the labour market will unlikely see more cyber security professionals in the next future. In this regard, survey results show that only 25% of national competitions keep involving the participants who do not make it to the final round, while 25% keep involving them “somewhat.” Similarly, national competitions seem to be struggling to keep their user “active” as only 17% of those who signup continue to be engaged. It is very important to keep involving the students who do not make it to the final round. There is emerging evidence of the fact that participants who do not make it to the final rounds could be at least as interested (if not more interested) in cyber security and its careers than their gifted pears who make it to the final.54 If this is true, and in the context of the lack of cyber security professionals, it would be a lost opportunity for a cyber security competition to disengage these students from the sector, especially given the efforts undertaken to “hook” them. There are multiple ways through which this can be achieved, for example by giving the participants the opportunity to engage in some of the same challenges that their peers are asked to solve in the final or through online learning. In this case, a practical example would be the Italian OpenCyberChallenge.IT program, which allows students who are not admitted to the training/final round to follow online lectures, get and solve challenges and receive a certificate of participation after completion of the program (see pg. 46 for further details).

5.5.2 Cyber security challenges, training and technological infrastructure

Section 3 underlined the importance of training as one of the core components of a national cyber security competition, which should incorporate both technical and soft skills in the curriculum. It also highlighted that there is no particular agreement among experts on the type, duration and length of training.

Survey results confirm that national cyber security competitions tend to have vastly different training methodologies, each of them with their pros and cons. At present, approaches are so diverse to make it hard to even have a simple comparison across countries. For example, survey results show that almost 1000 individuals are trained in cyber security skills across the EU and ECSC partner countries during cyber security competitions. However, approximately 70% of these participants are trained in only three countries. Moreover, the target of this training is also different. Whereas most countries train only those participants who later attend the ECSC, (very) few countries train a broader number of individuals, in addition to those going to the ECSC. Finally, survey results show that there are different approaches also when it comes to the length of training, with 80% of national cyber security competitions training participants for less than 3 months.

Considering this great variety of approaches, a common ECSC Roadmap should encourage national cyber security competitions to standardise cyber security training. The authors believe that establishing what the word “training” means in the context of a national cyber security competition and what its key features should be (duration, type, content and target group) are the number one priorities for a common ECSC Roadmap. As previously touched upon, the authors would argue that, in principle, national cyber security competitions should aim to train the largest number of participants for the longest period possible or an amount of time that participants and organizers find conducive to develop and consolidate a good level of cyber security knowledge and skills. In other words, the authors think that a national cyber security competition that trains over 100 students for more than 3 months have higher chances to achieve the objectives that a competition should meet (see section 5.1) rather than a

TOWARDS A COMMON ECSC ROADMAP

competition that trains 10 individuals for 1 week. Moreover, the authors believe that a national competition should aim to train participants beyond the small group of individuals (typically 10) who are part of the national teams attending the ECSC. If it is true that cyber security competitions are established with the intent to reduce the shortage of cyber security professionals, national competitions should also aim to train people who are interested in a cyber security career, and not only the already gifted small minority who attends the ECSC. As previously mentioned, there is emerging evidence about the fact that students not making to the final round are likely to be as interested in cyber security as their peers who achieve the final challenge. Hence, envisaging some sort of training even for the “excluded” could indeed be beneficial to increase cyber security skills in students who might end up pursuing a cyber security career even if excluded from the ECSC team. As of now, very few national competitions also train those participants that do not attend the ECSC.

Moreover, the platforms used by different countries for the deployment of competition The first priority challenges and the training also differ vastly as indicated in table 3. Some of the platforms are of an ECSC free and open source with limited functionality like CTFd while other are commercial products

Roadmap would

with extended functionality like hacking-lab. In the presence of relevant budgets differences ,

be to encourage

one can notice some countries using expensive and state of the art commercial platforms for the training of their national teams, whilst other countries are struggling to even provide soft drinks a greater during the competition. This does not provide a level playing field to participants overall. Thus, a standardization common ECSC Roadmap should encourage the establishment of a central repository of cyber

of cyber security

security challenges developed using standard formats and platforms to help different countries

training in

to have at their disposal updated cyber security challenges.

