Suné Von Solms
email: svonsolms@uj.ac.za

Annlizé Marnewick

Identifying Security Requirements Body of Knowledge for the security systems engineer

Keywords: Engineering education, Security, Security requirements engineering, Industry 4.0, Systems engineering

The interconnected nature of Industry 4.0-driven operations and systems is introducing the use of new digitized and connected industrial systems. These new connected environments impact system security, requiring engineers to include elicitation of security requirements as functional requirements. Academia and industry argue that systems engineers are not adequately prepared for the securityrelated activities required in the specification of secure systems. This paper utilizes a cybersecurity framework to create the body of knowledge related to Security Requirements Engineering for a module in systems engineering. The determined body of knowledge show Risk Management, Laws and Regulations, and Human Factors related to security must be considered in the changing technological landscape. Although not all systems engineers must have expert knowledge in this field, all systems engineers must have fundamental knowledge in security practice and the ability to apply systems thinking.

Introduction

In traditional systems design, security considerations of a system were limited to the integration of security added after the completed system was developed [START_REF] Dove | INCOSE System Security Engineering Working Group Charter[END_REF][START_REF] Shreyas | Software Engineering for Security: Towards Architecting Secure Software[END_REF][START_REF] Haridas | Software Engineering -Security as a Process in the SDLC[END_REF], treating security features as of secondary importance. The Industrial Internet of Things (IIoT) defines the use of new digitized and highly connected systems [START_REF] Kiel | What do we know about "Industry 4.0" so far?[END_REF], which require these systems to be designed, developed and managed by engineers while considering the impact and effects of cyberattacks on these systems throughout the whole system [START_REF] Waslo | Industry 4.0 and cybersecurity Managing risk in an age of connected production[END_REF]. In reaction to these required changes in design, the systems engineering community identified security roles and responsibilities applicable to the entire systems development life cycle for future connected environments [START_REF] Nejib | Systems Security Engineering: What Every System Engineer Needs to Know[END_REF], namely the secure systems development life cycle (S-SDLC) [START_REF] Waslo | Industry 4.0 and cybersecurity Managing risk in an age of connected production[END_REF]. Various sources argue that all engineering disciplines must understand and practice security through all phases of the system lifecycle to meet the project's requirements and manage an acceptable level of risk [START_REF] Nejib | Systems Security Engineering Whose Job Is It Anyway[END_REF][START_REF] Tamura | Packard Enterprise Leads Transformation of Cyber Defense with "Build it In" and "Stop it Now[END_REF].

In systems engineering, a holistic cybersecurity view is required by Systems Engineers (SEs) to design secure systems as the S-SDLC requires the execution of various specialized security tasks, such as security requirements planning which requires the evaluation of functional systems requirements relating to security and translation into technical solutions [START_REF] Von Solms | Towards Educational Guidelines for the Security Systems Engineer[END_REF]. Globally, engineering industries are observing that SEs are not adequately prepared to execute many of these tasks, including the incorporation of system security requirements into the system [START_REF] Von Solms | Towards Educational Guidelines for the Security Systems Engineer[END_REF][START_REF] Bayuk | Systems security engineering: A research roadmap[END_REF]. Therefore, industries require SEs with holistic cybersecurity knowledge and Security Requirements Engineers (SREs) who can conduct the security requirements process, minimizing the risk during systems development lifecycle [START_REF] Nejib | Systems Security Engineering Whose Job Is It Anyway[END_REF].

In the South African (SA) engineering space, there exists a high demand in cybersecurity engineering professionals. However, throughout academic institutions in SA there are no known comprehensive cybersecurity engineering courses offered, based on their undergraduate and postgraduate syllabus descriptions [START_REF] Tamura | Packard Enterprise Leads Transformation of Cyber Defense with "Build it In" and "Stop it Now[END_REF]. In systems engineering, the lack of cybersecurity content or modules in SA engineering education and the need for cybersecurity professionals point toward a gap in cybersecurity knowledge amongst engineers in industry. The need for such a skill requires the addition of security requirements engineering to the education in systems engineering curricula [START_REF] Parrish | Global perspectives on cybersecurity education for 2030: a case for a metadiscipline[END_REF]. The aim of this paper is to design a cybersecurity module for systems engineering students focusing on security requirements engineering.

2

The need for security requirements engineering education

Engineering industries globally are observing that SEs are not adequately prepared to incorporate system security requirements into the system [START_REF] Bayuk | Systems security engineering: A research roadmap[END_REF], which constitutes the need for an additional SE who possesses the knowledge, skills and competencies related to security requirements [START_REF] Von Solms | Towards Educational Guidelines for the Security Systems Engineer[END_REF]. This includes the consideration of security requirements as an integral part of system requirements to reduce systems weakness [START_REF] Nejib | Systems Security Engineering Whose Job Is It Anyway[END_REF], treating security requirements as functional requirements and not just non-functional requirements or of secondary importance [START_REF] Bayuk | Systems Security Engineering[END_REF][START_REF] Batcheller | Building on the Success of Building Security In[END_REF]. However, not all system engineers can be trained to become security experts. Therefore, academia should develop security experts as a path in system engineering, including the SRE [START_REF] Oren | What Does a Systems Security Engineer Do and Why Do Systems Engineers Care? INSIGHT[END_REF].

In the paper entitled "Global Perspectives on Cybersecurity Education for 2030: A Case for a Meta-discipline", the authors argue that cybersecurity must be integrated into existing academic disciplines, not simply be developed as separate degree programs [START_REF] Parrish | Global perspectives on cybersecurity education for 2030: a case for a metadiscipline[END_REF]. As with a module educating SEs to have a holistic view of cybersecurity, a module must exist in which a SE responsible for requirements engineering must be educated on the security factors influencing requirement engineering. To ensure the development of relevant content for such modules, this research investigates internal and external factors of the cybersecurity and systems engineering fields which can influence and impact the content of a cybersecurity curriculum.

