Cybersecurity Learning Outcomes

Data Sample

Cybersecurity Learning Outcomes

Save time and increase accuracy with DegreeData custom service.

The following is an example of DegreeData’s work in parsing and aggregating data from multiple sources.

Using Cybersecurity as a sample, learning outcomes are presented on a program-by-program basis and cross-referenced to their accrediting association’s competences. The result is a data-rich publication ready for research, publication or further development.

Outcomes By Program

Alfred State, College of Technology	Outcome	Outcome	Outcome	Outcome	Outcome	Outcome	Outcome	Outcome	Outcome	Outcome	Outcome	Outcome
Program: Cyber Security Award: B Tech	Demonstrate troubleshooting strategies with a variety of security problems.	Install and configure web, database, file, and application servers.	Develop and implement effective security and disaster recovery systems and policies.	Develop and maintain technical documentation and procedures for security management.	Demonstrate effective research, planning, and security management of software updates and fixes.	Apply accumulated knowledge and skills in an actual industry environment.	Demonstrate effectiveness in the use of computer forensic tools, procedures, techniques, and hardware, as well as maintain physical evidence.	Demonstrate effectiveness in configuring authentication schemes, such as NAT, content security and content vectoring, SYNDefender, and VPNs using industry standard firewalls.	Demonstrate effectiveness in the use and scan of a network with heterogeneous operating systems and identify security vulnerabilities.	Demonstrate knowledge of multiple areas within the liberal arts arena.	Demonstrate knowledge in design and configuration of Windows security.	Demonstrate effectiveness in tracking and monitoring attacks against Linux servers and how to prevent them
John's Hopkins	Proficiency	Proficiency	Proficiency	Outcome	Outcome
Division: Whiting School of Engineering Program: Cyber Security Award: MS	ensuring the confidentiality, availability and integrity of data,	preserving and restoring systems	developing risk management skills.	Demonstrate proficiency in assessing enterprise security risk and formulating technical recommendations in the areas of both hardware and software.	Demonstrate proficiency in four major areas of cryptology: Encryption, Hash Functions, Signature Schemes, and Authentication
Drexel University	Attain	Attain	Attain	Attain	Attain	Attain	Attain	Attain	Attain	Source
Division: College of Computing and Informatics Program: Computing & Security Award: BS Affiliation/Accreditation: NSA/CAE	An ability to apply knowledge of computing and mathematics appropriate to the program’s student outcomes and to the discipline	An ability to analyze a problem, and identify and define the computing requirements appropriate to its solution	An ability to design, implement, and evaluate a computer-based system, process, component, or program to meet desired needs	An ability to function effectively on teams to accomplish a common goal	An understanding of professional, ethical, legal, security and social issues and responsibilities	An ability to communicate effectively with a range of audiences	An ability to analyze the local and global impact of computing on individuals, organizations, and society	Recognition of the need for and an ability to engage in continuing professional development	An ability to use current techniques, skills, and tools necessary for computing practice	More information
Monroe Community College
Program: CyberSecurity Award: Certificate	Identify security risks to computing resources.	Assess potential threats to computing resources.	Develop effective countermeasures aimed at protecting data.	Develop effective countermeasures aimed at protecting computer assets
Millersville University	Ability	Ability	Ability	Ability	Ability	Ability	Ability	Ability	Ability
Division: Dept. of Computer Science Program: Computer Science Award: BS Affiliation/Accreditation: ABET	Analyze a complex computing problem and to apply principles of computing and other relevant disciplines to identify solutions.	Design, implement, and evaluate a computing-based solution to meet a given set of computing requirements in the context of the program’s discipline.	Communicate effectively in a variety of professional contexts.	Recognize professional responsibilities and make informed judgments in computing practice based on legal and ethical principles.	Function effectively as a member or leader of a team engaged in activities appropriate to the program’s discipline.	Apply computer science theory and software development fundamentals to produce computing-based solutions.				More Information
Southeast Missouri State	Ability	Ability	Ability	Ability	Ability	Ability	Ability
Harrision College of Business & Computing Program: Cybersecurity Award: BS Affiliation/Accreditation: ABET	An ability to analyze a problem, and to identify and define the computing requirements appropriate to its solution.	An ability to design, implement and evaluate a computer-based solution to meet a given set of computing requirements in the context of the discipline.	An ability to communicate effectively with a range of audiences about technical information.	An ability to make informed judgements in computing practice based on legal and ethical principles.	An ability to function effectively on teams to establish goals, plan tasks, meet deadlines, manage risk and produce deliverables.	An ability to apply security principles and practices to the environment, hardware, software, and human aspects of a system.	An ability to analyze and evaluate systems with respect to maintaining operations in the presence of risks and threats.
