Erik L Moore
email: emoore@regis.edu

Steven P Fulton
email: sfulton@regis.edu

Roberta A Mancuso
email: rmancuso@regis.edu

Tristen K Amador
email: tamador@regis.edu

Daniel M Likarish
email: dlikaris@regis.edu

Roberta A Man- Cuso

A Short-Cycle Framework Approach to Integrating Psychometric Feedback and Data Analytics to Rapid Cyber Defense

Keywords:

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

We also have witnessed the individual professional development of team members, for instance after hours cyber range practice, 7/24 threat awareness and analysis, regional and national group exercises. Since May of 2016, these exercises have also included psychometric analysts with expertise in personality trait preferences and role diversity to guide the cybersecurity teams toward better team interaction, leadership efficacy, and self-awareness for individual participants, which ultimately benefits the team. The observations and analysis outlined here have occurred at numerous events, providing feedback to leadership and to individual team members based on observed training and incident response behavior.

The leadership of the joint training had completed their initial roadmap of exercises, including technical, incident response practice, and relationships. They recognized the need to improve team performance using additional methods and began looking for a next set of methods to enhance response capabilities. A Regis-based member of the joint training leadership realized that behavioral psychology and health care faculty may be able to add significant value to enhancing cybersecurity team performance. The entire joint training leadership agreed and invited Regis faculty specializing in these fields to perform an initial unstructured observation and present initial ideas on what strategies they might use to enhance cybersecurity team performance.

The authors on the Regis social and health sciences faculty, Mancuso and Amador, were authorized by the joint training leadership to support the training as psychometric analysts. Their operations indicated two areas of opportunity for team enhancement, awareness of behavior types for the individuals and team interaction awareness to support leadership coaching. They recommended Myers Briggs Type Indicator (MBTI) psychometric tool for individuals. For leadership coaching support they recommended the Parker Team Player Survey (PTPS). These tools were selected because they have been extensively tested and utilized with a variety of populations, including those working in crisis management [START_REF] Sample | The MBTI as a Management and Organizational Development Tool[END_REF] and those working in technical positions [START_REF] Beyler | Assessment of Individual Differences in Preferences for Holistic-Analytic Strategies: Evaluation of Some Commonly Available Instruments[END_REF]. One of the authors, R. Mancuso, had significant experience in using the MBTI to determine team-based efficacy, including certification in the method, so the deployment of psychometric analysts could happen fairly rapidly based on that existing capacity.

During a cyber defense exercise in May 2017, Regis faculty performed psychometric analysis on surveys and observations to create the first coherent baseline data set that combined psychometric data with pre-existing performance measures for cyber defense operations. Thus, the digital behaviors recorded in network firewalls and first-person journaling of participants was interpreted in concert with general psychometric analysis of the training exercise. An actual cyber defense incident occurred in February 2018 where the psychometric evaluators were invited to observe in real time. The framework presented here is based on the baseline data from the May 2017 exercise and the February 2018 cyber defense incident.

2

The Cyber Defense Incident Response

Because of an existing relationship between Regis University and the Colorado National Guard, Defense Cyber Operations (CONG-DCO), select faculty were invited to observe the February 2018 cyber defense incident response activity. The CONG-DCO received a request from the Office of the Governor of the State of Colorado to provide urgent support to the Colorado Department of Transportation in the face of an active intelligent and persistent cyber threat. This was the first time that any National Guard unit within the US had been dispatched to support a state agency in cyber defense activities. This engagement provided the psychometric analysts opportunity to directly observe behavior while the team was under the stress of a real cyber defense incident and engaging in the larger interaction with the chain of command, collaborating teams, and the staff they were supporting. The value of this opportunity was immediately recognized by both the cyber defense experts and the psychometric analysts. Observations could provide leadership coaching multiple times during a live event in support of improving actual cyber defense capabilities. Since then, members of the cyber security training team and the psychometric analysts have collaborated on developing a new "Short-Cycle Framework." This framework is an integration of psychometric and other team performance indicators that provides along a single timeline to provide feedback to the cyber security team during training exercises and real incident response. When the CONG-DCO was deployed as part of a state response, they embed as a member of a multi-agency response team. These multi-agency response teams are made of individuals who are members of separate institutions with significantly different institutional practices and social norms. These include government IT Departments, National Guard soldiers, and corporate technical staff. Recognizing the personality types and behaviors rapidly may facilitate adaptation to more rapid convergence on threat identification, vulnerability mitigation, and recovery solutioning.

Several questions drove the authors' development work. "Can a Short-Cycle Framework of multiple psychometric and cyber defense indicators help cyber defense team leadership better recognize individual personality and team dynamics for coaching opportunities that can enhance team performance?" Follow-up questions of interest are, "Can psychometric indicators help team leadership move from intuitive to analytical response, overcoming the vulnerabilities of intuitive thinking often exploited by social engineering and psychologically designed attack strategies?" "Can psychometric-based intervention strategies shorten the delay between a single team member's awareness of an exploit, and the team's mitigation of that exploit?" In order to provide a context in which these questions could be effectively answered, the authors added a layer of preparation for both cyber defense training exercises and cyber defense incidents.

Event Preparation for Exercises and Cyber Defense Incident Response

In order for the psychometric analysis to be effectively framed during either a cyber defense training exercise or response incident, significant preparation is necessary. Up-front baseline assessments of each team member needs to be established using the Myers-Briggs Type Indicator and the Parker Team Player Survey and then a focused set of during-event assessments will continue during both cyber defense exercise opportunities and incident response. This established a set of traits against which the psychometric analysts could assess certain variable psychometric states along a combined timeline of cyber defense activities and events within the timeline that the CONG-DCO experienced, either in an exercise or during an incident. The state data is used in both training and incident response to generate short-cycle coaching for team members.

The authors have initiated a traditional pace of psychometric data feedback to cyber defense team leaders where data is analyzed between events. Currently, the sample size is small and the delay in feedback is the months between exercises. Following a March 2019 cyber exercise, we expect the increase in data gathering rate should improve data reliability. In addition, the Short-Cycle Framework is being applied to a broader range of cyber defense exercises including student competitions. Earlier work in the behavioral analysis of teams in cyber defense suggests that team dynamics is significant in relation to outcomes [START_REF] Hoffman | Exploring a National Cybersecurity Exercise for Universities[END_REF]. This impact of team interaction within cyber defense is similar to that observed in exercises like competitive challenge [START_REF] Buchler | Cyber Teaming and Role Specialization in a Cyber Security Defense Competition[END_REF].

