Mitigating the cyber security skills shortage: The influence of national skills competitions on cyber security interest

There is a shortage of cyber security professionals in the current labour market, which is detrimental to countries' economic development and national security. Governments have attempted to deal with this issue by designing policies targeting both the supply and demand of cyber security skills. Among these policies, national cyber security skills competitions (NCSSCs) have been widely implemented to increase the pipeline of students entering the cyber security labour market. However, scientific studies on these interventions are scarce, and many questions are still unanswered: How do participants develop an interest in cyber security before joining a NCSSC? Do NCSSCs influence participants' interest in cyber security as a topic and as a career? What factors contribute the most to influence their interest? By answering these questions, this thesis aims to discuss the role of national skills competitions as a public policy to mitigate the lack of cyber security workers.

This research used the Italian NCSSC, the CyberChallenge.IT (CCIT), as a case study as it is the skills competition in Europe that provides cyber security training to the largest number of participants. This research employed a before and after design, collecting data from non-randomised comparison groups. Data were gathered following a mixed-method approach: quantitative data were collected through two online surveys and qualitative data through 50 interviews with competition participants.

This study found that CCIT students became interested in cyber security through a mix of "triggers," most notably curiosity, formal and informal coursework, and the CCIT itself. Moreover, the CCIT increased interest in both cyber security as a topic and as a career. However, participants differentiated between the two, suggesting that theory should further investigate the relationship between interest development and vocational interest. Finally, this research recommends going beyond the concept of interest to fully appreciate NCSSCs' impact, particularly by including other relevant outcome variables, such as educational and career planning, key choices, and competing interests.

This thesis argues that NCSSCs organized and implemented like the CCIT could be a valuable solution to mitigate the lack of cyber security professionals. However, on its own, a skills competition programme is unlikely to achieve what a concert of policies might in dealing with the shortage. As the shortage issue has several roots, there are limits to what a NCSSC alone can do. However, it would lay a strong foundation for other policies to further steer students into the cyber security sector.

This thesis contributes to important debates such as interest theory, the relationship between skills competitions and interest, the design and implementation of NCSSCs and ultimately cyber security education and skills policy.

EPRSC Remit
This project falls within the EPSRC Digital Economy research area, where "Trust, identity, privacy and security" is one of the themes or research areas listed on this website https://www.epsrc.ac.uk/research/ourportfolio/themes/.

It is part of the nature of Cyber Security - and a key reason for the urgency in developing new research approaches - that it now is a concern of every section of society, and so the successful CDT will have a very broad impact indeed. We will ensure impact for:

* The IT industry; vendors of hardware and software, and within this the IT Security industry;

* High value/high assurance sectors such as banking, bio-medical domains, and critical infrastructure, and more generally the CISO community across many industries;

* The mobile systems community, mobile service providers, handset and platform manufacturers, those developing the technologies of the internet of things, and smart cities;

* Defence sector, MoD/DSTL in particular, defence contractors, and the intelligence community;

* The public sector more generally, in its own activities and in increasingly important electronic engagement with the citizen;

* The not-for-profit sector, education, charities, and NGOs - many of whom work in highly contended contexts, but do not always have access to high-grade cyber defensive skills.

Impact in each of these will be achieved in fresh elaborations of threat and risk models; by developing new fundamental design approaches; through new methods of evaluation, incorporating usability criteria, privacy, and other societal concerns; and by developing prototype and proof-of-concept solutions exhibiting these characteristics. These impacts will retain focus through the way that the educational and research programme is structured - so that the academic and theoretical components are directed towards practical and anticipated problems motivated by the sectors listed here.