Best Practices and Guidelines for Cybersecurity Training

Cybersecurity has never been more important than today. While increasing digitalization brings many advantages, it also comes with increased risks of cyberattacks: A growing attack surface contributes to a higher probability of attacks, and increasing dependence on digital systems and services contribute to higher consequences of attacks when they are successful. On top of this, the geopolitical situation has also led to an increased activity among many different threat actors, including cyber criminals, nation states and cyber activists. One of the main challenges to combat the cyber threat is the lack of skilled people: Not only are we missing around 4 mio. cybersecurity professionals on a global scale: We also have a huge challenge of ensuring that the general public, and in particular those working with IT, have a strong knowledge of cybersecurity. This need for training is also addressed in new regulations, such as the NIS2 Directive in the European Union. In this paper, we define 20 principles for good cybersecurity training, with a particular focus on technical training that goes beyond awareness. The principles are based on a combination of theoretical knowledge, practical experience, and extensive dialogues with stakeholders from both industry and academia through joint trainings and workshops. The paper explores topics such as active learning, combination of theory and practice through hands-on exercises, collaborative learning, gamification with clear missions, scaffolding and the use of hints and real-world context and experience. We believe that the paper can serve as an important reference for development of trainings, training platforms and courses in cybersecurity. We also believe the methodology with collaboration across companies and academia can contribute to increase the quality of trainings, and eventually contribute to closing the cybersecurity skills gap.