NYU, Tandon School of Engineering	Intention	Intention	Intention	Intention
Division: Tandon School of Engineering Program: Computer Science Award: MS Affiliation/Accreditation: NCAE/Cyber Op.s	deeply technical	interdisciplinary	grounded in the computer science (CS), computer engineering (CE), and/or electrical engineering (EE) disciplines	extensive opportunities for hands-on applications via labs/exercises.
Syracuse University	Outcome	Outcome	Outcome	Outcome	Outcome	Outcome
Program: Computer Science Award: BS Affiliation/Accreditation: ABET	Analyze a complex computing problem and apply principles of computing and other relevant disciplines to identify solutions.	Design, implement, and evaluate a computing-based solution to meet a given set of computing requirements in the context of the program’s discipline.	Communicate effectively in a variety of professional contexts.	Recognize professional responsibilities and make informed judgments in computing practice based on legal and ethical principles.	Function effectively as a member or leader of a team engaged in activities appropriate to the program’s discipline.	Apply computer science theory and software development fundamentals to produce computing-based solutions.
Syracuse University	Core/ABET Course	Core/ABET Course	Core/ABET Course
Special Program: Semester in Cyber Security Program: CyberSecurity Award: BS Affiliation/Accreditation: ABET/Veterans and Military Affairs	CIS 400: Certified Security by Design	CSE 484: Introduction to Computer and Network Security	CIS 487: Access Control, Security, and Trust
Carnegie Mellon	Skills	Skills	Skills	Skills	Skills	Skills	Skills	Source
Division: School of Computer Science Program: Computer Science Award: BS	Identify, use, design, develop and analyze appropriate abstractions and algorithms to solve problems while being able to prove the algorithm’s performance and correctness across a variety of metrics (e.g., time, space, parallel vs. sequential implementation, computability).	Implement solutions to problems in domains such as artificial intelligence, graphics and sound, software engineering, and humancomputer interaction, by applying the fundamentals of those areas to create solutions to current problems while being exposed to research developments that will enable them to adapt as the technology changes.	Reason about and implement programs in various programming languages and paradigms	Describe, specify, and develop large-scale, open-ended software systems subject to constraints such as performance and/or resource issues	Communicate technical material effectively to technical and nontechnical audiences	Work both individually and in teams	Recognize the social impact of computing and the attendant responsibility to consider the legal, moral and ethical implications of computing technologies.	More Information
Concentration: Security and Privacy	Understand how to reason about the adversary in computer systems.	Be familiar with common security vulnerabilities, from buffer overflows and return oriented programming to cross-site scripting, and widely deployed defenses against these vulnerabilities.	Be familiar with and understand how to apply the basic concepts in cryptography and secure system design and analysis.
NYU, City Tech	Demonstrate	Demonstrate	Demonstrate	Demonstrate	Demonstrate	Demonstrate	Demonstrate	Demonstrate	Hands-on	Hands-on	Hands-on	Hands-on
Program: Computer Systems, Networking and Security Award: B Tech	An ability to apply the knowledge, techniques, skills, and modern tools of the discipline to computer systems technology activities.	An ability to apply a knowledge of mathematics, science, engineering, and technology to computer systems problems that require application of principles and practical knowledge.	An ability to conduct standard tests and measurements, and to conduct, analyze, and interpret experiments.	An ability to function effectively as a member of a technical team.	An ability to apply written, oral, and graphical communication in both technical and non-technical environments; and an ability to identify and use appropriate technical literature.	An understanding of the need for and an ability to engage in self-directed continuing professional development.	An understanding of and a commitment to address professional and ethical responsibilities, including a respect for diversity.	A commitment to quality, timeliness, and continuous improvement in professional practice	Analyzing, designing, and implementing hardware and software computer systems.	Applying project management techniques to computer systems.	Demonstrating a deeper knowledge of at least one area of computing, such as software development, databases, information technology operations, networking and security, enabling the student to gain employment in the computing field.	Understanding how management uses information systems to operate business enterprises

