[Paper Review] Pedagogic Challenges in Teaching Cyber Security -- a UK Perspective

Harjinder, Lallie, Jane, Sinclair+4 more|arXiv (Cornell University)|Dec 13, 2022

Information and Cyber Security3 citations

TL;DR

This paper examines pedagogic challenges in UK cyber security degree programmes, focusing on tensions between student expectations—shaped by media portrayals like the 'CSI effect'—and academic teaching goals. It identifies key issues in balancing theoretical foundations versus technical tools, ethical instruction, and industry alignment, offering insights for curriculum design and academic practice in cyber security education.

ABSTRACT

Cyber security has become an issue of national concern in the UK, USA and many other countries worldwide. Universities have reacted to this by launching numerous cyber security degree programmes. In this paper we explore the structure of these degrees and in particular highlight the challenges faced by academics teaching on them. We explore the issues relating to student expectations and the CSI effect in students entering cyber security. We highlight the science vs tools debate to bring focus to some of the pedagogic tensions between students/industry and the academics who teach on the degree courses. Cyber security is subject to numerous ethical issues and nowhere is this more so than in a university environment. We analyse some of the ethical teaching related issues in cyber security. This paper will be of interest to professionals in industry as well as academics interested in exploring the shape, flavour and structure of cyber security related degree courses and also the challenges presented to the academics that teach these degrees.

Motivation & Objective

• To analyze the structure and pedagogic challenges of cyber security degree programmes in UK higher education.
• To investigate the impact of the 'CSI effect' on student expectations and course delivery in cyber security programmes.
• To examine the tension between theoretical foundations ('science') and practical tool-based learning ('tools') in cyber security education.
• To explore ethical challenges in teaching cyber security within university settings.
• To provide actionable insights for academics and industry professionals on shaping effective cyber security curricula.

Proposed method

• Conduct a qualitative analysis of cyber security degree programmes across UK universities.
• Examine student expectations through the lens of media influence, particularly the 'CSI effect' from crime dramas.
• Compare academic priorities (theoretical depth, ethical reasoning) with student and industry demands (technical skills, tool proficiency).
• Identify and discuss ethical dilemmas in cyber security teaching, including responsible use of offensive security tools.
• Use thematic analysis to highlight recurring pedagogic tensions and institutional responses.

Experimental results

Research questions

• RQ1 How do media portrayals such as the 'CSI effect' influence student expectations in cyber security degree programmes?
• RQ2 What are the main pedagogic tensions between academic teaching goals and industry or student demands in cyber security education?
• RQ3 How do ethical considerations shape the delivery and content of cyber security modules in UK universities?
• RQ4 To what extent do cyber security programmes balance theoretical foundations with practical, tool-based learning?
• RQ5 What challenges do academics face in delivering cyber security education that meets both academic standards and industry needs?

Key findings

• The 'CSI effect' significantly shapes student expectations, leading to a desire for immediate, hands-on technical skills rather than theoretical understanding.
• A persistent tension exists between teaching cyber security as a scientific discipline versus a set of technical tools, affecting curriculum design and student engagement.
• Ethical instruction in cyber security is underdeveloped in many programmes, despite the field's high sensitivity to misuse and moral responsibility.
• Academics face pressure to prioritize practical, job-ready skills over foundational knowledge, risking a decline in critical thinking and long-term adaptability.
• There is a lack of standardized ethical frameworks in cyber security curricula, leading to inconsistent teaching approaches across institutions.