Cyber Security

I was fortunate to find myself jammed into a room last week for a cyber security event organised by Education Scotland.  This was an excellent couple of hours with some really, really relevant stuff for CS education in schools. In particular:

  • An excellent course for S1(ish) students developed by Scott Hunter (Kyle Academy, Ayrshire)
  • New National Units and an NPA being finalised by the SQA vocational team, headed up by Bobby Elliott.
  • An overview of the Cybercrime scene by DS Steven Wilson, Police Scotland


I first met Steven Wilson – and his interest in cyber security education at last year’s CAS Scotland conference.  If you haven’t seen his talk, it’s well worth a look, and covers much of the ground he touched on today in more detail.

If you are interested, the talk by Mikko Hypponen he references is here:

Bobby Elliott, SQA

Bobby gave an overview of the new NPA Cyber Security being launched by the SQA shortly.  It will be the first qualification of its type in the EU, and is made up of three national units:

  • Data Security
  • Digital Forensics
  • Ethical Hacking

The qualification will be offered at SCQF levels 4,5 and 6.  The units are the same at each level and whilst some content can be differentiated by outcome, there are some performance criteria differences at different levels.  Overall my impression was that a multi-level class would still be straightforward.

Bobby has blogged about the event separately on the SQA Computing blog, and included his presentation slides which give a good overview of the new qualifications.

Scott Hunter

Scott gave an overview of a pilot project he set up at Kyle Academy in partnership with Police Scotland.  He started with the concept of developing an open badge for the award, then talked about the content of the award.

Scott is happy for other centres to use the badge and materials: his materials can be downloaded from here (Glow login required).

One of the big aims of the award is to make pupils more ‘hygienic’ about their cyber security and as a result disperse this knowledge to relatives, many of whom may be grandparents will little access to information about cyber threats.  The hope that Police Scotland have is that this will build up resilience from the ground up, spreading good practice within families and communities.

Another interesting aspect of Scott’s presentation was the fact that there is now a growing progression pathway for cyber security in schools.  He expects all S1 pupils to study the Cyber Security badge he has developed.  Those interested could progress to the (developing) National Unit in Cyber Security fundamentals (level 4) in S3, with senior phase pupils studying the new NPA.  Beyond school a growing number of options are available: Modern apprenticeships in Information Security; NC/HNC/HND Computing; BSc Ethical Hacking etc.

The issue of staff development was also discussed: Education Scotland are promising further development events in Cyber Security in the next term.  The general feeling was that, while delivering level 4 – and perhaps 5 – of the new NPA was well within the grasp of CS teachers, level 6 will involve a ‘step up’ in understanding for most of us.

Steven Wilson

Steven gave the room an overview of cybercrime in Scotland today, similar to the talk at last year’s CAS Conference.  His first point was to remind us that cybercrime has been identified as a tier 1 threat by the UK government to our national security, and that this status is placing an increasing focus on the threat, and a demand on Police to tackle the issues around it.

His talk went on to cover:

  • the differences between new crimes (eg DDOS) vs. old crimes enhanced by technology (fraud).
  • Small business vulneability to ransomware; this is a lucrative area for organised crime!  Imagine you are a small business with a ransomware-infected computer containing all your customer records.  Your backup regime is a bit dodgy due to lack of computer experience, and a criminal will lift the ransomware block for £500.  It’s an easy choice!
  • The growth of child explicit images and ‘sexting’ problems.
  • the Daniel Perry Case in Fife; this is a particularly shocking case that highlights the dangers to young (and older!) people from cyber-blackmail.  It was sobering to hear from one of the Police Officers who was heavily involved in investigating this, and disappointing that we can’t extradite the gang responsible to Scotland where (the crown office confirmed) they would have been charged with culpable homicide.
  • We need to prepare young people for these threats.  we need CS teachers to do this, they are fundamental to the whole process!  Police Scotland are keen to get this message across: whilst guidance teachers and other colleagues can cover issues such as cyber bullying, social issues and sexual exploitation, it is only CS teachers who can give students the technical background and computational thinking skills to really understand and protect themselves against cybercrime

Overall a very good morning indeed: Well done to Kirsty & Jim from ES, and Bobby, Steven and Scott for presenting!

Thoughts on Computing Science Teacher Numbers

Today’s TESS article can make for grim reading, (14% drop in teacher numbers in only 2 years) but before we all get too depressed about this, I think it’s important to remember some of the positives from the past 2 years or so:

  • We now have an established – and respected – body to represent the subject and the needs of teachers in CAS Scotland.
  • As I write this, I am about to join my CASS colleagues putting the finishing touches to our third national conference.  Never before have we had such a wealth of new ideas, resources and discussion available regularly to us.  It continues to impress me that so many teachers are willing to give up their Saturday – and often pay entry themselves – to attend the conference.  Our CS teachers care about our subject!
  • We have national courses that better match the skills required in jobs, FE and HE.  Sure, the N3/4/5/H courses aren’t perfect, but teachers now have much more flexibility to play to areas of strength and relevance to their students.
  • PLAN C.  Again, anyone who doubts the commitment of Computing Science teachers to improve the subject needs to show me another subject were around 40% of the cohort have signed up to a nationally-recognised programme that will deliver real change to the subject and the pedagogy behind our lessons.
  • Remember too that the Scottish Government funded PLAN C to the tune of £400,000; proof if you need it that they are serious about supporting the IT industry and training in Scotland.  The Skills Investment Plan reinforced this message earlier in the year.

So how do we go about arresting the sharp drop?  There’s no easy fix in truth.  The TESS article hinted at some of the issues, but didn’t explore them fully.

Computing Science and ICT skills are still being readily mixed (up) in schools; it never surprises me that we get lumped in with Business subjects, rather it reinforces the shallow grasp those designing the curriculum have on what the different subjects are actually about.  I wonder if I could ask to get some of English’s time – after all, I sometimes use pens and pencils too.

Solution: Not an easy one, but a few things are changing and people are getting things right.  Be consistent with the nomenclature.  We are Computing Science.  We are Computing Science teachers.  Build this up, starting with students, and take colleagues to task when they ask about your ICT lessons!  Use national campaigns and resources to your advantage to highlight the subject: Hour of code is coming up in a couple of weeks, for example.  HMI need to make sure all level 3 Es&Os are being delivered in a computing science context, as the document asks for.  CASS – and our members – must help to build more understanding of what these contexts are.

There is a wider ignorance of what our subject is about.  How many times have you sat in a parents evening, hearing “Wee Jimmy loves the subject – he’s on a computer all the time”.

Solution: We need a national publicity drive that will put the content of Computing Science squarely in the public eye.  Some materials are already there to help in schools:  (Leaflets are available from CASS).  Like above, keep pushing the principles to students.  No time in the BGE phase?  Take a deep breath, start a lunchtime/after school coding club, and wait for the parental pressure to come round on your side.  Resources and third parties such as CoderDojo and CodeClub can help with extra-curricular work.

ITE places are not being filled, and some Universities don’t even train Computing Science teachers.  Moray House, Aberdeen … it that you we can hear shifting uncomfortably at the back?  Computing Science graduates are naturally being head-hunted into jobs due to the competitiveness of the IT industry, meaning those universities that do train CS graduates are struggling to recruit suitable people.

Solution: This is clearly not something individuals, or CASS for that matter, can influence directly.  The Scottish Government need to make this issue a top priority over the next few years.  We need to see more teachers being trained in the East and North of the country.  We need to encourage more graduates into the profession – a hard task, but look what the Institute of Physics are doing south of the border. – is this a viable option?  Either way, Scottish Government, we need your ongoing support now more than ever.

Poor-quality Computing Courses in schools are cited in the TESS article.  Well, that’s something we can change, and obviously are changing given all the positive points I started with.  150 people giving up a Saturday in November proves that well.

Solution: It’s already in our hands.  more CASS activities, More PLAN C, using what we learn in the classrooms.  I really do think we have this one cracked if we can keep up the momentum.  Some people might not get carried along – lets not get hung up about it, most of the profession want to deliver the best Computing Science education we possibly can.  One last thought; we need to make sure Computing Science – and Computational Thinking – is being filtered down to primary level.  More work to do there!

So, that’s my £0.02 worth.  All up for debate though, it’s certainly an exciting time to be a Computing Science teacher.