Half of polled infosec pros say their degree was less than useful for real-world work – Source: go.theregister.com

Half of infosec professionals polled by Kaspersky said any cybersecurity knowledge they picked up from their higher education is at best somewhat useful for doing their day jobs. On the other hand, half said the know-how was at least very useful. We’re a glass half-empty lot.

The Moscow-headquartered multinational revealed those figures today in the first part of a multi-stage report based on a survey of 1,012 infosec professionals across 29 countries.

About a quarter of those probed said their higher education was “not at all useful” for their working life in cybersecurity; 12 percent said it was “slightly useful;” and 14 percent described it as “somewhat useful,” adding up to 50 percent for the negatives. On the flip side, 29 percent said their education was “extremely” useful, and 21 percent said “very” useful.

Here’s what Kaspersky had to say about that:

Or it might be that they took the wrong course, or didn’t pay attention, but that’s just our opinion. And we should include this part from Kaspersky’s report to give you more context:

If you were wondering what subjects these industry professionals studied – for instance, it’s no surprise that someone taking physics found that less than useful for IT security – we pondered that, too. Kaspersky said 36 percent of those polled said the highest-level of education they got was in engineering, 21 percent said information technology, 15 percent said computer science, 13 percent said business management, 10 percent said science, and three percent said mathematics or something else.

We’re told 43 percent of the polled cybersecurity professionals actually studied information security as part of their official curriculum. Which perhaps better explains the above 50-50 split on usefulness.

Keep up

There is another possible angle here. Security technology — and tech in general — moves fast and becomes “legacy” in one or two years, it’s believed.

“If you are studying for a bachelor’s degree in cybersecurity, for instance, you are preparing for a four-year course,” said one survey respondent who works as a bank CIO in Brazil. “But in those four years the tech has advanced so much that the knowledge you acquired in the first or second year is already outdated in your third or fourth years of study.” 

As mentioned above, an overall skills gap in the IT security industry may have caused or is fueling a shortage of qualified instructors who have practical industry experience as opposed to theoretical knowledge. Without those educators, graduates may feel the knowledge they gained is less than useful in the real world.

Almost 40 percent of the polled infosec professionals worldwide said they “somewhat disagree,” “disagree,” or “strongly disagree” that their college or university professors had real-world experience. Breaking that down: 32 percent of North American respondents said they disagreed their tutors had real-life experience; 35 percent for Europe; and 37 percent for the Asia-Pacific region. 

• Wait, security courses aren’t a requirement to graduate with a computer science degree?
• Infosec pros can secure IT, but have harder time securing job satisfaction
• Ransomware attacks hospitalizing security pros, as one admits suicidal feelings
• Infosec still (mostly) a boys club

The regions with the smallest number of academic instructors with industry experience are in Russia (42 percent of respondents in that region disagreed their tutors had outside experience) and the Middle East, Turkey and Africa (48 percent).

Latin America seemed to have the highest report with only 20 percent of people surveyed disagreeing that their professors had practical experience in the field.

Overall, half of the respondents rated the availability of infosec courses in higher education institutions as poor (27 percent) or very poor (23 percent), and this number jumped to 83 percent for professionals with between two and five work experience under their belt.

According to one professional from the US: “There was no such thing as handling real-life situations, it was simulating real security incidents and learning to respond effectively. So this was missing from the educational programs. Handling actual security incidents requires a different set of skills than theoretical knowledge alone.” ®