ABET Competencies

Source: https://cybered.hosting.acm.org/wp/
Knowledge Area: Data Security
Basic cryptography concepts	Describe the purpose of cryptography and list ways it is used in data communications.	Describe the following terms: cipher, cryptanalysis, cryptographic algorithm, and cryptology, and describe the two basic methods (ciphers) for transforming plaintext in ciphertext.	Explain how public key infrastructure supports digital signing and encryption and discuss the limitations/vulnerabilities.	Discuss the dangers of inventing one’s own cryptographic methods.	Describe which cryptographic protocols, tools and techniques are appropriate for a given situation.
End-to-end secure communications	Explain the goals of end-to-end data security.
Digital forensics	Describe what a digital investigation is, the sources of digital evidence, and the limitations of forensics.	Compare and contrast variety of forensics tools.
Data integrity and authentication	Explain the concepts of authentication, authorization, access control, and data integrity.	Explain the various authentication techniques and their strengths and weaknesses.	Explain the various possible attacks on passwords.	Data erasure Describe the various techniques for data erasure.
Knowledge Area: Software Security
Fundamental Design Principles; Least Privilege, Open Design, and Abstraction	Discuss the implications of relying on open design or the secrecy of design for security.	List the three principles of security.	Describe why each principle is important to security.	Identify the needed design principle.
Security requirements and the roles they play in design	Explain why security requirements are important.	Identify common attack vectors.	Describe the importance of writing secure and robust programs.	Describe the concept of privacy including personally identifiable information.
Implementation issues	Explain why input validation and data sanitization are necessary.	Explain the difference between pseudorandom numbers and random numbers.	Differentiate between secure coding and patching and explain the advantage of using secure coding techniques.	Describe a buffer overflow and why it is a potential security problem.
Static, dynamic analysis	Explain the difference between static and dynamic analysis.	Discuss a problem that static analysis cannot reveal.	Discuss a problem that dynamic analysis cannot reveal.
Configuring, patching	Discuss the need to update software to fix security vulnerabilities.	Explain the need to test software after an update but before the patch is distributed.	Explain the importance of correctly configuring software.
Knowledge Area: Component Security
Vulnerabilities of system components	Explain how the security of a system’s components might impact the security of the system.	Describe ways in which the confidentiality of a component’s design may be compromised.	Describe ways to learn information about component’s functionality with limited information about its design and implementation.
Component lifecycle	List the phases of a component’s lifecycle.	Secure component design principles List component design artifacts which may require protection.	Give examples of several secure component design principles and explain how each protects the security of components.	Describe several techniques for protecting the design elements of an integrated circuit.
Supply chain management	List common points of vulnerability in a component’s supply chain.	Describe security risks in a component supply chain.	Describe ways to mitigate supply chain risks.
Security testing	Differentiate between unit and system testing.	List several techniques for testing security properties of a component.
Reverse engineering	List reasons why someone would reverse engineer a component.	Explain the difference between static and dynamic analysis in reverse engineering software.	Describe a technique for reverse engineering the functionality of an integrated circuit.
Knowledge Area: Connection Security
Systems, architecture, models, and standards	Discuss the need for common models and architectures in order to describe systems.	Describe a model of systems that consists of components and interfaces for connections.	Explain why a component requires at least one interface.	List several standards that define models consisting of systems of components and interfaces.	Describe the components and interfaces of a networking standard provided.
