2021: ACTIVITY REPORT OF THE CYBER SECURITY COALITION

High-performance security is becoming increasingly important in the digital world. "We see that cyber attacks are getting bigger every year, and smarter too. A fairly recent trend, for example, are the attacks on supply chains, which can hit the operations of several companies at once", says Bart Preneel, Professor of information security and industrial cryptography at KU Leuven.

Shortage of people and resources

To cope with the expanding threat, the focus on cyber security needs to be further increased. "Today, an average of 7.7 percent of the IT budget within a company or organisation is spent on cyber security. This should actually be at least double", Preneel continues. In addition to the budget, awareness must also improve. "Too many companies and organisations live with conviction that it won't happen to them. That has to change. Luckily, things are certainly moving in the right direction."

This attitude illustrates how the cyber security challenge is underestimated. "It has the image of being important only for nerds. While in reality it is something very practical and socially relevant. One of the consequences is there are far too few people active in this segment of the labour market today. Look at the government: they are doing an excellent job, but they have very limited resources. Compared to Germany, we have 10 times fewer people in this area", says Preneel.

A new master's programme as of 2022

Education has a key role to influence and change this perception. “In fact, we should strive for every IT education to have a cyber security component”, says Preneel. In Flanders, the expertise is concentrated first and foremost at KU Leuven. Moreover, there is a Bachelor's Programme for Cyber Security Professionals at Howest. "That is a conscious choice. Unlike in Wallonia and Brussels, where the knowledge is more spread out over different institutions", explains Preneel. "Through our existing elective courses, KU Leuven students can acquire extensive knowledge and later take this with them as they enter the labour market.”

And in light of the growing challenges, the University of Leuven is taking an important step as of next academic year. Students with a relevant prior education will be able to apply for the new advanced master in cyber security. To follow this one-year programme, you will need to have obtained a master's degree or have sufficient experience in the industry.

“This advanced master focuses on academic skills, but at the same time we have tried to also pay attention to practical aspects. The industry will be involved wherever possible", states Preneel. This connection with industry is anything but new for KU Leuven. "Many professors in this academic field have earned their stripes in the industry in the past. This very close relationship is also deliberately maintained with all start-ups working around cyber security that emerged from the university."

Through this brand-new course, KU Leuven hopes to offer a solution to the acute shortage of professionals within the field of cyber security. "Today, we deliver about 30 cyber security profiles a year to the labour market. We hope to be able to add 50 more over a fairly short period of time. We are convinced this will make a significant difference", concludes an ambitious Preneel.   

Disruptive technologies have put organisations and their systems under pressure in recent years. Machines processing enormous amounts of data are all too often poorly or insufficiently secured. "The security of OT systems is an underestimated problem. The software on which they run is commonly outdated, and rarely updated. Hence, if a company becomes the victim of a cyber attack, the impact is immediate and often incalculable," says Bart Steukers.

Moreover, only one in four manufacturing companies is said to have a proper contingency plan covering both IT and OT systems. "This is why we need to create more awareness about cyber security, because every link in a production environment is vulnerable. One solution is training staff intensively to recognise threats. If everyone realises what can happen, then the biggest risk - the human factor - can be largely eliminated."

More than 3,700 vacancies for IT professionals

In too many smaller organisations, there is insufficient awareness of cyber risks. Yet they are at least as vulnerable to criminals as the larger corporations. "The existing NIS Directive is not applicable to many companies. Moreover, the regulation is quite technical and open to interpretation. Tailor-made cyber insurance for SMEs, with a number of clear conditions, could be a good alternative and a driver for change."

At the same time, Agoria’s CEO argues that every company should sharpen its employees' digital competences. "Today, every job involves a digital component, so training courses should pay more attention to those competences. On top of that, we need more IT and cyber professionals. The new courses that several colleges and universities have set up are promising. Thanks to cooperation with our sector, they are also very practice-oriented. We hope this will lead to a situation where talent multiplies."

We need to catch up in cyber security, yet currently there are 3,700 vacant positions. "Even then, we are only talking about the professionals," notes Bart. "We really need to make an effort to teach all employees the right skills. If that does not happen, no fewer than 47,000 jobs could be at risk. If we create enough awareness and provide companies with the right tools, I am convinced that we can save those jobs."

The added value of the Cyber Security Coalition

Building the right skills is what the future will be about. And the Cyber Security Coalition can play a role in that. "The Coalition is the largest network of security experts in Belgium. We bring together academics and professionals to learn from each other, and become even better at cyber security. If we can increase our collective knowledge, develop the right tools in cooperation with businesses, and inspire talent, then I am hopeful for the future," concludes Bart Steukers.