The technology infrastructure necessary to facilitate a cyber defense training exercise with live active networks are broadly known [START_REF] Dodge | Organization and training of a cyber security team[END_REF]. Usually all parties involved in the exercise meet at a single facility using a specialized network that simulates the Internet, an adversary network, a network to be defended along with business systems that must sustain services under attack. This can be a competitive challenge between multiple teams or a single-team exercise. These simulate defensive operations like defending a hospital, public utility, or government agency that is under attack where the trainees are brought in to defend the institution and facilitate recovery to normal operations.

The preparation required for an actual cyber defense incident response does not include the same level of network infrastructure as a training exercise. Typically, the cyber defense response team brings in laptops, switches, flip charts, and other resources necessary to establish an incident response center and forensic base of operations embedded within the large, possibly compromised, operations network of the institution that is under attack.

4

A New Model Through Which to Understand Types of Data for both Exercises and Cyber Defense Incidents

The Myers-Briggs Type Indicator surveys were provided through a web interface by distributing a link to participants approximately six weeks prior to the May 8, 2017 training session. The analysts reviewed 7 completed MBTI surveys from team members before the May 8th training session. The Parker Team Player Survey was provided to participants on the day of the training session. The analysts reviewed 13 completed PTPS surveys. The team was provided by the Colorado National Guard and consisted of active cyber defenders selected by their leadership. The surveys of this team provided a baseline of self-awareness so that members would be more aware of their behavior. The Parker Team Player Survey has behavioral traits that set a baseline and adaptive behaviors that can be observed in real time. The psychometric analysts identified adaptive behavior options as deliverable feedback with coaching support scripts in near real time. This came to be known among the group as the Short-Cycle Framework for psychometric coaching feedback.

The types of data gathered by the authors to enable the Short-Cycle Framework fall into baseline data (MBTI and PTPS traits) , established before exercise scenarios and cyber defense incidents, and ongoing data (PTPS adaptive behaviors) that is gathered with different frequencies throughout the event. This all could then be plotted on the same timeline with traditional cybersecurity training metrics listed below and described in detail in later sections.

 state over time of the defended services. o Red Team Journaling -presents the active attack and often intentionality o "CEO" Injects -provides the timelines of directives issued by a mock CEO Psychometric state analysis like "Team Cohesion" during events makes ongoing relationship dynamics and causal events of behavior clearer. This is why data were aggregated into a single timeline. To meaningfully address this, the team is developing a set of scripted feedback messages for particular psychometric states that can be evaluated for efficacy as more event data are collected. More detailed explanations of data types, such as the author's use of Parker Team Player Survey components applied as states to the Short-Cycle Framework are provided in later sections. In Figure 1, the second line of data from the top, they are represented along a single timeline by a circled "F" to facilitate cross-reference as analysis occurs.

Cyber Defense Exercise Scenario

Cyber Defense Exercise scenarios are to provide realism and context for success in terms of business scenario, technical infrastructure, and the situation in which the intervention occurred. While scenarios can range from public utilities infrastructure like water dam controls, and electrical grids, it is best to create a scenario from recent cyber defense incidents in order to maintain relevance. An example presented here to provide context was used in the CONG-DCO training exercise in May 2018.

Scenario Description

A fictitious financial department is in the middle of migrating from local to regional corporate control. With uncontrolled growth and change in governance the department had significant loss of focus on its cybersecurity infrastructure. A major cyber exploitation has occurred with an advanced, persistent threat that is disrupting the department operations. The CONG-DCO are asked to provide defensive intervention against the cyber attack. Primary goals are to identify compromised systems and remove exploits and vulnerabilities. They are responsible for defending the computer system and supporting the internal audit team. Concurrently they must maintain internal and external business services. The department has significant cloud-based service offerings.

Exercise -CEO Injects

A key control factor was implementing a realistic cybersecurity exercise simulating the behavior of leaders. In the exercise these simulated as a set of directives injected into the scenario by a trainer playing the role of mock CEO of the fictitious organization to be defended in the simulation. In Figure 1, the mock CEO injects line at the top identifies specific injects by letter (A, B, C, etc.) that can be referenced when evaluating the impact of each inject across the combined timeline. The mock CEO injects range from requesting a status update or asking for a service to be restarted, to sometimes disruptive events like standing up alternate financial systems to sustain a business' ongoing needs mid-incident. Simulating the demand to service institutional needs instead of focusing solely on defending against the red team provides a more realistic simulation of actual cyber defense incident response situations. Another purpose the CEO fulfills is to accept requests from the cyber defense team training in the exercise. This simulates business process, governance, communications, and leadership interaction at the highest level.

6

Cyber Defense Exercise Data Gathered Prior to the CDOT Incident

Security Incident and Event Management Data

The advantage of a Security Incident and Event Management system (SIEM) for training teams and for the psychometric evaluations is that the logs may be analyzed in real time. A SIEM is a coordinated set of services that aggregate the ongoing digital logs of network and computer devices into a single database. An analytical engine provides alerts, automated responses, and visualizations that guide live security team members as they respond to threats. In a cyber defense exercise, the Red Team, a team acting as an in-scenario adversary, journals their attack exploits and that journal is confirmed by traffic analysis of the SIEM data. The trainees see the alerts from the SIEM and respond. In a live incident, the attack data presented in the SIEM would be perpetrated by a malicious actor potentially from anywhere in the world. See Figure 2 for how the types of data vary between a training scenario and a real cyber defense incident. Focusing on the particular data isolated in Figure 3 graphed are three example indicators of compromise: Dotted Line: ASA-6-302014 -A TCP connection between two hosts was deleted. Dashed Line: ASA-6-106100 -The ASA might generate message 106100, indicating that the packet was permitted; however, the packet is later correctly dropped because of no matching connection. Solid Line: ASA-6-302013 -A TCP connection slot between two hosts was created. Each of these IoC events has immediate potential impact for the cyber defense teams, and through comparison with other data, each cyber security team's ability to respond can be analyzed. While the timespan represented in the samples is very short, fullday event data would be collected to lay in comparison to the other forms of data like team journaling, psychometric analysis observations, etc. This information is graphed in the 4th line of Figure 1 in order to determine both impact of digital traffic events on team behavior, and the effects of control efforts by the cybersecurity team on digital traffic.

Using the Splunk tool to analyze the SIEM IoC data, a Colorado School of Mines (CSM) analyst interpreted the data from the Regis University Security exercise held on May 8th, 2017. The CSM analyst identified common penetration techniques utilized by the Red Team and common techniques used by the Blue teams to protect their payloads. In addition to running queries to generate statistics and identify patterns, the CSM team upon review also constructed the line graph visualizations using the Splunk capabilities to develop a more abstracted timeline. This would become the basis of a multifactor timeline presented below.