Physical component interfaces	Explain why a hardware device is always modeled a physical component.	List several examples of physical component interfaces with their associated vulnerabilities.	Describe an exploit for a vulnerability of a physical interface provided.
Software component interfaces	Explain why every physical interface has a corresponding software component to provide a corresponding software interface.	Explain how software components are organized to represent logical layers in a standard model.	Discuss how the Internet 5 layer model can be viewed as software components and interfaces that represent levels of services encapsulated by lower-level services.	Discuss how TCP/IP as a service is represented by different interfaces in different software systems.
Connection attacks	Explain how connection attacks can be understood in terms of attacks on software component interfaces.	Describe how a specified standard interface could expose vulnerabilities in a software component that implements the interface.	Describe how an implementation could protect itself from a specified vulnerability in a specified standard interface.
Transmission attacks	Explain how transmission attacks are often implemented as attacks on components that provide the service of relaying information.	Describe an attack on a specified node in a TCP/IP network given the description of a vulnerability.	Explain why transmission attacks can often be viewed as connection attacks on network components (physical or software).
Knowledge Area: System Security
Holistic approach	Explain the concepts of trust and trustworthiness.	Explain what is meant by confidentiality, integrity, and availability.	Explain what a security policy is, and its role in protecting data and resources.
Security policy	Discuss the importance of a security policy.	Explain why different sites have different security policies.	Explain the relationship among a security group, system configuration, and procedures to maintain the security of the system.
Authentication	Explain three properties commonly used for authentication.	Explain the importance of multifactor authentication.	Explain the advantages of pass phrases over passwords.
Access control	Describe an access control list.	Describe physical and logical access control, and compare and contrast them.	Distinguish between authorization and authentication.
Monitoring	Discuss how intrusion detection systems contribute to security.	Describe the limits of anti-malware software such as antivirus programs.	Discuss uses of system monitoring.
Recovery	Explain what resilience is and identify an environment in which it is important.	Discuss the basics of a disaster recovery plan.	Explain why backups pose a potential security risk.
Testing	Describe what a penetration test is and why it is valuable.	Discuss how to document a test that reveals a vulnerability.	Discuss the importance of validating requirements.
Documentation	Discuss the importance of documenting proper installation and configuration of a system.	Be able to write host and network intrusions documentation.	Be able to explain the security implications of unclear or incomplete documentation of system operation.
Identity Management	Explain the difference between identification, authentication, and access authorization of people and devices.	Discuss the importance of audit trails and logging in identification and authentication.	Demonstrate the ability to implement the concept of least privilege and segregation of duties.	Demonstrate the overall understanding of access control attacks and mitigation measures.
Social Engineering	Demonstrate overall understanding of the types of social engineering attacks, psychology of social engineering attacks, and misleading users.	Demonstrate the ability to identify types of social engineering attacks.	Demonstrate the ability to implement approaches for detection and mitigation of social engineering attacks.
Awareness and understanding	Discuss the importance of cyber hygiene, cybersecurity user education, as well as cyber vulnerabilities and threats awareness.	Describe the major topics within Security Education, Training,	and Awareness (SETA) programs.	Discuss the importance of SETA as countermeasures.	Discuss the importance of risk perception and communication in the context of mental models of cybersecurity and privacy.
