Cyber Security which to take? (Provisional or Full Certified?)

The GCHQ thing is meaningless. I had the worst teaching experience I've ever had on a GCHQ provisionally certified module. The material were outdated, incorrect and on one occasion, missing lol!

GCHQ are endorsing courses and handing out scholarships as there are far too few Cyber Security professionals in the UK at the moment. This means more work for GCHQ in the longterm. For example, if Tesco Bank had more well trained Cyber Security engineers they might not have gotten hacked. That is less work for GCHQ. GCHQ endorsing a masters is simply them saying "we checked it out, they aren't teaching you anything unethical or reckless". It might impress some employers though in fairness.

In terms of the quality of the course, the GCHQ accreditation doesn't mean much. Think of it like a MOT. It might pass, but it doesn't mean its a good car. It doesn't mean its a bad car either.

Of the places you mentioned, Royal Holloway has the best research I've read. Warwick is a a fairly new course and overall has a good rep.

Really though, the GCHQ thing doesn't mean anything about the quality of the course or the quality of the modules.

The GCHQ thing is meaningless. I had the worst teaching experience I've ever had on a GCHQ provisionally certified module. The material were outdated, incorrect and on one occasion, missing lol!

GCHQ are endorsing courses and handing out scholarships as there are far too few Cyber Security professionals in the UK at the moment. This means more work for GCHQ in the longterm. For example, if Tesco Bank had more well trained Cyber Security engineers they might not have gotten hacked. That is less work for GCHQ. GCHQ endorsing a masters is simply them saying "we checked it out, they aren't teaching you anything unethical or reckless". It might impress some employers though in fairness.

In terms of the quality of the course, the GCHQ accreditation doesn't mean much. Think of it like a MOT. It might pass, but it doesn't mean its a good car. It doesn't mean its a bad car either.

Of the places you mentioned, Royal Holloway has the best research I've read. Warwick is a a fairly new course and overall has a good rep.

Really though, the GCHQ thing doesn't mean anything about the quality of the course or the quality of the modules.

Really? Bloody hell, i thought GCHQ accreditation meant cream of the crop. Is it really that desperate out there? Just how much are they screaming out for Cyber Security grads?

Big time. Like most companies will bite your arm off if you have any sort of security know how at the minute. GCHQ accreditation might better at fully accredited unis, but here is an example of a GCHQ approved module I took in Software Security:

1) Lecturer said they were a researcher and didn't want to teach
2) They didn't understand C programming very well and made mistakes often during class. We had to correct the teacher on these when they came up.
3) Lecturer gave us incomplete notes on Software Testing (as in there were headers for the notes but literally blank pages under the headers!!).
4) The lecturer could not work Valgrind so we had to look up online how to do it.

It was farcical. If that's the standard the GCHQ aspire too, the UK is doomed.

In fairness, a few of the other modules were excellent. Each module is individually accredited so far as I know. So yeah, don't read too much in to the GCHQ think because it seems like the standards they require aren't too high.

You are not going to go far in the cyber security field if you rely on things you was only taught at university, being in the infosec field you have to learn everyday for the rest of your life (new type of attacks get introduced regularly)

you complain about you had to look things up online lol welcome to cyber security , you complain about your lecturer making mistakes with coding , errmm even if you had 20 years experience writing in C you will still be making mistakes yourself !

You say you was taught outdated stuff , no you wasnt , you was taught the basics , even if he taught you up to date stuff , by the time next year it will be considered outdated anyways (this is how fast this industry moves) then you would still need to learn things by yourself after (online)

The Whole GCHQ accreditation , if you get onto a course then take it , employers will see that as a advantage , its not a necessity though , a OSCP certificate + a normal (not gchq) course is worth more than just a gchq accredited course

The course was at Qub. I presume you've done it too? You certainly seem to think you are qualified to talk about it.

Btw I was a mature student with 11 years in the tech sector when I did this course. This includes 4 years as a pen Tester (CREST certified). In my professional opinion, the masters at QUB was sub-standard. This is based on comparison with my undergrad studies, my other masters degree, professional experience and industry standard certification. The GCHQ accreditation is no mark of quality for a course.

I did my course at the NSA when i was only 7months old , i then transferred to GCHQ directly when i was 2 years old because they needed someone to find some 0days on a nokia brick phone , i am now 6years old and a exploit developer

All jokes aside , why would you go to uni when you have 4years as a penetration tester lol , i would of went on offensive security and bought some courses which is a much better ROI

There are cyber security individuals out there who never learned at a university , but they are still better than you at pentesting ..... why? Because he put the time and effort into learning himself rather than being spoonfed

Look, if you are going to resort to ad hominen attacks and aren't interested in having a discussion about this then there is no point in continuing. Happy to discuss this if you or anyone else is actually interested in having a grown up conversation about it.