The CSM team was able to identify the actual firewall used in the exercise which led to the discovery of the syslog codes and opened up a new realm of analysis. They identified the top log codes from the 8-10am log and created several visualizations to show high-level appearance of the top logs relative to the rest as well as over time. They further analyzed data related to each of the fixed red team IP addresses and listed, described and commented on the top ASA codes. While not presented here, these data are important as an interpretation of red team activity.

Security Incident and Event Management Data

The Red Team is the attacking team in a cyber defense exercise to simulate what an attacker might be doing to trigger an actual incident response operation. Events on the Red Team Journal, Table 1, can indicate the intentionality of their activities in addition to specific attacks that can be recorded as a journal entry as they engage in training scenario attacks. This provides excellent capabilities to cross reference in the device logs, in the defensive team's behavior, and in relation to whether full recovered status of the network was achieved.

Table 1. Sample journaling performed during exercises by the "Red" cyber attack team playing the role of a malicious perpetrator.

Number of red team tasks per minute are plotted in Figure 1, line 6, in order to indicate their impact on both service levels and team behavior.

Services Availability -Scenario Scoring Engine Data

The scoring engine provides a real-time indicator to cyber defense exercise organizers and is analogous to availability dashboards present in network operations centers. If a service like a web server is up, it will indicate an up arrow in real time. If that service has been disrupted, its arrow will display as down. This is represented in Figure 1, line 5, to enable assessment of impact of red team activities, and the cybersecurity team's ability to respond fully to a service interruption. The timeline is designed so that it can become possible to analyze the duration of response times from IoC to service recovery in relation to team resilience. Figure 4 represents a sample scoring engine to illustrate how multiple teams can be tracked over time for various network system services. The scoring engine is a key tool in determining the effectiveness of cyber defense teams as they train against a particular scenario, in a competitive challenge, or in a technical walk-through. In this particular case, a single team consisting of 13 members was tracked over time and had access to this scoring engine to determine their performance as they worked to restore services.

Identifying and Infusing Personality Trait Preferences and Role Diversity in Cyber Security Teams

Our model utilizes both trait and state measures as central psychosocial factors in cyber security teams. The trait measures that comprise our initial psychometric evaluation will enable us to calculate a predicted effectiveness score for each team. Based on that score, we can develop scripts with prescribed feedback to enhance team performance.

Work in cybersecurity incident response human factors covers several related areas that each add value and provide context for the work presented and complementary value to the work presented here. For instance, Oltramari [START_REF] Oltramari | Towards a Human Factors Ontology for Cyber Security[END_REF] focuses on the risk associated with trusting individuals. This human factors work highlights the importance of expectations of behavior as they affect the team performance through cohesion of purpose. As Pfleeger and Caputo notes [START_REF] Pfleeger | Leveraging behavioral science to mitigate cyber security risk[END_REF], since 2010 there has been a significant effort to align the efforts of behavioral science and cybersecurity to encourage empirical studies to enhance the socio-technical systems that enable cybersecurity. The work presented in this paper follows along that thread, working to develop a systematic process that can generate measurable results in training and incident response events.

For the initial psychometric evaluation (before the cyber defense exercise or incident occurs) the psychometric evaluators identify personality trait preferences by administering the Myers-Briggs Type Indicator [START_REF] Myers | MBTI Manual: A Guide to the Development and Use of the Myers-Briggs Type Indicator, 3rd[END_REF] and role diversity utilizing the Parker Team Player Survey [START_REF] Parker | Team Player and Team Work: The New Competitive Business Strategy[END_REF]. Two additional trait assessments that we believe will be useful in predicting cyber security team performance are Adaptive Behavior [START_REF] Charbonnier-Voirin | Adaptive Performance: A New Scale to Measure Individual Performance in Organizations[END_REF] and the 14-item Resilience Scale [START_REF] Wagnild | Development and Psychometric Evaluation of the Resilience Scale[END_REF]. Measures of resilience will be used to develop scripts to support leadership in coaching and can also be used as the basis for future skill development. All of these measures have been shown to be largely stable over time as suggested in referenced material. The 14-item Resilience Scale is plotted in the graph in Figure 1 on the third line so that it may be cross-referenced to indicate if other events have affected team resilience.

We predict that teams with high trait preference diversity and high role diversity who self-report as being very adaptive and resilient may be more effective at cyber incident response. Using scores from the initial psychometric evaluation as a baseline, we can categorize teams into one of four quartiles by their predicted effectiveness score. Coaching injects in the form of direct, real-time feedback to team leaders can be tailored and scripted for each team in response to their predicted effectiveness score.

Personality state assessments will be used to provide real-time observer assessments of team performance. We propose to assess team cohesion and observed role diversity at three points during the cyber defense exercise in order to gauge the effect of the coaching injects. Team cohesion is measured using a modified Crew Cohesion Assessment Scale [START_REF]Crew Cohesion Assessment; Leadership Toolbox Reference[END_REF]. This is coupled with a modified PTPS that can assess observed role diversity. Both are completed by faculty observers following each coaching inject.

Below is a sample paragraph of the psychometric evaluators' assessment of cyber security team members' scores on the Parker Team Player Survey, our measure of role diversity. After uncovering Contributors, Collaborators and Communicators, an example finding was:  Evaluation 1: There were no Challengers in the team.  Evaluation 2: These results indicate that the group is predominantly task and goal oriented, but does not excel at process or at questioning that process.

These examples represent general statements within the context of instruments and frameworks like the Myers Briggs Type Indicator [START_REF] Myers | MBTI Manual: A Guide to the Development and Use of the Myers-Briggs Type Indicator, 3rd[END_REF] and the Parker Team Player Survey [START_REF] Parker | Team Player and Team Work: The New Competitive Business Strategy[END_REF]. These examples suggest scripts for coaching and are a demonstration of process functionality. Once process is confirmed as functionally able to generate actionable findings in this study, observations and indicators will later be tracked over multiple exercises and adjusted and new constructs may be identified. Over time we expect to identify and differentiate different individual and team characteristics that suggest higher levels of capability in cyber defense training and incident response.

Live Response Incident Log and After-Action Report

The Incident Response Log is a compilation of observations entered by incident responders while working through the incident. Specifically, it is a real-time journal of observations and record of actions taken. Often in a digital form it will include malicious file names, system configuration settings, and commands used. In relation to cyber defense exercises it is analogous to a team journal. Also, the journal documents when a service goes down and when it is restored from the perspective of the cyber defense team. The scoring engine provides an alternate means of confirmation. After action reports occur in both cyber defense exercises and incident response. They are based on journaling and include later analysis intended to determine how things could have been done better, how successful it was, what follow-up items might be valuable, etc. The after-action report is initiated immediately after the incident with a live debrief of all participating members. This is formalized into a document with follow up items. The report is used to inform next steps on defense, revision of cyber defense exercises scenarios, and research on open-ended questions to enhance the capabilities of the trainers and the incident response teams.