Social behavioral privacy and security	Compare and contrast various theories of privacy from social psychology and social science.	Describe the concepts of privacy tradeoffs and risks in the social context, control and awareness of data consent, personal information monitoring, regulatory protections and concerns on maintaining social privacy.	Discuss the importance of social media privacy and security.
Personal data privacy and security	Discuss the importance of protection of Sensitive Personal Data (SPD) and Personally Identifiable Information (PII).	Discuss the importance of regulations governing the collection, use and distribution of SPD, and possibilities for inference of SPD.	Describe the concepts of personal tracking and digital footprint, while understanding the invasiveness of such tools in the context of privacy.
Knowledge Area: Organizational Security
Risk Management	Describe risk management and its role in the organization.	Describe risk management techniques to identify and prioritize risk factors for information assets and how risk is assessed.	Discuss the strategy options used to treat risk and be prepared to select from them when given background information.	Describe popular methodologies used in the industry to manage risk.
Governance and policy	Discuss the importance, benefits, and desired outcomes of cybersecurity governance and how such a program would be implemented.	Describe information security policy and its role in a successful information security program.	Describe the major types of information security policy and the major components of each.	Explain what is necessary to develop, implement, and maintain effective policy and what consequences the organization may face if it does not do so.
Laws, ethics, and compliance	Differentiate between law and ethics.	Describe why ethical codes of conduct are important to cybersecurity professionals and their organizations.	Identify significant national and international laws that relate to cybersecurity.	Explain how organizations achieve compliance with national and international laws and regulations, and specific industry standards.
Strategy and planning	Explain strategic organizational planning for cybersecurity and its relationship to organization-wide and IT strategic planning.	Identify the key organizational stakeholders and their roles.	Describe the principal components of cybersecurity system implementation planning.
Knowledge Area: Societal Security
Cybercrime	Discuss various motives for cybercrime behavior.	Summarize terror activities in cyberspace geared toward generating societal fear and certainty.	Describe methods for investigating both domestic and international crimes.	Explain why preserving the chain of digital evidence is necessary in prosecuting cybercrimes.
Cyber law	Describe the constitutional foundations of cyber law.	Describe international data security and computer hacking laws.	Interpret intellectual property laws related to security.	Summarize laws governing online privacy.
Cyber ethics	Distinguish among virtue ethics, utilitarian ethics and deontological ethics.	Paraphrase professional ethics and codes of conduct from prominent professional societies, such as ACM, IEEE-CS, AIS and (ISC)2.	Describe ways in which decision-making algorithms could overrepresent or under-represent majority and minority groups in society.
Cyber policy	Describe major international public policy positions and the impact they have on organizations and individuals.	Summarize nation-specific cybersecurity public policy with respect to the protection of sensitive information and protection of critical infrastructure.	Explain global impact of cybersecurity to culture including areas such as the economy, social issues, policy and laws.
Privacy	Describe the concept of privacy including the societal definition of what constitutes personally private information and the tradeoffs between individual privacy and security.	Summarize the tradeoff between the rights to privacy by the individual versus the needs of society.	Describe the common practices and technologies used to safeguard personal privacy.