NCSCs

Finally, knowledge sharing can help countries that struggle to organize national competitions according to certain standards and, in doing so, elevating the quality of cyber security learning across the EU and ECSC partner countries. In the survey, 4 countries reported that they do not have the technical capabilities to organize such competitions and are struggling to identify relevant sources of information. On the other hand, 8 countries are willing to provide assistance. The referred technical capabilities are mainly related to the development and deployment of technical challenges. These challenges differ vastly from country to country and every country is following their own methodologies as indicated in section 4.5. This different approaches in challenge development impacts the overall quality of the competition, for example when a national cyber security competition does not take into account the difficulty levels for new 28,29 commers, which might unintentionally demotivate them to participate in future challenges. To solve this issue, a standardized challenge format and deployment platform could be developed thanks to the extensive expertise and knowledge sharing of participating countries. This will result in standard skills assessment and training to further improve the already welldefined ENISA curriculum and to increase the overall quality of the competition. Moreover, such multinational collaborative effort takes out the burden from individual countries competition organizers for setting up the whole competition technical environment on their own. This will save both time and money for the organizers, enabling them to address more organizational challenges like increasing diversity and promote cyber security awareness.

5.6 CONNECTION WITH EMPLOYERS AND CAREER OUTCOMES

Survey results confirmed that increasing interest in cyber security careers and connect participants with employers should be one of national cyber security competitions’ objectives (section 5.1). Section 3 argued that, in order to achieve this objective, it is essential to establish and strengthen relations with employers, create a network of alumni and organizations to help participants understand more about cyber security careers and organize networking events/career fairs..

Survey results show that national cyber security competitions could do more to develop their links with employers and better liaise participants with the cyber security labour market. In fact, 20% of competitions try “somewhat” to link participants with employers, while another 20% do

TOWARDS A COMMON ECSC ROADMAP

not have such mechanisms in place; only half of competitions have an alumni or mentors network; only 20% collect data on participants’ career outcomes, which makes the quantitative assessment of competition success with regards to their career outcomes more difficult.

A common ECSC Roadmap should support countries to improve their career and employability outcomes. There are several ways to achieve this. For example, competitions could collect participants’ CV and allow employers to view them in a online custom platform; social and career fairs could be organized to make students more informed about cyber security roles and organizations; finally employers could be encouraged to offer placements and internships to competition’s participants.

Besides these practical elements, a common ECSC Roadmap should perhaps promote a mind-

NCSCs should

shift among practitioners on the importance of competitions as a tool to increase the number of

put more effort in

cyber security professionals in the labour market. Survey results show a sort of “under commitment” to cyber security careers, which also seems confirmed by the list of objectives in linking section 5.1, ranking “increase interest in a cyber security career and connect participants with participants with employers” as only the 4th objective. As stated above, the authors believe there should be more

employers and

emphasis on this objective. Competitions should put in place activities that effectively bring

encourage them

closer participants with employers, without assuming that simply organizing and running a

to consider a

competition will somehow automatically mitigate the lack of cyber security professionals. Instead, well thought-out activities that ensure a strong and systematic connection between cyber security participants and employers should be created to make participants aware of cyber security career professional opportunities.

5.7 ENISA’S ROLE

Finally, the survey asked national organizers what role should ENISA play to further support national cyber security competitions in the EU and affiliated countries. The most mentioned suggestions include:

 Propose/support dissemination, marketing and public affair activities;  Provide and share cyber security challenges/training material;  Increase the visibility of national competitions among governments;

Other interesting, albeit less mentioned, tasks are:

 Host the ECSC and provide funds to the national teams to attend the event;  Help overcoming the gender issue;  Providing best practices in running national competitions.