My reason for doing it was there are other other areas of Cyber Security (like Cryptography theory and Computer forensics) that I wanted to educate myself on. The MSc provided a single course to do this. In hindsight it wasn't the best course. In my experience the GCHQ accreditation doesn't mean much. Thats my opinion. It was the opinion of much of the class according to the class rep. I can't sit here and tell you it was a well taught course overall (some aspects were good) when it wasn't in my opinion. This year the course directors have resorted to offering 6 fully paid scholarships to the course as the applications are way down (you can view this on linkedin btw), due likely in part to bad word of mouth from ex students (Belfast being a small place with only 2 uni's).

What modules did you study? On a side note, you are not the only one who has studied at a Uni with a below par cyber security course.

The GCHQ thing is meaningless. I had the worst teaching experience I've ever had on a GCHQ provisionally certified module. The material were outdated, incorrect and on one occasion, missing lol!
...
GCHQ endorsing a masters is simply them saying "we checked it out, they aren't teaching you anything unethical or reckless".
...
Really though, the GCHQ thing doesn't mean anything about the quality of the course or the quality of the modules.

Really? Bloody hell, i thought GCHQ accreditation meant cream of the crop. Is it really that desperate out there? Just how much are they screaming out for Cyber Security grads?

Each module is individually accredited so far as I know. So yeah, don't read too much in to the GCHQ think because it seems like the standards they require aren't too high.

Sorry for chipping into a slightly older thread, but as the owner of the GCHQ certification scheme (soon to be renamed the NCSC Certification scheme to better reflect our business), we thought we'd reply to some of the points made above.


@jestersnow - you’re right that we need more well-trained cyber security engineers, and high-quality education. GCHQ/NCSC can’t do it all, and the more that companies can do to protect themselves, the better. However, some of the comments you made about the certification scheme aren’t quite accurate.

We don’t hand out scholarships (that’s the CyberFirst scheme if anybody is interested), and our assessments do more than just a basic check of the course. Our process assesses the subject coverage of the course, the standard of the staff and facilities, and the quality of exams, marking and dissertations. The assessments are carried out by independent experts from across industry, government and academia, and the universities have to reach a high standard for their applications to be successful.

The modules aren't individually assessed; the overall degree is considered, but the universities have to specify the content of the modules, and show how they address our standards and the skills framework.

Despite the above, we appreciate there is still the possibility that a university might still deliver a sub-standard course once they have certification, although experience has shown us that this rarely happens.


@jestersnow - we're sorry if you had a bad experience on a certified course, but we’d encourage anybody in these cases to complain to the university, who will have a process for such things. If students still feel they are not being taken seriously, we are willing to listen, but our sole concern is the quality of the course and its teaching – we can’t get involved in legitimate university processes.

In general, student feedback from our certified courses is excellent (and forms part of an application for Full certification), but if a pattern emerges of students suggesting the course is not up to standard, we will investigate.

We hope this helps, and are happy to answer any questions that readers might have, either via PM or on a forum thread.

Very interesting. Thanks. What is the process for moving from provisional to full accreditation for a university?

To move from Provisional to Full Certification, an eligible degree programme must have been running in both the previous and current academic year, and the external examiner's report for the last academic year must be available. Provisional certification is typically valid for around 2 years, or until the first cohort of students have completed the degree.

The university in question needs to submit an incremental application, which in addition to describing any changes to the content, structure etc, since their previous application, should include the following:

It's also possible for a university to apply directly for Full certification, if a course has been running for some time.

Full certification is typically valid for 5 years, after which a university will need to re-apply.

If anybody would like to read the in-depth details, copies of our call documents and standards are available for download.

Great! Just for anyone else reading this in the future... Why would you recommend a NCSC accredited course over say something like CISSP certification?

What areas of cyber security are the NCSC calling out for? What's in demand? e.g Pen Testing, Reverse Engineering of Malware etc.

What areas of cyber security are the NCSC calling out for? What's in demand? e.g Pen Testing, Reverse Engineering of Malware etc.

<snip> It's ok to have a grasp of the concepts of network security but if GCHQ and other agencies, either private or government, would say where they are short of skills, i would fully focus my time on one area, instead of scattered knowledge right across the cyber security arena. I feel like I'm bobbing in an ocean and need to be anchored.