9

Strategy for Relating Data Cyber Defense Team Leads and the exercise designers use the new data from the Short-Cycle Framework to address two development challenges: 1) exercise designers need to increase the relevance of exercise to live incident response by comparing data across incident response and exercise and improve future cyber defense exercises and, 2) during a cyber defense incident or exercise, the team leads need to leverage the full set of new data to better coach their teams to enhance performance. The authors have spent several years analyzing data pulled from exercises. The technical sets of analysis such as firewall and red team journaling were used to compare exercises to incident response and enhancing performance from session to session. The authors recognized though that key indicators of performance were not being gathered in the earlier data sets. Team interaction such as conflict, collaboration, and motivation played a strong part in success, and yet was not being recorded. The following is a list of key functions and strategies that the psychometric analysts use to enrich the interpretation with both new data acquisition and analysis across exercise and incident response.

Psychometric Analysts  Provide observations, evaluations, and coaching  Leadership skills and team member participation feedback for individual team members  One-on-one discussion about personality traits and leadership guidance  Increase awareness of participant's interaction styles so they can function more effectively in both cyber exercises and incident response. The Short-Cycle Framework, integration of psychometric observations, SIEM network data, and journaling may be applied so that incident response exercises and live incident response are enhanced through the use of psychometric analysis and feedback to team leads. The authors intend to continue this research by developing a set of prescribed feedback or "scripts" based on the four psychometric evaluations through the quartile states. Then the team intends to evaluate the effectiveness of these types of feedback over time using the proposed method described here. Preparing scripts may allow leaders very early identification of the disruptive effects on team cohesion potentially caused by some social engineering or other types of psychological attack strategies. Because scripts may be delivered digitally and the psychometric analyst observations may not be interactive, video may allow psychometric teams to provide their services to cyber operations teams through networks. Some of the authors' previous experience suggests that direct feedback from the psychometric analysts to individual team participants may undermine leadership so we recommend using leadership channels to provide coaching. This approach supports the appropriate authority in behavioral adjustments within the broader context of their individual institutional relationships.

A prerequisite to this work needs to be acknowledged for those looking to produce similar processes. Transitive trust between the analytical/academic community and the cyber defense community must be pre-established. A consideration for future research is how to more rapidly build these types of trust relationships that can stand rapidly and at multiple scales.. Should we be successful in this line of research and development of framework structure, we are looking to achieve replicability of approach by baselining the team state and standardizing how scripts are used to provide feedback to team leaders. Over time, the team hopes to use frameworks like this to discover patterns of behavior that represent effective behavior types in relation to the various aspects of different scenarios. Developing a portfolio of scenarios, the team intends to test the predictive capacity of this type of framework in relation to effectiveness of cybersecurity incident response.

1 Introduction

 1 Beginning in 2013, Regis University has hosted joint training exercises of multiple Colorado state and local government cybersecurity teams, Colorado based public utilities and cybersecurity focused industry leaders. The University has hosted biannual large (over 100 participants from adjoining states) and smaller joint training exercises that the authors recognized the personal individual member, team cohesion and incident responses community growth and maturation leading up to recognition of a dynamic self-sustaining Collaborative Training and Response Community (CTRC).

Fig. 1 .

 1 Fig. 1. Short-Cycle Framework, a simulated set of metrics across cyber defense and team psychometric indicators set in parallel on a timeline to rapidly analyze cyber event causes in relation to ongoing psychometric measurement of the team.

Fig. 2 .

 2 Fig. 2. The exercise scenario and incident response data differ in that more external data can be reviewed independently regarding the threat actor and external services.

Figure 3

 3 Figure 3 indicates digital traffic events as they occur as reported by the SIEM based on known potential indicators of compromise (IoC) as published by the relevant SIEM manufacturers published standards and customized alerts. The vertical scale is each type of IoC events per minute.

Fig. 3 .

 3 Fig. 3. Illustrates the rough format in which data is presented from the SIEM.

Fig. 4 .

 4 Fig. 4. Service Availability Scoring Engine indicates whether a business service is up or down by simulating the user and checking for success.

o

  Increase the rapidity of Multi-Agency Incident Response Teams by enhancing team members' cohesion o Develop awareness of leadership using feedback that supports coaching o Enhance ability to work in groups o Increase self-awareness and awareness of others o Adapt to team members and situation and demonstrate resiliency leading to quicker response and better collaboration 10 Conclusion and Recommendations

Acknowledgements

The authors have presented the context in which the Short-Cycle Framework was developed in conjunction and collaboration with our Regis University interdisciplinary investigators (Computing and Information Sciences, Liberal Studies and Healthcare), state and local Colorado government entities and private industry partners.

The team thanks Riley Miller, a PhD student at Colorado School of Mines department of Computer Science for his independent analysis of the red team attack traffic that was detected in the main firewall during the cyber exercise referred to in this analysis. The cyber defense exercises at Regis University are sponsored by a series of grants from the Department of Defense of the United States of America. Thank you to Rick Cisneros, the project scientist of Regis University, College of Computing and Information Sciences, for his work gathering the network data as Red Team lead and providing exercise infrastructure. Thank you to Robert Moon for gathering the network data and being a red team member along with Nasser Esmail.


Alexander Tolstoy
email: aitolstoj@mephi.ru

Natalia Miloslavskaya
email: ngmiloslavskaya@mephi.ru

Andragogy as a Scientific Basis for Training Professionals in Information Security

Keywords: andragogy, pedagogy, adult learning, adult education, information security, training. 1

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

The "andragogy" term most often refers to a sufficiently large area of knowledge relevant to adult education. Its history can be divided into several phases [START_REF] Reischmann | History, Meaning, Context, Function[END_REF][START_REF] Kessels | The Routledge Companion to Human Resource Development[END_REF]:

Phase 1. The emergence of the "andragogy" term. The term as a part of pedagogy relating to adult education was first used in 1833 by A.Kappa, a German high school teacher. The Kappa's "Plato's educational ideas as pedagogy for individuals and as public education" [START_REF] Kapp | s Erziehungslehre, als Pädagogik für die Einzelnen und als Staatspädagogik[END_REF] includes a section entitled "Andragogy or education for men in adulthood" ("Die Androgogik uber Bildung im manlichen Alter"). On 60 pages, the author considers the problems of education, characterizes education in the context of the main values of human life and connects these problems with the training of physicians, soldiers, teachers, speakers, rulers and men as fathers of their families. Using the "andragogy" term, the author does not give its definition and does not talk on its authorship. It should be noted that in most of the subsequent works of his followers the priority of this term's usage is given to Kappa. However, he did not develop the theory of andragogy but justified the practical importance and necessity of education for adults. Over the following decades, the "andragogy" term was almost forgotten. This can be explained by the fact that studies conducted actively in this area in Europe and America had their own history and terminology. Therefore, the new term did not have widespread support. Phase 2. "Andragogy" was reborn. In 1920, adult education became the subject of active research in Germany. In one of the first published works [START_REF] Lindeman | The method of teaching adults[END_REF] andragogy was considered as a new direction in science without special justification [START_REF] Lindeman | The method of teaching adults[END_REF]. Most of the works were related to the study of practical problems of adult education. In most studies, andragogy was reduced to the method of teaching of adults, thereby significantly narrowing its subject and weakening its theoretical foundations. At this phase, the important results include not only the initial stage of disclosure of the "andragogy" concept but also the formation on an interdisciplinary basis of a community of researchers from academic and scientific institutions that have begun to work actively in this area.

Phase 3. Formation of andragogy as a separate science. Studies of andragogy in the 2 nd phase remained largely unnoticed until the 50s and 60s of the XXth century when in Europe and the US there was a new interest in the formation and development of andragogy as a scientific discipline related to adult education. These two directions of research can be explained by the fact that the accumulation of research results occurred in different conditions (social, economic, due to the end of the 2 nd World war, and even geographical) and was based on different needs in adult education. A comparison of these two approaches on a scientific basis can be found in Savicevic's work (1999) [START_REF] Savicevic | Understanding Andragogy in Europe and America[END_REF]. We will not consider in detail the differences of scientific schools of the US and Europe but will focus only on the results of research in andragogy, which can form the scientific basis of the development of training of professionals in information security (IS).

A leading scientific school was formed in the US under the leadership of M.Knowles, who called andragogy an art and science of helping adults in learning and a system of statements on adult learners, which should be applied differentially to different adults depending on the situation [START_REF] Knowles | The modern practice of adult education: Andragogy versus Pedagogy[END_REF]. The key element of Knowles's works is the justification of differences between pedagogy and andragogy [START_REF] Knowles | Andragogy in Action. Applying modern principles of adult education[END_REF] made on the basis of considering the main characteristics of an adult learner. Further, he formulated the basic principles of andragogy, identified the key factors to be taken into account in the development of programmes for adult education and considered the variety of factors motivating adults to learn. The main results, which were obtained by the Knowles's scientific school, are published in [START_REF] Knowles | The adult learner: The definitive classic in adult education and human resource development -7th edition[END_REF]. This monograph was reprinted 7 times (last time in 2011)!

In Europe, studies were on a broad front in Germany, Switzerland, the Netherlands, Yugoslavia, Hungary, Finland, Poland, and Russia [START_REF] Savicevic | Understanding Andragogy in Europe and America[END_REF]. Currently, scientific journals are published with the "andragogy" word in their titles. Departments of Andragogy are operating actively in various universities, which teach disciplines related to andragogy. The International Society for Comparative Adult Education (ISCAE) with a recognized leader J.Reischmann as its President unites the scientific community, which carries out research on adult education.

The results, which are useful for our study, can be highlighted as follows [START_REF] Reischmann | International Encyclopedia of Adult Education[END_REF][START_REF] Popović | andragogy and Administering Graduate Programs[END_REF].

1. The definition of andragogy was clarified. It refers to an art and science to help adults to learn, as well as to study the theory of education, the processes, and technologies associated with it. 2. The statement of the need for continuous adult education was justified.

3. The requirements for teachers to teach adults were defined. These teachers were called "andragogues" that emphasizes their differences from teachers. 4. The necessity of introducing the "Andragogy" discipline into the curricula of academic training of teachers is substantiated in the assumption that universities' graduates can participate professionally in adult education. The latter is implemented in dozens of universities around the world but not always under the above-mentioned name. It should be noted that the experience of teaching such a discipline accumulated at universities does not solve the problem of a universal andragogue [START_REF] Reischmann | Because "adult education" is not beneficial to the academic identity! In: Adult Education in an interconnected world[END_REF] as his possible follow-up practical activities, which are associated with adult learning, are significantly influenced by specifics of a professional field, to which the adult learner prepares.

This conclusion was the basis for research on the use of the recommendations of andragogy to improve modern systems of training of professionals in a particular professional field (IS). To do this, the characteristics of such systems will be determined, the classification of trainees according to the criteria of adulthood will be carried out, the possibilities of applying the basic provisions of andragogy to the object (educational system) and the subject (processes, methods, and technologies of training) of research in the selected area will be considered in the paper.

IS PROFESSIONAL TRAINING SYSTEMS

IS professional training systems in different countries have their peculiarities. The following is common among them:

 Professional training is conducted within the systems of higher (academic) (1 st stage) and postgraduate additional professional (2 nd stage) education;  The system of higher education usually has two levels: Bachelors and Masters;  The system of postgraduate additional professional education (APE) is based on the short-term professional refresher courses (RC) for obtaining additional professional competencies and retraining (RT) programmes for developing trainees' competencies related to a new type of their professional activity.

It should be noted that the same features are typical for other professional areas. However, the peculiarity of the IS field is due to the fact that it is constantly changing. This fact leads to the need to correct the content of educational programmes almost every two years that results in the following. It is necessary to adapt constantly the higher education programmes that contradicts the principle of their stability within each curriculum. It increases the APE role, for which it is necessary to develop new educational programmes permanently. If an IS professional wants to meet modern requirements, he must improve constantly his skills through self-education and APE, following the principle of continuous professional learning (learning throughout the whole professional life).

Differences between countries in their IS professional training systems relate to the presence of separate trajectories of academic education and duration of training for individual educational programmes. For example, in the UK [START_REF] Furnell | A National Certification Programme for Academic Degrees in Cyber Security[END_REF] it involves the development of the trajectory of academic education, which includes the implementation of the following programmes (Fig. 1 In the Russian Federation [START_REF] Budzko | Forming the Abilities of Designing Information Security Maintenance Systems in the Implementation of Educational Programmes in Information Security[END_REF], the trajectory of academic Bachelor's and Master's training is also implemented, as well as in-depth engineering education on the basis of so-called Specialitet (S), and additional professional training in the form of RC and RT programmes is traditionally developed (Fig. 1). The implementation of Specialitet programmes forms a separate learning path. In this case, the duration Tb of training of Bachelors (B) is 4 years with laboriousness of 480 credits; for Masters (M) Tm is 2 years with laboriousness of 240 credits, for Specialists (S) Ts it lies in the range of 5-6 years (Ts=Tse-To) with laboriousness of 600-720 credits. The duration of various RC programmes Trc is from 16 to 250 academic hours (Trc=Trce-Trco) and of RT programmes Trt -from 250 to 1000 hours (Trt=Trte-Trto).

It should be noted that regardless of the countries the start of training on Bachelor's and Specialist's degree programmes (To) often coincides with the time of graduation from secondary schools (possibly after a period of practical activity). The Master's degree programmes can be implemented immediately after the Bachelor's degree programmes (Tbe=Tmo) or at some interval related to professional activities (not always in the field of IS). The RC programmes should be held at least every two years (the interval between the end of academic education should not exceed two years). The RT programmes should be associated with a change in the type of professional activity within the field of IS (for example, from operational to organizational and management, or from operational to teaching).

ADULT LEARNERS: WHO ARE THEY?

Consideration of the features of IS professional training systems taking into account the time scale tied to the trainee's age shows that the minimum age of applicants for the Bachelor's and Specialist's degree programmes is 17-18 years, for Master's -20-22 years and for RC and RT -22-24 years correspondently. If we take into account the fact that in Russia, for example, a young man 18-years old has the right to participate in elections, form a family and be called up for military service, where he will be entrusted with weapons and may die defending his homeland, trainees in any IS professional training programmes can be considered the adult trainees.

To accept only trainees' age as a basis for defining the adulthood, without taking into account their psycho-physiological properties, is not sufficient. For example, one can also consider the basic life tasks that can be set only by an adult. On this basis, Knowles divided the adults into three groups: 18-30, 30-65 and 65+ years [START_REF] Knowles | The modern practice of adult education: Andragogy versus Pedagogy[END_REF]. Adults in each group have their own attitude to their profession, career, family, home, development of personality, use of free time, health, public life, etc. Knowles considered an adult a person "who behaves like an adult, i.e. plays adult roles (employee, spouse, parent, responsible citizen, soldier) -the sociological definition" and "whose selfconsciousness is the self-consciousness of an adult -the psychological definition". A person is an adult to the extent that he perceives himself responsible for his life [START_REF] Knowles | The modern practice of adult education: Andragogy versus Pedagogy[END_REF].

Thus, an adult refers to a person who performs socially significant productive roles (citizen, employee, family member), has physiological, psychological, social, moral maturity, relative economic independence, life experience and a level of selfawareness sufficient for responsible self-governing behavior.

Based on the idea of an adult, we should rely on these characteristics in his training and expect that he will treat the educational process consciously and responsibly. In addition, since an adult is usually engaged in a specific activity, his need for training will be related to some extent to his main professional activity, as well as the performance of other social roles. So he will pursue specific, practical and real goals. It is also obvious that if usually in conditions of well-established life the adult with wellestablished social roles decides to study, then he has a strong enough interest (i.e. high motivation) to this. It is determined by the urgent need for training to solve an important life problem. At the same time, he seeks to apply immediately his knowledge, skills, personal qualities and value orientations acquired in the educational process to solve the above problem as soon as possible. In learning activities, an adult learner relies inevitably on his life experience (everyday, professional, social), which often serves as an important source of learning for both himself and his colleagues.

Considering all of the above, we can define an adult learner as a person with five fundamental characteristics that distinguish him from the non-adult learners [START_REF] Zmeev | Andragogy: Fundamentals of Theory, History and Technology of Adult Education[END_REF]. He is aware of himself as an increasingly independent, self-governing person. He is gaining more and more life experience (everyday, professional, social), which becomes an important source of training for himself and his colleagues. His readiness to learn (motivation) is determined by his desire to solve his vital problems and achieve specific goals with the help of educational activities. He strives for the immediate implementation of the acquired knowledge, skills, personal qualities, and value orientations. His educational activity is largely due to temporary, spatial, professional, household and social factors (conditions). In this case, if the adult approaches his training consciously, he primarily evaluates his real possibilities and abilities.

Summarizing numerous studies on the definition of human age periods, it can be argued [START_REF] Zmeev | Andragogy: Fundamentals of Theory, History and Technology of Adult Education[END_REF] that physiologists, psychologists, sociologists, philosophers and researchers of educational problems have found that a person throughout his life goes through three clearly defined stages with their distinct features. The first stage called "immaturity" is divided conditionally into childhood, adolescence, and youth. According to various expert estimates, it lasts on average up to 20 years. The second stage called "adulthood" lasts from 20 to about 65 years. It is divided into the periods of early adulthood (up to about 35 years), maturity (up to about 50 years) and late adulthood. Finally, after 65 years a period of elderly ("golden" or "third") age comes.

If we apply the description of human adulthood to the modern education system, the following conclusions will be obvious:

1. In the implementation of the Bachelor's and Specialist's degree programmes, the trainee becomes an adult (early adulthood). This process needs help that should correct the trainees' activities. 2. It is necessary to treat training in the Master's degree programmes and APE programmes as adult education (the period of mature and late adulthood).

Educational programmes of the appropriate level and their implementation

should reflect the characteristics of adult learners.

PEDAGOGY OR ANDRAGOGY?

The principal features of the andragogical approach to the educational process can be identified by comparing the pedagogical and andragogical learning models [START_REF] Knowles | The Adult Learner: A Neglected Species[END_REF]. The main differences between these models are presented in Table 1. The table shows that andragogy can be considered as a separate science of adult education, justifying the activities of adult learners and teachers in organizing the educational process.

Like any science, andragogy has its objects (adult educational processes) and subject (patterns of activity of adult learners and teachers while organizing and implementing the educational process) of consideration, as well as its structure, concepts, and terminology. Theoretical statements of andragogy as a science can be formulated and presented in the form of an andragogical learning model (Table 1).

In the previous section, we came to the conclusion that IS professional training must be approached as to the implementation of adult educational processes. Further, we consider the possibility of applying the andragogical model directly to our case.

ANDRAGOGICAL APPROACH TO THE PREPARATION OF TRAINING IN THE FIELS OF IS

Preparation of training for any programme (including the field of IS) involves the following steps:

1. Definition of goals, objectives and expected learning outcomes. 2. Development of curriculum and syllabus for its components (disciplines, modules). 3. The choice of technologies for the educational process implementation. 4. Determining the curriculum for the training implementation. 5. Formation of the trainees. 6. Formation of the teaching staff.

Let us apply these steps to IS professional training using the adragogical model. In this case, the experience gained in the Russian Federation in the creation and implementation of the system for IS professionals training in general and at the National Research Nuclear University MEPhI (Moscow Engineering Physics Institute) in particular will be taken into account.

Definition of goals, objectives and expected learning outcomes

The learning objectives, the tasks to be addressed to achieve these goals and the expected learning outcomes will be different for different educational programmes in IS.

For the Bachelor's and Specialist's degree programmes in the first years of training (basic training), a pedagogical model is applicable. The second half of training (teaching professional disciplines, Internship) includes the transition to the andragogical model in terms of the formation of trainees' awareness of increasing self-government, the acquisition of modern learning experience and practice of solving problems related to either IS ensuring basic issues (for Bachelors), or practical (engineering) issues (for Specialists).

The andragogical model is fully applicable to the Master's degree programmes and APE programmes. It is assumed that the trainee has a certain level of self-awareness in relation to readiness for training (including on the basis of practical problem solving), understanding of the role of self-management in training, a positive learning experience, and he is ready to apply immediately in practice the knowledge gained.

When defining the goals, objectives and expected learning outcomes, it is also necessary to take into account the qualification requirements formed by the professional community, for example, in the form of a model [START_REF]Model. A Best Practice Model and Framework[END_REF] or professional standards [START_REF]Professianal standards in the field of information security[END_REF].

Thus, the purpose of training will be the formation of certain professional competencies in terms of the development of the learner's understanding that he is an adult (Bachelors and Specialists), or in terms of the implementation of educational processes that take into account the fact that the learners are adults (Masters and APE).

It can be recommended to formulate the goals, objectives and expected learning outcomes for a specific programme in IS in the form of a trainee's model, which should also reflect the characteristics of those entering the training.

Development of curriculum and syllabus for its components

A specific curriculum in IS should contain a list of disciplines with an indication of their volume (laboriousness in credits or in academic hours), forms of control of knowledge and place in the schedule of classes (in the curriculum).

The curriculum of any programme contains the following modules (cycles): Basic (General), General professional, Professional, Internship, and Control (current, final).

In accordance with the andragogical model (Table 1), one of the principles of adult education is the joint learner-trainee activity, related to the planning of the educational process, the definition of learning needs and the formulation of learning objectives. This means that the curriculum of a specific educational programme should include all the appropriate forms of individual training:  Blocks of several elective disciplines. The trainee has the right to choose one of them; after that it becomes mandatory for him. His teacher should help him in choosing such disciplines. Our experience shows that the total laboriousness of these disciplines can reach half of the laboriousness of the Professional module. For example, if the curriculum includes a unit related to ensuring IS of automated systems (ASs), then it can include such disciplines as "IS of Automated Banking Systems", "IS of Automated Control Systems for Technological Processes", "IS of Decision-making AS", etc. This choice can also be ensured by the availability of elective disciplines in both Professional and Basic modules;  Internship module. The Internship topic is chosen by the trainee and his teacher jointly. Its implementation is controlled by the teacher. For example, the Internship topic may be related to a certain type of professional activity (production, organizational and management, information and analytical, research, teaching);  Trainee's independent work, the content of which is consistent with his teacher. Its volume (laboriousness) is included in the volume of a particular discipline (up to 50 % of its volume) and in the volume of a particular Internship;  Implementation and protection of a final qualifying work (FQW) with the topic selected by the trainee with his teacher. It is reasonable to involve in the supervision of FQW implementation not only the leading teachers of an educational institution but also the leading employees of the organizationspotential consumers of the graduates trained under the specific programme. The volume of FQW's implementation and protection is defined by the type of training programme.

Syllabus of disciplines from the curriculum are formed on the basis of determining their content (sections, topics), forms of training (contact or classroom work, independent work, monitoring of learning outcomes), the information base (mandatory and additional) and the forms and content of intermediate and final control of knowledge. In the discipline's syllabus, the requirements for the initial educational level of the trainee (for example, the level of knowledge and skills) should be defined and the levels of professional competencies, which should be formed during the discipline's mastering, should be formulated. This information should be consistent with the goals, objectives and expected learning outcomes generated during the phase of training preparation (for example, in the trainee's model).

Disciplines' syllabus of the Professional module in IS should have a practical orientation. Therefore, the acquired professional competencies should include a set of abilities (practical skills) that can be applied not only after graduation from the programme but also in the FQW's implementation. This can be done if the discipline's programme includes laboratory work, practical (case) training, homework followed by public protection of the results of their implementation [START_REF] Budzko | Forming the Abilities of Designing Information Security Maintenance Systems in the Implementation of Educational Programmes in Information Security[END_REF].

Taking into account the peculiarities of adult education, it is possible to allow the development of individual curriculum and disciplines' syllabus, which correspond to the peculiarities of the andragogical model (Table 1).

The choice of technologies for the educational process implementation

When choosing a technology for the implementation of the educational process, it is necessary to take into account not only the features of adult learning but also modern trends in the development of IT and IS areas. The IT development in general and, especially, the formation of information resources on the Internet have made a signifi-cant change in educational technology. The use of distance learning technologies (DLT) becomes relevant. The IS professional training is characterized by regular changes in the content of training, the presence of case training and the importance of teacher-trainees contacts. This imposes certain restrictions on the breadth of DLT usage. For example, in the Russian educational standards, there are restrictions on the volume of disciplines that can be implemented using DLT (not more than 25 % of the volume of the Professional module), as well as a complete ban on distance learning. The formation (implementation of Bachelor's and Specialist's degree programmes in IS) and the presence of a trainee's certain level of awareness of increasing selfgovernment and readiness for training (implementation of Master's degree programmes and APE programmes in IS) justifies the high role of the trainee's independent work (discussed in section 5.2) with the support of his teacher in the education process. This form of training allows to implement such element of the anragogical model as of how to apply the technology of searching new knowledge (Table 1). Public protection of the results of independent work in the framework of practical training allows to form a mechanism for joint assessment of the effectiveness of the training programme that also corresponds to the andragogical model.

Determining the syllabus for the training implementation

When forming the curriculum for implementation of any training programme in IS, it is necessary to consider the following: features of the curriculum; the contact educational forms used (lectures, practical classes -seminars, and laboratory works); teachers' individual consultations; the content of the syllabus of individual disciplines (modules); presence in the curriculum of such forms as independent work and Internship; and the possibility of DLT usage.You should also consider the fact that trainees in senior courses in Bachelor's and Specialist's degree programmes as well as studying in Master's degree programmes very often combine training and work as interns or employees. At the same time, it is necessary to strive to ensure that the place and content of such work correspond to the specifics of the implemented programme. As a rule, RC programmes are implemented in isolation from practical activities. Therefore, their curriculum is formed within the framework of intensive training in the time interval of 6-8 academic hours per day, 5-6 days per week.

The implementation of RT programmes can be associated with either full or partial separation from practical activities and the use of mixed (part-time) technology. Therefore, it is necessary to design the duration of this training up to 6 months.

Formation of the trainees

The trainee decides to study under the Master's degree programme or APE programme in IS guided by the task to improve his skills to a level that is in demand in this labor market. Thus, he shows his readiness for training, which is determined by the tasks of its development. This is fully consistent with the andragogical model.

The trainee decides to study under the Bachelor's or Specialist's degree programme taking into account the peculiarities of his physiological development and under the influence of the social environment. It can include, for example, the pressure of parents' opinion and the prevailing opinion that exists in his information environment, which determines the prospects for the acquisition of professional competencies in IS. Therefore, these trainees can be attributed either to the late stage of immaturity (youth) or to the early stage of adulthood. Training in these programmes should be aimed not only at the formation of certain professional competencies but also to transform him into an adult learner in the view of the andragogical model. The consequence of this may appear in the trainee's opinion that he choose the wrong field of study. The experience gained by the authors in the MEPhI shows that the proportion of trainees who have interrupted their studies can reach several tens of percent.

The solution lies in the introduction of a special system of vocational guidance for the selection of young people on the basis of the formation of a culture of IS (inclusion of disciplines related to the IS basics in the school curriculum), the organization of Olympiads in IS, as well as the introduction of methods of psychophysical testing.

It is very important to connect to this system organizations interested in getting trained professionals of a certain level and specialization. The ideal is the formation of a contingent of trainees within the target order of a particular organization, which can participate in the formation of the goal, objectives and expected learning outcomes, as well as in the development of curricula and harmonization of disciplines' syllabus. It can be useful to send trainees to Internship to these organizations -the future place of work of graduates, as well as the inclusion of representatives of these organizations in the Commission for public protection of the results of their FQWs.

Formation of the teaching staff

The above analysis of the stages of preparation of training programmes in IS has shown that the teacher must have certain specific professional competencies in the field of training programmes in IS. Our studies have shown the lack of information on the existence of current operational systems of teacher training for the implementation of General professional and Professional modules in IS. Most often we are talking about the selection of such teachers. Based on our experience, which is not very different from the experience of other educational centers, we can identify the following main factors that are taken into account in the selection of teachers:

 Practical experience in the field of designing or usage of IS maintenance systems;  Experience in carrying out research taking into account the specifics of an individual training programme;  Teaching experience in the framework of similar educational programmes.

Here, the requirements for andragogues can be present only in relation to the teaching experience, and not to the presence of basic education in andragogy (even in relation to the RC in this field).

CONCLUSION

The analysis of the andragogical learning model conducted in conjunction with the consideration of the main stages of preparation for training programmes of academic and additional education in IS allows us to formulate the following conclusions:

1. An important reason for the need to move from the pedagogical to the andragogical model is the presence of factors that determine the attitude to trainees as adults. In this case, the role of the educator (teacher) also changes dramatically. 2. The level of applicability of the andragogical model will be different for different educational programmes. 3. The andragogical model is fully applicable to Master's degree programmes and APE programmes. 4. The andragogical model can be applied for the educational process of Bachelor's and Specialist's degree programmes in the senior courses.

Further research can be aimed at the development of andragogical models of trainees in various training programmes for IS professionals and appropriate models of teachers.

The development of the system of teacher-andragogue training is urgent. Fundamental is the availability of the professional competencies not only in IS relevant to the implementation of specific programmes but professional competencies in andragogy. Training of such teachers is possible in three directions. Firstly, in the framework of the curriculum of the Master's degree programme, which aims to form trainees' professional competencies for two areas of professional activity, for example, organizational and managerial (or project or operational) and teaching. Secondly, conducting RC for teachers with experience in the implementation of specific IS professional training programmes with the inclusion in the curriculum of the RC programme of disciplines on various aspects of andragogy. Thirdly, the implementation of RT programmes for IS specialists (possibly in IT too) with the inclusion in their curricula of a module related to andragogy. In all these cases, it is necessary to develop appropriate training programmes and corresponding methodological support.

The quality of teacher-andragogue training can be controlled if the evaluation system of teachers similar to the system of IS professional certification will be established. The appropriate programmes should be developed to do this.

The features of the results obtained in this research should also be noted. Foremost, they have a novelty in terms of the integrity of the chosen model, based on the andragogical approach. Separate elements of the andragogical model without its designation were used earlier in practical educational activities in the field of IS. However, we are not aware of publications in which the features of the use of the scientific foundations of andragogy in this field were considered. Secondly, the results obtained are systematic in terms of applicability to various educational programmes in the field of IS. Thirdly, the results obtained are universal. They can be applied with a certain correction for the training of professionals in other areas for which the essential fea-tures are the need for continuing education and the high dynamics of the development of the subject area (for example, information technology).



  ): For the Bachelor's degree (B), the duration Tb of training on which is 3 years. On the timeline on Fig. 1, it corresponds to the time difference (Tb=Tbe-To). Its volume called laboriousness is 360 credits,  For the integrated Master's degree (M), the duration Tm of training on which is 4 years (Tm=Tme-To) with laboriousness of 480 credits,  For the Master's degree (M), the duration Tm of training on which is 1 year with laboriousness of 180 credits.

Fig. 1 .

 1 Fig. 1. Structure of the IS professional training system

Table 1 .

 1 A comparison of the pedagogical and andragogical learning models

	Characteristic	Pedagogical model	Andragogical model
	Trainee's self-awareness	Feeling of dependence	Awareness of increasing self-government
	Trainee's experience	Low value	Rich source of learning
	Trainee's readiness to training	Determined by physio-	Determined by the tasks of personal de-
		logical development and	velopment and mastering social roles
		social compulsion
	Application of acquired	Deferred	Immediate
	knowledge
	Orientation in training	On the subject	To solve the problem
	The psychological climate of	Formal, teacher's author-	Informal, based on mutual respect and
	learning	ity-oriented, competitive	collaboration
	The educational process's	By the teacher	Together with the trainees
	planning
	Identification of training needs	By the teacher	Together with the trainees
	Formulation of learning objec-	By the teacher	Together with the trainees
	tives
	The educational process's	The logic of the subject,	Depending on the trainee's readiness to
	construction	meaningful units	learn, problem units
	Educational activity	Technology of	Technology of searching new knowledge
		knowledge transfer	on the basis of experience
	Assessment	By the teacher	Joint identification of new training needs
			and evaluation of training programmes

Acknowledgement. This work was supported by the MEPhI Academic Excellence Project (agreement with the Ministry of Education and Science of the Russian Federation of August 27, 2013, project no. 02.a03.21.0005).