The authors believe that in the process of establishing a common ECSC Roadmap, ENISA can effectively increase its role and provide added value in the activities listed above. Some of them can be implemented rapidly and at relatively low cost. For example, ENISA could help national competitions gather the support of national public authorities by leveraging the Agency’s network of national contact points and policymakers; national competitions’ dissemination and public affair activities can be further coordinated with the Agency’s activities in the same field. Moreover, and in line with its tradition of applied studies, ENISA could also conduct additional research on best practices in running national competitions and provide the necessary evidence basis for a common ECSC roadmap. Other tasks such as the provision of cyber security challenges/training material, assistance in overcoming the gender issue and hosting the ECSC probably require further elaboration, but are objectives worth discussing depending on the future of the ECSC as an EU policy.

TOWARDS A COMMON ECSC ROADMAP

6. CONCLUSIONS AND RECOMMENDATIONS

This report aimed to identify the key factors enabling the success of a national cyber security competition and to give a snapshot of the current situation in the EU and ECSC partner countries. To do that, we conducted a dozen interviews with national and EU experts, searched and reviewed the relevant scientific literature and collected data on these key enabling factors with a survey, which was filled by 90% of the countries attending the ECSC. This was done to provide preliminary insights and a discussion platform to determine a common ECSC roadmap, which is presented below.

At present, there are many similarities among national cyber security competitions and thisis a good starting point for the development of a common ECSC roadmap. However, there are also many differences on several key aspects, making the definition of a common ECSC roadmap an important and urgent task, if stakeholders wish to develop the ECSC at its fullest potential.

In light of this research, we believe that establishing and implementing a common ECSC roadmap with a view to promote a standardisation of national cyber security competitions has the potential to make the ECSC the EU flagship policy in the field of cyber security education. This would place the ECSC in a primary position to support the objectives of the EU Security Union Strategy for the period 2020-2025. We believe so because we currently do not see many other policies that, like the ECSC, could potentially involve 20.000 students, provide solid cyber security training to almost 1.000 individuals and give such visibility to EU efforts in cyber security policies.

We use the analogy of a tree and its roots to summarize our findings (Figure 4). A tree has a strong foundation at the roots level, which provide the necessary strength for the stem to grow. When the stem becomes strong enough different, the branches of the tree start to spread out and bear fruit. To accomplish ECSC’s objectives there also is the need for a strong foundation. This can be achieved by involving students and the public in a nationwide competition like in the Czech Republic, which saw the participation of more than 5000 individuals in the first round of the competition (Table 1). This also helped in increasing awareness at a national level which motivated a diverse group of individuals to participate in the competition without having a specific policy for promoting diversity.

When the root level is established, then the stem flourishes. The example of Italy can be taken, where they are using a systematic and institutional approach for identifying and training young cyber talent. Their universities and other educational organisation can take part to the national cyber security competition and provide training to a team of students who then attend a local and a national challenge (Section 4.6.2). This not only makes the competition more competitive, but also acts as tool for spreading cyber security knowledge among different geographical areas, which helps creating small clusters of cyber security hubs within each region. The positive results of this approach are underlined by the performance of team Italy in the ECSC 2017, 2018 and 2019 editions, when the Italian team ranked 3rd, 6th, and 2nd place, respectively. It should be noted that winning a competition is one thing and creating a systemic learning environment to address the cyber security need for the country is completely different, in that regard lessons from Czech Republic and Italy can be learned.

Now, when the stem flourishes the tree starts bearing fruits. At this stage different countries try to provide employability to the identified cyber talent. The effort of Spain in this regard are

TOWARDS A COMMON ECSC ROADMAP

admirable, as it follows a well-structured process to identify, attract, train, recruit, and place the next generation of cybersecurity professionals. Every year, they organize the Cybersecurity Employment and Talent Forum, which is designed to show students what it is like to work in the industry, provide them with the chance to meet industry experts, explore potential careers, discover education opportunities and learn about practical next steps (Section 4.7). Other countries like Czech Republic, Italy, Germany also organize similar events.