NCAE Competencies

Source: http://www.iad.gov/NIETP/CAERequirements.cfm
Foundational
CyberSecurity Foundations (CSF)	Ability	Ability	Ability	Ability	Ability
	Describe the fundamental concepts of the cybersecurity discipline and use to provide system security	Describe potential system attacks and the actors that might perform them	Describe cyber defense tools, methods and components and apply cyber defense methods to prepare a system to repel attacks	Describe appropriate measures to be taken should a system compromise occur	Properly use the Vocabulary associated with cybersecurity
CyberSecurity Principles (CSP)	Ability	Ability	Ability	Ability	Ability
	Define the principles of cybersecurity	Describe why each principle is important to security and how it enables the development of security mechanisms that can implement desired security policies	Analyze common security failures and identify specific design principles that have been violated	Given a specific scenario, identify the design principles involved or needed	Understand the interaction between security and system usability and the importance for minimizing the effects of security mechanisms.
IT Systems Components (ISC)	Ability	Ability	Ability	Ability	Ability
	Describe the hardware components of modern computing environments and their individual functions	Describe the basic security implications of modern computing environments	Understand the Federal, State and Local Cyber Defense partners/structures	Properly use the Vocabulary associated with cybersecurity.
Technical Core
Technical Core – Basic Cryptography (BCY)	Ability	Ability	Ability	Ability
	Students will be able to identify the elements of a cryptographic system	Students will be able to describe the differences between symmetric and asymmetric algorithms	Students will be able to describe which cryptographic protocols, tools and techniques are appropriate for a given situation	Students will be able to describe how crypto can be used, strengths and weaknesses, modes, and issues that have to be addressed in an implementation (e.g., key management), etc.
Technical Core – Basic Networking (BNW	Ability	Ability	Ability	Ability	Ability	Ability
	Describe the fundamental concepts, technologies, components and issues related to communications and data networks	Design a basic network architecture given a specific need and set of hosts/clients	Track and identify the packets involved in a simple TCP connection (or a trace of such a connection)	Use a network monitoring tools to observe the flow of packets (e.g., WireShark)	Perform network mapping (enumeration and identification of network components) (e.g., Nmap)	Describe common network vulnerabilities.
Technical Core – Basic Scripting and Programming (BSP)	Ability	Ability	Ability	Ability
	Demonstrate their proficiency in the use of scripting languages to write simple scripts (e.g., to automate system administration tasks)	Write simple linear and looping scripts	Write simple and compound conditions within a programming language or similar environment (e.g., scripts, macros, SQL)	Demonstrate proficiency in the use of a programming language to solve complex problems in a secure and robust manner.
Technical Core – Network Defense (NDF)	Ability	Ability	Ability	Ability
	Describe the key concepts in network defense (defense in depth, minimizing exposure, etc.)	Explain how network defense tools (firewalls, IDS, etc.) are used to defend against attacks and mitigate vulnerabilities	Analyze how security policies are implemented on systems to protect a network	Evaluate how network operational procedures relate to network security.
Technical Core – Operating Systems Concepts (OSC)	Ability	Ability	Ability	Ability
	Describe the role and basic functions of an operating system, and how operating systems interact with hardware and software applications	Identify and describe basic security issues of operating systems.
Non-Technical Core
Non-Technical Core – Cyber Threats (CTH)	Ability	Ability	Ability	Ability
	Identify the bad actors in cyberspace and compare and contrast their resources, capabilities/techniques, motivations and aversion to risk	Describe different types of attacks and their characteristics.
Non-Technical Core – Cybersecurity Planning and Management (CPM)	Ability	Ability	Ability	Ability
	Examine the placement of security functions in a system and describe the strengths and weaknesses	Develop contingency plans for various size organizations to include: business continuity, disaster recovery and incident response	Develop system specific plans for: aThe protection of intellectual property bThe implementation of access controls cPatch and change management	Outline and explain the roles of personnel in planning and managing security, including: aBoard of Directors bSenior Management cChief Information Security Officer (CISO) dIT Management (CIO, IT Director, etc) eFunctional Area Management fInformation Security personnel gEnd users
Non-Technical Core – Policy, Legal, Ethics, and Compliance (PLE)	Ability	Ability	Ability
	List the applicable laws and policies related to cyber defense and describe the major components of each pertaining to the storage and transmission of data	Describe their responsibilities related to the handling of data as it pertains to legal, ethical and/or agency auditing issues	Describe how the type of legal dispute (civil, criminal, private) affects the evidence used to resolve it.
Non-Technical Core – Security Program Management (SPM)	Ability	Ability	Ability
	Apply their knowledge to develop a security program, identifying goals, objectives and metrics	Apply their knowledge to effectively manage a security program	Assess the effectiveness of a security program
Non-Technical Core – Security Risk Analysis (SRA)	Ability	Ability	Ability	Ability
	Describe how risk relates to a system security policy	Describe various risk analysis methodologies	Evaluate and categorize risk a) with respect to technology; b) with respect to individuals, and c) in the enterprise, and recommend appropriate responses	Select the optimal methodology based on needs, advantages and disadvantages.

CSE Competencies

Data Sample

Cybersecurity Learning Outcomes

Share this:

Like this: