Competency based Education (CBE) for IT Security: Towards Bridging the Gap

—Skills gap is a common problem between university products and industry needs. This is apparent in many, if not all of the areas. The gap plays a role in the productivity or development of a given industry, as well as the unemployed rates. In a competitive world, employers are always looking for the best candidates for employment, with the best being defined as being competent both technically and professionally. We contend that competency based curriculum can provide a means to narrow and even close the skills gap. In this paper, we present a Competency Based Curriculum Model that can be used as a guide to develop a competency based curriculum. This model will be employed to develop a competency based curriculum for IT Security Engineers.


I. INTRODUCTION
In the world where knowledge economy (K-economy) is the current buzzword, being knowledgeable is certainly a common criteria required by employees.Unfortunately, there are gaps in the graduates produced by higher education institutions and the industry needs, as opined in the colloquium entitled "Closing the Education-Industry Gap: The Way Forward" [1].
This gap also plays a role in the unemployed rate.Lim [2] stated that IT graduates a facing lesser marketability power now compared to the early 1990s, due to some extent, to the mismatch of skills acquired and required by the job market.Following the job matching theory, a mismatch between skills possessed by a graduate and the required skills by employers have important consequences towards the success of getting a job, productivity, even wages [3].In the highly competitive job market today, employers will choose the most suitable candidates with both technical and professional competencies to avoid the hassle of expensive training cost later [4].
Competency Based Education (CBE) may provide the necessary tool to close the gap between graduate acquired and industry required skills.Competency Based Education is a functional approach to education that stresses upon obtaining and mastery of knowledge and skills [5].

II. UNDERSTANDING COPETENCY
A better understanding of competency is needed before any further discussions on competency-based education and competency based curriculum can be continued.Competency has many different definitions, according to the different people and the different domains of study.Ref. [6] stated that while there is a consideration that the meaning of competency is universally understood, any effort to find a universal definition of competence will inevitably fail.Kouwenhoven [7] explained the difference between 'competency' and 'competence', Competency is the capability to choose and use (apply) an integrated combination of knowledge, skills and attitudes with the intention to realize a task in a certain context, while personal characteristics such as motivation, self-confidence, and willpower are part of that context.

Competence is the capacity to accomplish 'up to standard' the key occupational tasks that characterize a profession. A competent professional shows a satisfactory (or superior) performance.
Competency is defined by many as an accumulation of knowledge, skills, and attitude [8][9][10]; though some may use a different set of wordings.Some of the different definitions by others are shown in Table 1.
Figure 1 illustrates the meaning behind knowledge, skill and attitude.

TABLE I. COMPETENCY DEFINITION
Any aspect of competence, such as knowledge, skill, attitude, ability, or learning objective [11] Core competencies identify the skills, knowledge, and attitudes that competent employees should demonstrate in a particular job classification [12] Competencies describe a comprehensive profile of the knowledge, skills and professional behaviors that can be expected for a particular professional group.[13] Figure 1.A deeper look into competency definition PREPARATION OF PAPERS FOR THE INTERNATIONAL JOURNAL OF ENGINEERING PEDAGOGY (IJEP) Competency within a profession encompasses two main divisions, which are domain specific competencies and generic (or life skills) competencies [14], [15].Domain specific competencies are those knowledge, skills and attitudes related to a specific profession.Generic competencies are competencies accepted for use in all areas and domains.These competencies are skills that one requires to perform well in their profession and may be transferred when one changes domain and/or profession [14].
Competency in industry is used for performance evaluation as well as to help identify skills gap among employees [16] [17].In education, competency can be used to design content and also as a gauge of teaching learning effectiveness.Competency can empower and enrich the teaching and learning process.This in turn will result in a more competent that will be a positive addition to the industry and profession.

III. COMPETENCY BASED CURRICULUM
Competency Based Education focuses on the outcomes of learning.It deals with what the students are expected to do, defining educational goals as a set of terms of knowledge, skills and attitude that can be measured [5].Competency Based Education is adaptive to the continuously changing requirements of the industry, university and students [18] and it also stresses on skills education and evaluation of its mastery [19].
Under CBE, competency based curriculum is the answer towards a more industry and technology relevant academic programs in institutes of higher learning.Courses within competency based curriculum may be adapted at a much simpler rate as it is based upon the competency (both technical and professional) required by the industry.Through the use of a skill standard (such as a competency model) as an essential tool in designing the curriculum, a more common platform is constructed in promoting effective collaborations and communications between institute of higher learning (IHL) and the industry.Figure 2 depicts how this collaboration may take place.
Such collaborations are more crucial to domains such as Information and Communication Technology (ICT) where technology development is rapid.

IV. DEVELOPING A COMPETENCY BASED CURRICULUM
In developing a competency based curriculum, we propose the following model (Fig. 3).This model provides a step by step guide in producing a competency based curriculum for IT Security Engineers.
The important initial step is to identify the competencies within the domain or profession.In the case of IT Security Engineers, the competencies required must be identified.If a competency model exists, then it can be a base (with perhaps some amendments where needed) to continue to the next step.In the case of IT Security Engineers, a complete competency model, especially from the Malaysian perspective is still unavailable currently.
Accordingly, the competencies required within this domain must be identified.From the competencies collected, construct a competency model.A competency model is a collection of competencies needed to successfully perform a specific role in a job or profession.
The next step is to construct a competency framework of chosen competencies (both technical and generic) for the intended curriculum.The competency framework will align competency and the level of competency required.It must be noted that not all the competencies within a competency model of a profession need to be addressed within an education curriculum.There are competencies, either whole competencies or a certain level of a given competency, which will only be achieved after a few years of working experience.
The curriculum competency framework is then used to identify the competency distribution throughout the intended program (undergraduate or postgraduate).Consequently, learning objectives and outcomes are identified and these objectives are mapped to courses and year of study.Accordingly, any training needed for the faculty can be addressed.The completed program, together with the courses and competencies addressed can be shared with the Industry Panel.The panel can review and provide recommendation for curriculum enhancement.The teaching materials and evaluation methods that will support the learning objectives and student performance of the competencies can be identified and created.

V. DISCUSSION
The skills gap between the university graduates and the industry needs is a grave issue that needs to be addressed swiftly.A competency based education is a functional approach towards defining educational objectives in terms of knowledge, skills and attitude that can be measured.We contend that competency based curriculum can create a better, more successful platform to narrow and consequently overcome the skills gap within the computer security domain.Accordingly, we suggest the Competency Based Curriculum Model, which will be followed to produce a competency based curriculum for IT Security Engineers.A study on the common body of knowledge for IT Security is currently ongoing to determine the elements iJEP -Volume 2, Issue 4, October 2012 of competencies, as well as the level required for an academic course.A competency model for this domain with a Malaysian perspective will be generated.The competency model will accordingly be used to develop a competency based curriculum.