Figure 5: Common model for organizing NCSC

TOWARDS A COMMON ECSC ROADMAP

Therefore, in light of what suggested by national experts and the scientific literature (section 3), survey results (section 4) and the subsequent analysis (section 5), a common ECSC Roadmap should have the following objectives:

 Identify young cyber security talent  Increase interest in cyber security as a topic  Increase cyber security knowledge and skills  Increase interest in a cyber security career and connect participants with employers  Create a network of young cyber security specialist

A common ECSC should renew emphasis on the objective “Increase interest in a cyber security career and connect participants with employers” and related activities (see recommendations on “connection with employers and career outcomes” below) in the light of the current shortage of cyber security professionals and run rigorous evaluations to see whether these objectives are successfully achieved based on the indicators in section 3.1;

Based on the key enabling factors identified in section 3, a common ECSC Roadmap should:

6.1 POLICY RELEVANCE, GOVERNANCE AND PPP

 Encourage more countries to understand the strategic importance of their national cyber security competitions in the field of cyber security education, in the context of the cyber security skills shortage;  Encourage countries to make national cyber security competitions more “policy relevant,” for example by mentioning them in their national cyber security strategies, and to adopt a more systematic policy and vision on cyber security education;  Noting that perfect governance structure for a national cyber security competition does not exist, encouraging the establishment of a PPP involving the key actors of the national cyber security ecosystem is likely to provide several benefits;  Encourage those countries where a national competition is organized and implemented by only one actor to involve more stakeholders and reap the benefits of a public-private partnership, when this is feasible and practical;  Encourage governments to more firmly support and assist national cyber security competitions, especially when they are in their “start-up phase” and when the rest of the national cyber security ecosystem cannot adequately back them.

6.2 FUNDING

 Make sure national competitions have appropriate financial resources to meet their current objectives;  While a perfect funding arrangement does not exist, supporting a model in which costs are shared among key actors, most notably the government and the private sector, could provide more financial stability over time;  Encourage the 35% of countries who receive funding from a single source to attempt to diversify the sources of their budget, when this is feasible and practical;  Consider whether governments and the EU should increase their financial support to assist in the development of the ECSC as a fully-fledged EU cyber security policy and ensure a level playing field for national cyber security competitions. Without adequate financial support, in the current state of affairs, it would be impossible, and possibly unfair, to ask national cyber security competitions to initiate any Common ECSC Roadmap process;  Take note of ENISA 2017 recommendations and adopt the following funding strategies:

o Offer attractive sponsorship to the private sector to enhance their marketing presence for example in national level events;

TOWARDS A COMMON ECSC ROADMAP

o Organize side events like conference, trainings and job fairs and have entryfees ; o To overcome geographic disparities and avoid unnecessary carbon emissions from traveling, use video-game streaming technologies to their full potential.

6.3 PUBLIC RELATIONS AND MARKETING STRATEGY

 Encourage 40% of national cyber security competitions without a fully developed public relations, marketing and communication strategy to establish one;  Develop a public relations and marketing strategy taking into account the following objectives: o Promote the event and raise cyber security awareness (see below); o Reach out to potential participants and increase recruitment (see below); o Give visibility to sponsors and the national cyber security ecosystem; o Build a positive narrative around cyber security and inform stakeholders about the competition’s success stories.

 Coordinate national competitions public affairs activities with ENISA;  Establish a repository of communication best practices to assist countries in developing their own communication and marketing plan.

We believe a common road map should have three phases at national level to increase cyber security awareness, which will result in increased participation of a diverse group (Figure 4):

1. A phase to spark interest in young people 10-15 years old with the following features:  Preferably in cooperation with primary schools as part of the curricula;  This should be fun and based on gamification, with a hint of competition;  Focus on broad interest and education. 2. An inclusive national CTF phase for 16-22 years old with the following features:  Based on local CTF clubs;  Preferably in cooperation with a national e-sport organization and universities;  Focus on continuous learning and skill improvement. 3. Main phase nationally and internationally for 16-25 years old with the following features:  Preferably made media friendly in order to have more media exposure in mass media;  This also creates attractive venues for sponsor visibility;  Focus on the elite and winners.

Furthermore, we recommend defining policies to make cyber security relevant for a broader audience. This can be achieved by involving the education sector and national ministries of education in the dissemination of information related to the national cyber security competition during the recruitment phase and by establishing close coordination between high schools, universities, public and private sector to organize through:

o Research days at universities and invite general public to showcase latest cyber security technologies; o Career days at public and private organizations for high schools and university students to spark interest in cyber security careers; o ECSC alumni meetups for sharing knowledge, experience and opportunities among each other.

