Mitigating the cyber security skills shortage: The influence of national skills competitions on cyber security interest

当前劳动力市场网络安全专业人才短缺，不利于各国经济发展和国家安全。各国政府试图通过制定针对网络安全技能供需的政策来解决这一问题。在这些政策中，国家网络安全技能竞赛得到了广泛实施，以增加进入网络安全劳动力市场的学生的渠道。然而，关于这些干预措施的科学研究很少，许多问题仍然没有答案：参与者如何在加入NCSSC之前发展对网络安全的兴趣？NCSSC是否会影响参与者对网络安全作为一个主题和职业的兴趣？哪些因素对他们的兴趣影响最大？通过回答这些问题，本文旨在讨论国家技能竞赛作为一项公共政策，以缓解网络安全工作者的缺乏的作用。本研究使用意大利NCSSC，网络挑战.IT（CCIT），作为一个案例研究，因为它是在欧洲的技能竞赛，提供网络安全培训的参与者最多。这项研究采用了前后设计，从非随机对照组收集数据。数据收集采用混合方法：定量数据通过两个在线调查收集，定性数据通过对50名参赛者的访谈收集。研究发现，CCIT学生对网络安全感兴趣是通过各种“触发因素”，最明显的是好奇心、正式和非正式的课程以及CCIT本身。此外，CCIT增加了对网络安全作为一个主题和职业的兴趣。然而，与会者区分两者，建议理论应进一步研究兴趣发展和职业兴趣之间的关系。最后，本研究建议超越利益的概念，充分认识NCSC的影响，特别是通过纳入其他相关结果变量，例如教育和职业规划、关键选择和竞争利益。本论文认为，像CCIT这样组织和实施的NCSC可能是一个有价值的解决方案，可以缓解网络安全专业人员的缺乏。然而，技能竞争方案本身不太可能像协调一致的政策那样解决人才短缺问题。由于短缺问题有几个根源，只有NCSSC能做的事情是有限的。本论文对利益理论、技能竞赛与利益之间的关系、NCSSC的设计和实施以及最终的网络安全教育和技能政策等重要争论做出了贡献。EPRSC Remit本项目福尔斯属于EPSRC数字经济研究领域，其中“信任，身份，隐私和安全”是本网站www.example.com上列出的主题或研究领域之一https://www.epsrc.ac.uk/research/ourportfolio/themes/。

There is a shortage of cyber security professionals in the current labour market, which is detrimental to countries' economic development and national security. Governments have attempted to deal with this issue by designing policies targeting both the supply and demand of cyber security skills. Among these policies, national cyber security skills competitions (NCSSCs) have been widely implemented to increase the pipeline of students entering the cyber security labour market. However, scientific studies on these interventions are scarce, and many questions are still unanswered: How do participants develop an interest in cyber security before joining a NCSSC? Do NCSSCs influence participants' interest in cyber security as a topic and as a career? What factors contribute the most to influence their interest? By answering these questions, this thesis aims to discuss the role of national skills competitions as a public policy to mitigate the lack of cyber security workers.This research used the Italian NCSSC, the CyberChallenge.IT (CCIT), as a case study as it is the skills competition in Europe that provides cyber security training to the largest number of participants. This research employed a before and after design, collecting data from non-randomised comparison groups. Data were gathered following a mixed-method approach: quantitative data were collected through two online surveys and qualitative data through 50 interviews with competition participants.This study found that CCIT students became interested in cyber security through a mix of "triggers," most notably curiosity, formal and informal coursework, and the CCIT itself. Moreover, the CCIT increased interest in both cyber security as a topic and as a career. However, participants differentiated between the two, suggesting that theory should further investigate the relationship between interest development and vocational interest. Finally, this research recommends going beyond the concept of interest to fully appreciate NCSSCs' impact, particularly by including other relevant outcome variables, such as educational and career planning, key choices, and competing interests.This thesis argues that NCSSCs organized and implemented like the CCIT could be a valuable solution to mitigate the lack of cyber security professionals. However, on its own, a skills competition programme is unlikely to achieve what a concert of policies might in dealing with the shortage. As the shortage issue has several roots, there are limits to what a NCSSC alone can do. However, it would lay a strong foundation for other policies to further steer students into the cyber security sector.This thesis contributes to important debates such as interest theory, the relationship between skills competitions and interest, the design and implementation of NCSSCs and ultimately cyber security education and skills policy.EPRSC RemitThis project falls within the EPSRC Digital Economy research area, where "Trust, identity, privacy and security" is one of the themes or research areas listed on this website https://www.epsrc.ac.uk/research/ourportfolio/themes/.