What's in a Name? How Cyber Security Masters Degrees Compare

Cyber security is now a prominent topic in university education, forming the focus of dedicated degrees at both undergraduate and postgraduate levels. However, the way it is perceived and understood by students can vary significantly, depending upon how the university concerned has elected to present their program. While many degrees (particularly at Masters level) can be found that address specialized aspects of cyber security, there are also many programs that are presented as offering general coverage and are titled accordingly. However, the actual topic coverage offered within these degrees has the potential to vary considerably, meaning that students may get a very different perspective on cyber security depending upon their choice of program. Building upon earlier phases of investigation, this paper examines the topic coverage and consistency of a series of Masters degrees in cyber security, drawing upon a sample of ten from the UK (which had been the focus of the earlier work) and a further ten from a series of European countries. Each program was assessed in terms of the technical and non-technical cyber security topics being covered, and the proportion of credits afforded to these in the degree overall. While all twenty programs shared the same title, the findings revealed significant variation between them in terms of the topics receiving coverage. Additionally, it was apparent that some topics were more likely to receive attention than others, with a general skew towards addressing technical themes such as digital forensics and security testing, while significant non-technical themes such as security awareness and business continuity are often overlooked in comparison. The paper discusses these findings, including the implications of having degrees that are offered as general Masters in cyber security but with imbalanced coverage of key topics, and how the resulting graduate qualifications are likely to align with industry needs. Finally, consideration is directed towards the potential for establishing unified frameworks for cyber security syllabi and assessment of coverage.