Development of information technology and the globalization require constant investment in people. New and emerging technologies such as autonomous systems, machine learning and AI radically re-contextualize the human dimension of the organization. Strategic changes have revealed new critical vulnerabilities such as social media-based election meddling and disinformation campaigning with impact on the human aspects at state, societal, organizational and individual levels. Education and training raise the level of expertise, skills and competences and ensure better performance in complex cyber situations. Researchers have addressed assumptions, models, concepts and cognitive aspects of human performance in the cyber domain. However, the theories and approaches of human learning in training and exercises are only partly touched. New techniques for enhancing organizational cyber resilience to cyber-attacks are needed and they still lack sound theoretical foundations. This article aims to advance the discussion suggesting viewpoints on training and exercises in the cyber domain, taking into consideration specifics of skills in cyber security. It provides overview of theories of learning to better support human performance. Our critical interpretation enhances the comprehensive understanding of decision-making, learning theories, and design of cyber security training and exercises. Furthermore, our intention is to constructively promote discussion on current issues about human learning in cyber training and education and thus boost multidisciplinary studies to enhance cyber awareness.

Since 2012, the European Security and Defence College is actively engaged in pre-deployment training for CSDP missions and operations. Although the main effort still relies on residential courses, the preparatory and supporting eLearning part receives more and more attention. eLearning is independent of time and location; hence, a perfect tool to training newly selected staff before their deployment to a mission area. Additionally, the running costs are lower compared to a residential course. The main challenges include the content of the eLearning modules, the nomination of trainees as well as the co-ordination between Headquarters and Mission responsibilities. Financial implications of training and the time constraints play also an important role as well as the in-mission training. Additionally, the various legal states of the deployed personnel (contracted, seconded, locals), the different personal security clearances and the learning content (no classified information in eLearning modules, sensitive information accepted) raise concerns when it comes to eLearning. The presentation will give an insight, how the ESDC provides eLearning modules for pre-deployment training taking EUNAVFOR SOMALIA as an example. The article will also tackle the challenges concerning selection/recruitment, nomination for training and in-mission training. It will give an overview about the state of affairs and the way ahead. The presentation will give an insight, how the ESDC provides eLearning modules for pre-deployment training taking EUNAVFOR SOMALIA as an example. The article will also tackle the challenges concerning selection/recruitment, nomination for training and in-mission training. It will give an overview about the state of affairs and the way ahead.

As the scale and complexity of the cyber threat landscape is rapidly evolving, with increasing number of cyber attacks on all types of organisations, the pressure on the cybersecurity resilience of organizations is also gaining importance. In order to prepare organizations to counter advanced cyber attacks, specific training and realistic exercise procedures and supporting simulation environments are required. These simulation environments should be able to support and adequately prepare organisations to counter advanced cyber threats. Currently there is a wide variety of e-environments for cyber exercises. They vary from e-learning platforms offering static content, to virtualization based environments, to computer simulations and serious gaming and proprietary systems offered by software and consulting companies. Simulation based exercises are an excellent tool to transfer outcomes defined in the training curriculum in to the practice. Virtual-based simulation can be defined as an imitation of reality by using virtual environments or virtual programs on the computer. The range of different virtual methods varies from a basic video to an immersive, three-dimensional virtual environment. In this article we analyze existing e-learning platforms for cybersecurity training and education, and propose an integrated, multidisciplinary approach to cybersecurity training and exercising, allowing different levels of IT personnel in the organisation to understand how they shall cooperate to be prepared to defend the organisation. We are arguing that a common methodological and pedagogical framework to cybersecurity training can and should be utilized both by the educational institutions providing cybersecurity education, and by the organizations specializing on cyber drills. This framework will support technologically advanced simulation environments with a holistic model of professional competence, which integrates knowing, understanding, doing and situation management into learning outcomes as one component, and with a knowledge transfer methodology that focuses on finding and implementing the best methods to stimulate people to think and/or act differently in the cyber domain. The proposed framework will take inputs from existing works such as ENISA’s “Good practice guide on training methodologies”, ECSO’s position paper on “Gaps in European Cyber Education and Professional Training” and other relevant works, and will apply learning by developing pedagogical model in the context of cybersecurity simulation environments.