Mitigating the cyber security skills shortage: The influence of national skills competitions on cyber security interest

当前劳动力市场存在网络安全专业人才短缺的问题，不利于各国经济发展和国家安全。各国政府试图通过设计针对网络安全技能供需的政策来解决这一问题。在这些政策中，国家网络安全技能竞赛（NCSSCs）已被广泛实施，以增加进入网络安全劳动力市场的学生渠道。然而，关于这些干预措施的科学研究很少，许多问题仍然没有得到解答：在加入NCSSC之前，参与者如何对网络安全产生兴趣？NCSSCs是否影响了参与者对网络安全作为一个主题和职业的兴趣？什么因素对他们的兴趣影响最大？通过回答这些问题，本文旨在讨论国家技能竞赛作为一项公共政策的作用，以减轻网络安全工作者的缺乏。这项研究使用了意大利的NCSSC， CyberChallenge。IT （CCIT）作为一个案例研究，因为它是欧洲的技能竞赛，为最多的参与者提供网络安全培训。本研究采用前后对照设计，从非随机对照组中收集数据。数据的收集采用混合方法：定量数据通过两次在线调查收集，定性数据通过对50名比赛参与者的访谈收集。这项研究发现，CCIT学生对网络安全产生兴趣是通过一系列“触发因素”，最明显的是好奇心、正式和非正式的课程作业，以及CCIT本身。此外，CCIT对网络安全作为一个主题和职业的兴趣都有所增加。然而，被试对这两者有不同的看法，这表明理论应该进一步研究兴趣发展与职业兴趣之间的关系。最后，本研究建议超越利益的概念，充分认识非csscs的影响，特别是包括其他相关的结果变量，如教育和职业规划、关键选择和竞争利益。本文认为，像CCIT这样组织和实施的NCSSCs可能是缓解网络安全专业人员缺乏的一个有价值的解决方案。然而，就其本身而言，一项技能竞赛计划不太可能达到一系列政策协调在解决人才短缺方面可能达到的效果。由于短缺问题有几个根源，仅靠NCSSC所能做的是有限的。然而，这将为进一步引导学生进入网络安全领域的其他政策奠定坚实的基础。本文对兴趣理论、技能竞赛与兴趣之间的关系、NCSSCs的设计和实施以及最终的网络安全教育和技能政策等重要辩论做出了贡献。该项目属于EPSRC数字经济研究领域，其中“信任、身份、隐私和安全”是本网站https://www.epsrc.ac.uk/research/ourportfolio/themes/列出的主题或研究领域之一。

There is a shortage of cyber security professionals in the current labour market, which is detrimental to countries' economic development and national security. Governments have attempted to deal with this issue by designing policies targeting both the supply and demand of cyber security skills. Among these policies, national cyber security skills competitions (NCSSCs) have been widely implemented to increase the pipeline of students entering the cyber security labour market. However, scientific studies on these interventions are scarce, and many questions are still unanswered: How do participants develop an interest in cyber security before joining a NCSSC? Do NCSSCs influence participants' interest in cyber security as a topic and as a career? What factors contribute the most to influence their interest? By answering these questions, this thesis aims to discuss the role of national skills competitions as a public policy to mitigate the lack of cyber security workers.This research used the Italian NCSSC, the CyberChallenge.IT (CCIT), as a case study as it is the skills competition in Europe that provides cyber security training to the largest number of participants. This research employed a before and after design, collecting data from non-randomised comparison groups. Data were gathered following a mixed-method approach: quantitative data were collected through two online surveys and qualitative data through 50 interviews with competition participants.This study found that CCIT students became interested in cyber security through a mix of "triggers," most notably curiosity, formal and informal coursework, and the CCIT itself. Moreover, the CCIT increased interest in both cyber security as a topic and as a career. However, participants differentiated between the two, suggesting that theory should further investigate the relationship between interest development and vocational interest. Finally, this research recommends going beyond the concept of interest to fully appreciate NCSSCs' impact, particularly by including other relevant outcome variables, such as educational and career planning, key choices, and competing interests.This thesis argues that NCSSCs organized and implemented like the CCIT could be a valuable solution to mitigate the lack of cyber security professionals. However, on its own, a skills competition programme is unlikely to achieve what a concert of policies might in dealing with the shortage. As the shortage issue has several roots, there are limits to what a NCSSC alone can do. However, it would lay a strong foundation for other policies to further steer students into the cyber security sector.This thesis contributes to important debates such as interest theory, the relationship between skills competitions and interest, the design and implementation of NCSSCs and ultimately cyber security education and skills policy.EPRSC RemitThis project falls within the EPSRC Digital Economy research area, where "Trust, identity, privacy and security" is one of the themes or research areas listed on this website https://www.epsrc.ac.uk/research/ourportfolio/themes/.