Finally, we recommend engaging:

o Schools and universities by placing attractive competition banners in prominent places like libraries;

TOWARDS A COMMON ECSC ROADMAP

o Social media platforms that are mostly used by young people, using photo and video sharing applications. o The audience during such competition events, with live commentary and explanation of technical things.

6.4 TRAINING AND THE COMPETITION

 Set guidelines on how to assist countries to attract a higher number of participants in the first qualifying round of the competition, paying close attention to the examples offered by the Czech and Italian approaches.  Reflect whether having lower entry level requirements (basic computer science skills versus intermediate/advanced computer science and cyber security skills) could help to attract a higher number of participants in the initial qualifying round, when this does not impact the overall quality and development of the competition;  Increase the gender diversity of competitions by paying close attention to the Czech example, which is currently the only national competition with a 70:30 male to female ratio;  Set guidelines and standards on how to ensure that most students who signup remain active throughout the competition, considering the examples offered by the Austrian, Italian and Romanian competitions;  Encourage a greater standardization of the competition’s rounds and/or phases: the authors of this report believe that national competitions should have one long or multiple qualifying rounds, where participants are given the chance to learn new cyber security knowledge and skills before entering the final challenge selecting the ECSC national team;  Encourage national cyber security competitions to standardize cyber security training, including: o Define the concept and meaning of “training” in the context of a national competition; o Define and establish the key features of training in terms of duration, type, content and target group. As an overarching principle, a national cyber security competition should aim to train the largest number of participants (beyond those attending the ECSC) for an amount of time that is appropriate to consolidate a good level of cyber security knowledge and skills;

Moreover, we recommend the establishment of a joint working group comprising of members of different participating countries with the following responsibilities:

1. Define cyber security challenges’ standards and their deployment platform; 2. Provide assistance to countries that have technical challenges in implementing such competitions; 3. Create a central repository of challenges where countries can donate and use different challenges if needed; 4. Coordinate with different government, academic and private stakeholders to keep cyber security challenges relevant as per their interests.

The establishment of the working group will ease the burden on national organisers. This will enable them to focus more on organizational aspects of the competition such as for example funding and public affairs. Recommendations on these aspects were already proposed by ENISA. One key point for challenge development is their adaptability to be used in different organizational setting. As the basic objective of the ECSC is to identify young talent and increase cyber security awareness, the challenges are helping to identify young cyber talent. However, to increase cyber security awareness these challenges should be able to be used other than the competition environment. This will help sharing the challenges among different government, academic and private stakeholders for their internal training and security awareness as well. This can be achieved through defining a standard for security challenge development and deployment.

TOWARDS A COMMON ECSC ROADMAP 6.5 CONNECTION WITH EMPLOYERS AND CAREER OUTCOMES

 Promote a mind-shift regarding the importance of competitions as a tool to increase the number of cyber security professionals in the labour market;  Support national cyber security competitions to improve their career and employability outcomes and encourage them to organize activities that effectively and systematically bring closer participants with employers, such as: o collection and dissemination of participants’ CVs; o career and networking events; o employers-led lectures; o establishment of alumni networks; o guaranteed placements opportunities such as internships and traineeships.  Monitor the career progression of competitions’ participants by: o Collecting information of online professional profiles of participants; o Conducting anonymized surveys on former competition’s participants about their carrier progression; o Conducting personalized interviews with participants related to their carrier progression.

6.6 ENISA’S ROLE

 Should consider as a matter of priority to increase its role in the following activities: o Increase the visibility of national competitions among governments; o Coordinate national competition’s dissemination activities; o Conduct additional research on best practices in running national competitions and provide the necessary evidence base for a common ECSC roadmap;  Other activities it should consider: o Provide and share cyber security challenges/training material; o Give guidance on how to ensure that a pool of people with a broader education and gender variety is involved in national competitions.

-N -EN -016 -21 -01 TP

ABOUT ENIS A

The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing crossborder communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

ISBN 978-92-9204-464-0 DOI: 10.2824/657311