Methodology

A preliminary investigation into a basic body of knowledge of a SE cybersecurity module was presented in [START_REF] Von Solms | Identifying the Cybersecurity Body of Knowledge for a Postgraduate Module in Systems Engineering[END_REF] which provided a baseline for this research. This paper builds on the work done in [START_REF] Von Solms | Identifying the Cybersecurity Body of Knowledge for a Postgraduate Module in Systems Engineering[END_REF] where a broader spectrum literature was considered to inform a module in SE. The framework described by [START_REF] Knapp | Maintaining a Cybersecurity Curriculum: Professional Certifications as Valuable Guidance[END_REF] was developed to ensure that cybersecurity certifications remain relevant in industry, by identifying factors which professional bodies recognize as important to a relevant certification. These relevant factors are then used to inform a current curriculum to remain relevant to industry requirements.

This framework was adapted to analyze professional certifications to help shape a new cybersecurity module related to SE. The module was validated against the Curriculum Guidelines for Post-Secondary Degree Programs in Cybersecurity (CSEC2017) guidelines. The adapted framework followed is illustrated in Figure 1 below. The results of the various steps are discussed in the subsequent sections.

Review of Input Factors

To analyze the significant factors that professional certifying bodies consider most important relating to cybersecurity in systems requirement engineering, literature was reviewed to determine specific skills, knowledge and activities relating to security in requirements engineering. The five input factors, shown in Fig. 1, is considered. This is not an exhaustive list and other factors can be considered but is considered comprehensive to provide relevant information for module development [START_REF] Knapp | Maintaining a Cybersecurity Curriculum: Professional Certifications as Valuable Guidance[END_REF].

Threat landscape

The changing technological landscape constantly gives rise to new threats and risks, like protection of information and information systems and communications and network security [START_REF] Squires | Building a competency taxonomy to guide experience acceleration of lead program systems engineers[END_REF]. As cybersecurity threats are constantly evolving, it is essential to consider literature discussing any new threats relating to engineering systems and how they should be managed. Traditionally, security requirements were considered as nonfunctional requirements [START_REF] Von Solms | Towards Educational Guidelines for the Security Systems Engineer[END_REF][START_REF] Bayuk | Systems Security Engineering[END_REF][START_REF] Batcheller | Building on the Success of Building Security In[END_REF]. Other instances include where security requirements are developed independently from the rest of the requirements engineering activity and hence not integrated into the requirements engineering activities [START_REF] Von Solms | Towards Educational Guidelines for the Security Systems Engineer[END_REF]. Generally, this leads to serious design challenges and wide-ranging security vulnerabilities. New requirements must be considered by SEs as part of each system to create innovative solutions to address the new risks. Researchers argue that many security problems can be eliminated through the integration of security with requirements engineering [START_REF] Waslo | Industry 4.0 and cybersecurity Managing risk in an age of connected production[END_REF][START_REF] Kissel | Security Considerations in the System Development Life Cycle[END_REF][START_REF] Salini | Survey and analysis on Security Requirements Engineering[END_REF]. By conducting security requirements in the early stages of the development process with the system requirements specifications, security threats can be avoided very early in the systems development process as security is adequately planned, acquired, built in, and deployed as an integral part of the system [START_REF] Waslo | Industry 4.0 and cybersecurity Managing risk in an age of connected production[END_REF][START_REF] Kissel | Security Considerations in the System Development Life Cycle[END_REF][START_REF] Salini | Survey and analysis on Security Requirements Engineering[END_REF]. NIST Special Publication 800-64 -Security Considerations in the System Development Life Cycle [START_REF] Kissel | Security Considerations in the System Development Life Cycle[END_REF] comments on the enforcement of security requirements throughout the phases of the life cycle. Nejib and Beyer (2016) comment on the importance of systems engineers towards contributing to secure systems [START_REF] Nejib | Systems Security Engineering Whose Job Is It Anyway[END_REF]. They considered current and evolving policies, guidance, and standards (ISO 15288:2015) regarding security activities in the S-SDLC and provide a framework which identifies the security-related activities applicable to systems engineers. The 5 SE processes related to requirements engineering was identified as important processes which an SRE should implement.

The identified 5 processes will be used as inputs to the cybersecurity module. The output of this investigation yielded the following [START_REF] Nejib | Systems Security Engineering Whose Job Is It Anyway[END_REF]:

• Elicit Stakeholder Requirements

Workforce needs

Von Solms and Marnewick (2018) identified that within the S-SDLC, specialized security-related requirement actions relevant to the 5 processes identified in Section 4.1 requires the skills of a System Requirements Plannera position generally filled by a SE [START_REF] Von Solms | Towards Educational Guidelines for the Security Systems Engineer[END_REF]. To identify the tasks, skills, knowledge and abilities required by the SE to perform these tasks, the 81 tasks, skills, knowledge and abilities documented in NIST 800-181 relating to this position were investigated. The factors relevant to the requirements engineering process (5 processes identified in section 4.1) were determined. The output of the analysis is shown in Table 1 below where the NIST code in provided with a shortened description. These 22 identified factors will be used as inputs to the cybersecurity module.

Changing technology

Changing technological landscapes, including Industry 4.0 requirements, bring changes to the cybersecurity landscape. The security areas will differ for each new system, so the SRE must be able to elicit the security requirements upfront, impacting the system in development. Salini et al [START_REF] Salini | Survey and analysis on Security Requirements Engineering[END_REF] states that every SRE must have the knowledge related to various types of security requirements and factors which influence requirements. Elicitation of requirements includes considering various non-technical aspects, which includes standards and best practices [START_REF] Von Solms | Towards Educational Guidelines for the Security Systems Engineer[END_REF], laws and regulations, as well as knowledge relating to human factors, which can be considered expert knowledge to be used as input to security requirements engineering and threat analysis.

The Cyber Security Body of Knowledge (CyBOK) is one framework developed to provide guidance on the foundational and generally recognized knowledge on cybersecurity [START_REF] Rashid | Scoping the Cyber Security Body of Knowledge[END_REF]. To identify the cybersecurity body of knowledge which applies to the SRE, the 19 top-level knowledge areas (KAs) documented in the CyBOK were evaluated. The category "Human, Organizational, and Regulatory Aspects" were considered relevant to the SRE as humans, organizations and regulations must be considered when requirements are defined. The output of the analysis is shown in Table 2 below where a unique code in provided with a shortened description. These 3 identified factors will be used as inputs to the cybersecurity module.

Table 2. Cybersecurity knowledge requirements from CyBOK [23]

Code

Table 2 reference code

CyBOK1

Risk Management and Governance: Security management systems and organizational security controls, including standards, best practices, and approaches to risk assessment and mitigation.

CyBOK2

Laws and Regulation: International and national statutory and regulatory requirements, compliance obligations, and security ethics, including data protection and developing doctrines on cyber warfare.

CyBOK3

Human Factors: Usable security, social and behavioural factors impacting security, security culture and awareness as well as the impact of security controls on user behaviours.

Industry standards

Industry standard and best practices are considered an important input toward curriculum relevance. Various industry standards and guidelines relating to cybersecurity, including ISO and NIST security frameworks, provides authoritative guidelines, frameworks and procedures to be adopted by industry [START_REF] Knapp | Maintaining a Cybersecurity Curriculum: Professional Certifications as Valuable Guidance[END_REF][START_REF] Backhouse | Circuits of Power in Creating de jure Standards: Shaping an International Information Systems Security Standard[END_REF]. Upon the investigation of the eCompetence framework, it was seen that security aspects are only defined in the "Build" function much later in the S-SDLC. This implies that security forms part of the design, but no more detail is provided. Considering security requirements in the eCompetence framework, it was only included in the "Run" phase of the SDLC, implying that security only forms part of the reaction and maintenance processes of a system and not the requirements [START_REF]European committe for standardization[END_REF]. A second investigation into the NIST 800-160 [START_REF] Ross | Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems[END_REF] framework as well as the INCOSE Systems Engineering Handbook [START_REF] Walden | INCOSE Systems Engineering Handbook: A Guide for System Life Cycle Processes and Activities[END_REF] was conducted. These frameworks describe the use of the technical Systems Engineering and Software processes set out in ISO/IEC/IEEE 15288:2015. Nejib et al (2016) mapped the Security Systems Engineering processes described in the NIST 800-160 framework technical processes of ISO/IEC/IEEE 15288:2015, resulting in 27 Security Systems Engineering processes [START_REF] Nejib | Systems Security Engineering Whose Job Is It Anyway[END_REF]. From these processes, five were related to the Security Requirements phase of the S-SDLC. These five processes were identified in Section 4.1, which already formed part of the input factors to the curriculum.

Government and Regulation

Following the evaluation done on the key input factor of Changing Technology, is was determined that law and regulations must be viewed as stakeholders in the requirements process. When a system is designed, the requirements of these laws and regulation must be integrated into the requirements of the system itself. Kotonya and Sommerville (1998) commented on the inputs and outputs of the requirements engineering process and stated that two inputs include Organizational Standards and Regulations [START_REF]European committe for standardization[END_REF]. In the same manner, all regulations and standards related to cybersecurity must be included in the Security Requirement Specification process. As stated in Section 4.3, knowledge relating to cybersecurity laws and regulations can be considered specialized knowledge and must be considered as an input factor the curriculum design.

Module Development

The input factors identified in Section 4 is now utilized to design a cybersecurity module for systems engineering students focusing on security requirements engineering. The cybersecurity knowledge, tools and skills identified in Section 4 require various levels of understanding by the SRE, ranging from a holistic view regarding systems security to specialized knowledge relating cybersecurity laws and regulations to elicit relevant requirements.

Kossiakoff et al. ( 2011) derived a range of educational components relating to systems engineering development, based on quality work experience and professional certifications [START_REF] Kossiakoff | Systems Engineering Principles and Practice: Second Edition[END_REF]. These components include three overhead components, namely engineering process training, systems thinking activities and systems engineering work experience, each consisting of three sub-activities each. Adapting the generalized activities presented in [START_REF] Kossiakoff | Systems Engineering Principles and Practice: Second Edition[END_REF] to the field of requirements engineering, the following development activities were identified to use as a guideline in the development of a module for SREs:

• Engineering process training: which include Process Knowledge, Tools and techniques and Skills • Systems thinking activities which include Security discipline expertise, Problem solving and Holistic view

The evaluation of the threat landscape in Section 4.1 identified five engineering processes relating to requirements engineering in the S-SDLC. These processes are viewed in relation to the six engineering development activities listed above to generate a Body of Knowledge (BoK) table, namely the rows and columns of the table, respectively. This BoK table is populated by mapping all the knowledge, skills, abilities and tasks identified in the other sections of Section 4 to the six engineering processes and developmental activities. The BoK table is shown in Table 3 below. This populated table provides an overview on the cybersecurity module for SE students. The columns of the BOK table are the five processes related to the Security Requirements phase of the S-SDLC identified in Sections 4.1 and 4.4. The table is populated with the knowledge, skills, abilities, tasks and requirements identified in Sections 4.2, 4.3 and 4.5. This table can provide guidance to determine the content of a Security Requirements Engineering module in systems engineering as the codes in the table indicate the topics of interest for each Security Requirements process in the S-SDLC. 3 presents the content for the cybersecurity module for security requirements within a SE curriculum. From the table mapping the systems thinking ability is very important for the future and a lot of focus should be in this area to help teach future students to think in this manner.

Module validation

The CSEC2017 framework provides guidance for education efforts in cybersecurity [START_REF] Burley | Cybersecurity Curricula[END_REF] which offers a sound guideline for the validation of the developed module. The CSEC framework divides the cybersecurity content into 8 KAs and states that the content must be aligned to workforce needs by viewing the work through a disciplinary lens. In the development of a cybersecurity module for SEs, von Solms and Futcher (2018) identified systems engineering as the disciplinary lens and determined that 3 of the 8 knowledge areas can be considered too technical for the systems engineering domain [START_REF] Von Solms | Identifying the Cybersecurity Body of Knowledge for a Postgraduate Module in Systems Engineering[END_REF]. Building on this research, the 5 KAs considered in the validation of this developed module are Software, System, Human, Organizational and Societal security.

The five processes which formed the headings of Table 3 columns were used as the divisions for five module units of work. Using the key words of the various knowledge, skills, abilities and tasks included as entries in the Table 3, the CSEC2017 document was investigated and corresponding KAs and knowledge units (KUs) were identified and indicated in Table 4. When a corresponding CSEC2017 KU could not be found, an addition entry was added to Table 4, named "Systems Engineering Specialized".

Conclusion

The creation of systems to comply with Industry 4.0 environments and cyberattacks requires the elicitation of security requirements from various sources, including regulations, client needs and human behavioral factors. The elicitation of these security requirements requires a SE who are specialize in the field of security requirements engineering and had specialized knowledge relating to various security aspects which may influence the security requirements of the system. Engineering education is SA does not include comprehensive cybersecurity modules in systems engineering and does not provide specialized education in the field of security requirements engineering. This paper includes an investigation to determine the BoK for the creation of a module which specializes in security requirements engineering. Input factors from industry were considered to determine the knowledge, skills, abilities and tasks required for security requirements elicitation. The CSEC2017 framework were utilized to validate the educational content to be included in the module. The basic BoK for a security requirement engineering module is presented, which shows that the KAs of Systems Thinking, Risk Management and Governance, Security systems engineering principles, Law and Regulation related to Cybersecurity and Human Factors are the most important for inclusion in the module. This work will contribute to cybersecurity curriculum design in systems engineering and other specialized systems engineering fields, such as security requirements engineering. This work can also be used as a roadmap for the development of SE modules outside of SA, as it is based on international standards and best practices. However, the laws and regulations relevant to the specific country must be considered.

Fig. 1 .

 1 Fig. 1. Methodology for module development [17] 1. Step 1: Review the key input factors that certifying bodies consider relevant, including threat landscape, technology changes, industry standards, workforce needs, and government and regulation as per the framework in [17]. From this review, relevant cybersecurity knowledge and skills are determined. 2. Step 2: Development of a draft SE cybersecurity module from the data collected in Step 1. 3. Step 3: Validate the developed SE cybersecurity module against the CSEC2017 guidelines.

Table 1 .

 1 Tasks, skills, knowledge and abilities requirements from NIST 800-181[START_REF] Newhouse | National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework[END_REF]

	Code Table 2 reference code	Code Table 2 reference code
	T0033 Risk assessment & feasibility study	K0012 Requirements analysis
	T0039 Functional requirements evaluation	K0038 Data risk management
	T0052 Scope definition	K0044 Cybersecurity and privacy
	T0062 Requirements development	K0045 Security systems engineering principles
	T0127 Integration of security policy & regulation K0067 SDLC process
	T0174 Needs analysis	K0102 SDLC process
	T0235 Requirements modelling T0300 User interface requirements	K0164	Functionality, quality, and security require-ments integration
	T0454 Baseline requirements	S0008 System analysis
	K0002 Risk management	S0010 Requirements analysis
	K0003 Cybersecurity regulation & laws	S0050 Requirements modelling
	K0004 Cybersecurity and privacy	S0134 Review and validation
	K0005 Cyber threats and vulnerabilities	S0367 Cybersecurity privacy principles application
	K0006 Impact analysis	A0064 Translate requirements operational impact
	K0008 Operational business domain knowledge A0123 Cybersecurity privacy principles application

Table 3 :

 3 Body of Knowledge for

	module
	Engineering
	Requirements
	Security
	Table

Table 4 .

 4 Security Requirements Engineering Module outline

	Stakeholder Needs & Require-	System requirements
		ments Definition Process		definition process
	Elicit stakeholder	requirements	Define stakeholder	security requirements	Analyse & maintain	stakeholder security	requirements	Define system	security requirements	Analyse and main-tain system security requirements

Software

From the validation process shown in Table 4, emphasis is placed on five main KAs:

• Systems Thinking: As a SE, the professional must have skill of systems thinking and be able to view a system holistically. • Risk Management and Governance: The SE must be able to implement and understand risk management of systems and organizational security controls, which requires knowledge of applicable standards, best practices, and approaches. In addition, the new threats that the connected systems introduce must be analysed and risk estimations must be done during requirements phase. • Security systems engineering principles: The SE responsible for the security requirements engineering needs to have expert knowledge in the security discipline. • Law and Regulation related to Cybersecurity: All local and international statutory and regulatory requirements, compliance obligations, and security ethics, must be known to elicit security requirements. • Human Factors: Knowledge relating to human factors and user behaviours and how it impacts security, security culture and awareness must be known by SREs.

These observations support the findings in Table 3 where it was shown that systems thinking skills must be considered in the changing technological landscape. However, the SE must have fundamental expert knowledge in security practice and the ability to apply systems thinking. Security threats will change, and the SE must be able to consider all possible scenarios when specifying requirements. Due to technological changes in systems, this module needs to be developed and used in the training of specialized SEs to prepare them for the changes brought forth by changing technological landscapes.


Natalia Miloslavskaya
email: ngmiloslavskaya@mephi.ru

Alexander Tolstoy
email: aitolstoj@mephi.ru

Blockchain and its Security: Ignore or Insert into Academic Training?

Keywords: blockchain technologies, security, academic training, competencies, standards, survey, educational course structure

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Starting from 2009 with Bitcoin, there are countless publications advertising the "magic" of blockchain (BC) technologies (BCT) and supporting a high level of "hype" around their usage [1]. The BCT for creating verifiable digital records have shown notable success not only in digital currencies but also in financial application domains (like online payments, currency exchanges, money services and transfers, soft and hard wallets, trade finance, markets, microtransactions, investments, brokerage, insurance, etc.), as well in non-financial domains (like digital identity management, authentication and authorization, digital content storage and delivery systems, smart contracts, certification validation systems, application development, real estate, election voting, patient medical records management, distributing the workload for communication system, computer systems that must comply with legal agreements without human intervention, etc.). If someone will use the "blockchain" word as a search criterion in the IEEE digital library as well as in Scopus and WebofKnowledge databases, many titles will be returned in the reply. For example, the search for 2018 returned 1427 from Scopus, 418 items from WebofKnowledge and 605 from the IEEE digital library (access date 06.11.2018)! But in 10 years the BCT is not well understood as yet, and no single agreed definition of this technology has appeared. Some of the most known BC definitions are quoted below:  UK Government, 2016: "A distributed ledger technology" [2];  PriceWaterhouseCoopers, 2016: "A decentralized ledger of all transactions across a peer-to-peer network, where participants can confirm transactions without the need for a certifying authority" [3];  OpenBlockchain, 2017: "A technology that enables the secure and resilient management of distributed data in combination with data analytics techniques that add scale and flexibility" [4];  Wilson, 2017: "It is not a "trust machine". By the blockchain protocol, it only reaches consensus about one specific technicality -the order of entries in the ledger, free of bias" [5];  Nielson, 2017: "A distributed file system that keeps files copies of the participants who agree on the changes by mutual consensus, where the file consists of blocks and every block has a cryptographic signature of the last block, making an immutable record" [6];  Primechaintech, 2018: "A peer-to-peer network which timestamps records by hashing them into an ongoing chain of hash-based proof-of-work, forming a record that cannot be changed without redoing the proof-of-work" [7].

We define a BC as a secure distributed data structure (database, DB) that maintains without centralized administration and data storage a constantly expanding list of noneditable time-stamped blocks (records) and sets rules about transactions which are tied to these blocks [8].

So far as the BCT cause such a serious burst of interest to them of young people in the first place, not to meet the rising demand and not to pay attention to the BC during the training means not to be modern. Speaking easier, any educational institution, which doesn't offer courses in the BC, is going to be left behind as a non-competitive. That is why the goal of the paper is to analyze a state of the current training in the BCT and to work out on this basis some recommendations for conducting it for security professionals, paying special attention to security issues. To achieve this goal the paper is organized as follows. Survey of the BCT training worldwide is given in Section 2. Standards as the basis for the BCT training are discussed in Section 3. Section 4 is devoted to books, which can support the BCT training. The desired competencies after mastering a full-time BC course are formulated in Section 5. An exemplary structure of the course in the BCT is proposed in Section 6.

Survey of the BCT training worldwide

The efforts to develop individual disciplines (courses) in the BC started a few years ago. The Coinbase Company reviewed BC course catalogs at the top 50 universities [9]. Their study was focused on classes available to undergraduate-level students in the fall 2018 semester or the most recent semester, for which information was available online. We used it to begin our search on the BCT courses worldwide.  Linux Foundation: the "Blockchain for Business -An Introduction to Hyperledger Technologies" course covers key features of the BCT and the differentiators between various types of Hyperledger projects (10w-3-4hpw);  Linux Foundation: the "Blockchain: Understanding Its Uses and Implications" course analyzes the concept of transparent ledgers, both public and permissioned, and focuses on using cryptography to achieve consensus, immutability, and governance of transactions (5w-3-4hpw);  University of Hong Kong: the "Blockchain and FinTech: Basics, Applications, and Limitations" course discusses the BCT, the differences of the various existing BC platforms, applications best fit the BCT, as well as limitations and the downside of the BC with respect to the protection of criminal activities (6w- This list can be continued more and more, but from our perspective, it is enough information to define main competencies for those who will master a course in the BCT.

Standards as the basis for the BCT training

In 2016, the ISO/TC 307 "Blockchain and distributed ledger technologies" has been created for standardization of the BCT and distributed ledger technologies (DLT). This technical committee combines several specialized and working groups, namely "Blockchain and distributed ledger technologies and IT Security techniques", "Foundations", "Use cases", "Security, privacy and identity", "Smart contracts and their applications", "Governance of blockchain and distributed ledger technology system" and "Interoperability of blockchain and distributed ledger technology systems". The IEEE P2418.1 standard for the framework of BC use, implementation, and interaction in one particular application -IoT -has started in June 2017 with June 2019 as an expected date of draft submission to the IEEE-SA. This framework will include BC tokens, smart contracts, transaction, credentialed network, permissioned and permissionless IoT BC enable decentralized, autonomous peer-to-peer, consumer-tomachine and machine-to-machine communications without the need for a trusted intermediary and address scalability, interoperability, security and privacy challenges with regard to BC in IoT.

The Draft NISTIR 8202 "Blockchain Technology Overview" [1] discusses how the BC works, especially when applying to electronic currency. It shows the BCT's broader applications (banking, supply chain, insurance, healthcare, trusted timestamping, energy industry) and highlights some of their limitations, concerning the BC control, malicious users, no trust, resource usage, transfer of burden of credential storage to users, and Private/Public Key Infrastructure and identity. This draft defines the high-level components of BC system architecture like transactions, blocks, hashes, forks, etc. It describes how new blocks are added to the BC and how consensus models resolve conflicts among miners. Different BC permission models and their use case examples are introduced. The draft also covers smart contracts and BC platforms in use today. Here we rely on this document as the only one is currently publicly available.

We hope that for the beginning of the next educational year some of these standards will be adopted and published, so they could be used as a basis for the training.

Books support for the BCT training

As our search has shown, there are a lot of books, which can be taken as the basis for conducting training in the BCT. Here is a list of books published in 2016-2018 and available on the book markets in alphabetic order (with their volumes in pages):

Desired competencies after mastering a full-time BCT course

Based on a detailed analysis of all the previously mentioned courses, the content of standards and some of the books listed above, we are ready to formulate what students who have completed full-time semester training on a BCT-related course will know and be able to do. Upon successful completion of this training, students should:  Know and understand what the BC is and the terminology used;  Know where, how and why the BCT can be used in the modern world;  Know and get a deep understanding of international standards on the BC;  Know key BC's theoretical principles and practices and understand how they can be applied within an individual business environment;  Have a deep understanding of how to build a BC (meaning building a blockchain system from scratch);  Understand BC's security and know its vulnerabilities and security risks. Besides this, students should master basic BC handling skills and be able to:  Identify and analyze the challenges and prospects of the BCT and propose or develop systems and services that address them;  Develop or participate in developing the BCT itself and the things that interact with the BC (like developing a new BC protocol or improving existing one, understanding and being able to apply cryptography used in BC systems, designing a distributed system architecture, innovative systems, and services that complement and extend the existing BC concept);

 Implement requirements of international standards on the BCT;  Carry out the synthesis and analysis of design projects on distributed ledgers, smart contracts, and applications for the BCT;  Analyze and compare different BC platforms, as well as select the right BC platform to be applied within an individual business environment;  Analyze best practices of the BCT applications, specify business opportunities, and apply the BCT-based innovative solutions to address business problems;  Conduct a security risk assessment for the BCT and propose a set of measures (rules, procedures, practical methods, guidelines, and tools) to mitigate them. Of course, the given list of knowledge and skills can be taken only a basis. It does not pretend to completeness as every educational institution training on the BCT can broaden it according to the country and its business specific, for example.

6

Exemplary structure of the course in the BCT Based on the above-formulated knowledge and skills, it is possible to determine the structure of a typical full-time 1-semester university course in the BCT for a Master's degree programme as it requires some prerequisites as knowledge in cryptography, networks, information security and so on.

CONCLUSION

After a detailed study of the issue put at the beginning, for us it is obvious that teaching the BCT and their security is the urgent need of today. The next steps in preparing a course with the proposed structure for teaching in the MEPhI in the framework of the "Business Continuity and Information Security Maintenance" Master's degree programme since the Autumn 2019 semester will include the development of all educational and methodical materials required for its support, a set of laboratory works to acquire the necessary skills and a web site as a tool for coordinating the educational process and providing a teacher-student interaction during it.

  It was found that 42 % of the top 50 universities offer at least one class on BC or cryptocurrency, and 22 % offer more than one. These courses are most prominent in the U.S. Only 5 of the 18 international universities on the list (27 %) offer at least one class. And only two -Swiss Federal Institute of Technology Zurich and National University of Singapore -offer more than one.Our analysis shows that at present the training proposed can be divided into two groups: the first one is designed for distance learning only and the second one for face-to-face full-time (not online) training. The first group is represented by the following universities and companies, providing training in the BCT by means of online, usually paid open courses (on successful completion of these courses, students earn certificates) and even master's degree programmes (like the last item in the list):

	On Coursera [https://www.coursera.org]:
	 State University of New York and University of Buffalo (USA): the
	"Blockchain" course covers basics, smart contracts, decentralized applications,
	and platforms. It includes projects for practicing. Potential students can get a
	free 7-days trial before deciding to pay for the course. Duration: 4 weeks (w),
	3.5 hours per week (hpw);
	 University of Buffalo: the "Blockchain Basics" course provides a broad over-
	view of the essential BCT concepts -by initially exploring the Bitcoin proto-
	col followed by the Ethereum protocol -to lay the foundation necessary for
	developing applications and programming (4w-3.5hpw);
	 Princeton University (USA): the "Bitcoin and Cryptocurrency Technology"
	course teaches the basic technical foundations of how the BC works and ar-
	chives decentralization, dispelling misconceptions and pointing to the future of
	the BCT. (11 w);
	 The "IBM Blockchain Foundation for Developers" course teaches software
	developers with a little or no experience concepts and strategies on building
	private BC networks for IBM Bluemix. Students can learn how to add code for
	smart contracts using the chaincode interface from the Hyperledger Project's
	Fabric. The course includes a lab demo of how assets are transferred to several
	roles across a network (6w-2hpw);
	 ConsenSys Academy: the "Blockchain: Foundations and Use Cases" course
	consists of several modules, introducing the BCT, Ethereum and different
	business use cases (5w-2hpw);
	On edX [https://www.edx.org]:
	 University of California at Berkeley (USA): the "Blockchain Technology"
	course provides the ideal foundation required to comprehend the BCT. Among
	other things, it covers distributed systems, alternative consensus mechanisms,
	fundamental applications and implementations of the BCT (like JP Morgan's
	Quorum, Ripple, Tendermint, HyperLedger). It is good for both beginners and
	those at the intermediate level (6w-3-5hpw);
	 University of California at Berkeley: the "Bitcoin and Cryptocurrencies"
	course learns, for example, the basics of smart contracts, the Ethereum plat-
	form and how to build decentralized applications (6w-3-5hpw);

  Blockchain and a Cryptocurrency from Scratch" course by D.J.Katz (6.5h-71l-5a) discusses the implementation of the BC, gives understanding of the main concepts like Proof-of-Work, mining, peer-to-peer connections, etc. and how to build your own BC, create a NodeJS application with real-time websocket connections and build an API with NodeJS and Express; B9Lab ACADEMY [https://academy.b9lab.com], an independent firm in London and Hamburg working in collaboration with private industry and higher education, provides several online courses in the BCT, consults with businesses who want to make use of it, and performs crucial research on the BCT developments and applications. Students have access to experienced tutors via a dedicated slack channel. Students who complete their studies successfully receive a certificate in the BC, backed up by the Ethereum network;  University of Nicosia (Cyprus): the first full, 3-semester long Master's degree programme in digital currency offered through distance learning [https://digitalcurrency.unic.ac.cy/about-the-program]. The majority of the courses consist of lectures delivered by the faculty, but in some cases by guest lecturers with academic and business background related to topics covered in courses. Practical exercises, individual and group projects, simulations and case study analyses form an integral part of the programme. One additional note: the UNIC is the first university to accept Bitcoin as payment for tuition. The second group of face-to-face full-time (not online) courses in represented mostly by American universities having specialized research centers in their structures supporting training in the BCT. They are appeared in the list in alphabetical order, not in any scientific or statistical ranking:  Cornell University with the support from Cornell's IC3 (Initiative for Cryptocurrencies and Contracts) research organization has created in 2017 the Cornell Blockchain project [https://cornellblockchain.org] to provide education, certification, and application of the BCT for students and corporate clients. Unfortunately, the content of this web site is available only to its members;  Duke University's Blockchain Lab [http://www.dukeblockchainlab.com] is a specialized, student-led research center designed to bring students and faculty alike up to speed on the newest developments in the BCT through lectures, interest groups, and workshops. On the web site, there are some links to the selected resources for further learning, research, news, etc.;  Center for Financial Markets and Policy of the Georgetown University' McDonough School of Business [https://finpolicy.georgetown.edu/about] is one of the most notable academic studies in the BC, sponsoring an annual international BC Summit and seminars and publishing white papers and analysis of BC's impact on finance and investment;  Massachusetts Institute of Technology is one of the world's authorities on the BCT through the Media Lab's Digital Currency Initiative [https://dci.mit.edu], which is working to push the BC development with research projects, papers, and groups while raising awareness of its risks and potential;  New York University's Stern School of Business has the BCT as an integral part in the FinTech MBA program [http://www.stern.nyu.edu/programs-admissions/full-time-mba/academics/areas-interest/fintech] focused on technology's impact on finance, including analytics, artificial intelligence, and the BC. They offer the "Digital Currencies, Blockchains, and the Financial Services Industry" course in the BC. The first course was offered in 2014;  Blockchain at Berkeley at the University of California at Berkeley [https://blockchain.berkeley.edu] is a student-led organization, uniting students, alumni, and community members to offer education, research, and consulting in the BCT and their future uses via workshops, lectures, seminars, and meetings. They offer the 1-semester "Blockchain Fundamentals" course with 1 hour of lecture per week and 1 hour of interactive discussion. Among their workshops are the following: "What is Blockchain (Introduction to the BC)", PwC Academy conducts the "First touch to Blockchain. Features and application of blockchain technology" 4-hours face-to-face master class [https://training.pwc.ru/seminars/workshop-blockchain], introducing the use of the BCT in the financial sector, its purpose, open and closed types, and distinctive advantages. Cryptoacademy [https://cryptocademy.ru] offers several 6-hours intensive courses in the BCT. Blockchain Academy [https://block.academy/ru/edu/] has several 1-2-days face-to-face programmes for banks, developers, and investors. The "Blockchain Basics" online course from the Skillbox Company consisting of 10 seminars and 5 assignments is available at [https://skillbox.ru/blockchain]. Luxoft Training [https://www.luxoft-training.ru/kurs/blokcheyn_i_kriptovalyuty.html] teaches the "Blockchain and Cryptocurrencies" 6-hours course.

	 The "Blockchain Developer" two 3-month terms Nanodegree programme In Russia,
	[https://www.udacity.com/course/blockchain-developer-nanodegree--nd1309]
	teaches to work with the Bitcoin and Ethereum protocols, as well as to build
	smart contracts and projects for real-world application;
	  National University of Singapore: the "Blockchain: Embarking on the Jour-
	ney" [https://academy.smu.edu.sg/blockchain-embarking-journey-1136] is a 1-
	day course targeted at professionals seeking to gain an understanding of the
	BCT and their applications in the business world;
	 Swiss Federal Institute of Technology Zurich: the "Blockchain and Internet of
	Things"	[http://www.vvz.ethz.ch/lerneinheitPre.do?semkez=2018S&
	lerneinheitId=122368&lang=en] 1-semester course provides opportunities to
	gain fundamental understanding of promising new technologies as well as de-
	velop creative decentralized solutions for societal challenges using these tech-
	nologies. During the hackathon, students work in mixed teams on concrete
	challenges (like climate change, financial instability, energy, or mass migra-
	tion, etc.) and develop decentralized approaches towards a sustainable, sharing
	circular economy using BC and Internet of Things (IoT) technologies;
	 Financial University under the Government of the Russian Federation: the on-
	ly one in the world full-time face-to-face Master's degree "Blockchain Tech-
	nologies and Cryptocurrency" programme (2 years, 120 credits) in the frame-
	Miscellaneous: work of the "Applied Mathematics and Computer Science" direction
	 Royal Melbourne Institute of Technology (Australia): the 8-week, fully online [http://www.fa.ru/en/admissions/Pages/Master-programs.aspx] started in 2018.
	short Graduates are preparing to use the BCT in various fields of activity, techno-course in the BCT [https://www.rmit.edu.au/news/all-
	news/2018/feb/blockchain-strategy-course-students-jobs-future] is designed in logical support for the secure usage of cryptocurrencies, ensuring
	partnership with the Accenture company and Stone and Chalk Fintech hub; cybersecurity in the field of finance using BC and cryptocurrency technolo-
	gies.

3-4hpw); On Udemy [https://www.udemy.com] (only the first 7 courses with the best scores are represented here):  The "Blockchain and Bitcoin Fundamentals" course by G.Levy (2.5 hours of video, 37 lectures (l), 2 articles(a)) learns all about the fundamentals, including how miners and block hashes work;  The "The Basics of Blockchain: Ethereum, Bitcoin, & More" course by T.Serres, B.Warburg, Dr.Bull (3.5h-51l-4a) gives fundamentals of the BCT;  The "Blockchain for Business 2018: The New Industrial Revolution" course (6h-60l-3a) develops solid fundamental understanding of the inner workings of BC with detailed explanations of mining, decentralized consensus, cryptography, smart contracts and many other important concepts;  The "Blockchain A-Z™: Learn How To Build Your First Blockchain" course by H. de Ponteves (14.5h-94l-9a) learns how to build a BC, create a cryptocurrency and smart contracts;  The "Ethereum & Solidity: The Complete Developer's Guide" course by S.Grider (24h-246l-13a) teaches how to use Ergereum, Solidity and secure Smart Contracts to build applications based on the BC and to use the latest version of Ethereum development tools;  The "Become a Blockchain Developer with Ethereum & Solidity" course by S.Agrobast (15h-86l-4a) learns from the very basics to advanced levels how to develop a distributed application, to unit test them and create a user interface for them, and to use the Truffle build/testing framework;  The "Build a "Bitcoin (How a Bitcoin transaction works)", "Ethereum (Introduction to Ethereum)", "Consensus Algorithms (Algorithms, data structures and scripting)", "Smart Contract Security (Programming smart contracts with Ethereum)", "How to Consult (Lessons learnt from the BC)", "Blockchain vs Database (What makes the BC unique)", "Smart Contracts and Business (What makes the BC unique)", and "EVM (Ethereum Virtual Machine)";  Decentralized Systems Lab of the University of Illinois at Urbana-Champaign [http://decentralize.ece.illinois.edu] is a multidisciplinary research center for educating and extending the academic conversation with research projects and papers, as well as creating the BCT. In 2018, they offered the half-semester "Smart Contracts and Blockchain Security" course (2 credits, slides are available at http://soc1024.ece.illinois.edu/teaching/ece398sc/spring2018/);

Section 4. BC vulnerabilities and limitations and how to overcome them Module

  The following exemplary detailed structure is proposed for a classical course in the BCT. Providing hash values for data in the BC; Detecting changes in data; Asymmetric cryptography in the BC for identifying accounts and authorizing transactions; Merkle tree; Cryptographic Changes and Forks Module 9. Transactions and data storage in the BC o Creating a new block for inclusion into the BC; Chaining blocks; Verifying and adding transactions; Distributing the data store among peers 10. BC vulnerabilities and limitations o BC control and hidden centrality; The security model utilizing asymmetric cryptography; No trust; Lack of privacy; Resource usage; Limited scalability; High cost; Critical size; Malicious users; Double spending as a problem of distributed peer-to-peer systems of ledgers and how to solve it; Transfer of burden of credential storage to users; Conflicting BC goals: transparency vs. privacy, security vs. speed; Lack of legal acceptance; Module 11. How to overcome some BC limitations o Redactable BC by Accenture Section 5. Using the BC Module 12. Specific BC use cases o Finance, digital identity, notary services, voting, manufacturing, IoT, supply chain, security, etc. BC use cases; Detour to the emergence of cryptographic currencies; introduction to BC platforms: Bitcoin, Ethereum, Ripple, etc.; Hyperledger project; Multichain platform; Economical, social, cultural and political implications of the BC; Module 13. BC research and further development o Research and development in the BCT; o Further BC development Section 6. BC Project Option 1 -Choose a BC topic from the given content for its detailed discussion Option 2 -Create a BC business plan for the application area selected Option 3 -Create a BC for the application area selected

	(permissionless, public) ledger, user, validating mechanism, etc.);
	BC-related standards (ISO/IEC, NIST, etc.)
	Module 4. BC Characteristics and Architecture
	o Characteristics of the BC (immutable, append-only, ordered, time-
	stamped, open, transparent, secure, eventually consistent, interopera-
	ble); Architecture of BC networks; Soft and hard forking; Security
	and privacy protection issues for the BC; Trust and ownership in the
	BC
	Section 3. How the BC works
	Module 5. Planning the BC
	o Describing and protecting ownership; Storing transaction data; Pre-
	paring and distributing ledgers; Adding new transaction; Deciding on
	trust; BC deployment architecture; Resource management in the BC
	development
	Module 6. BC protocols
	o Protocol for transactions; Protocol for peer-to-peer communications;
	Consensus protocol (proof of work; proof of stake; round robin; ledg-
	er conflicts and resolutions); Data storage protocol
	Module 7. Maintaining the history of transactions
	o Choosing a transaction history; Storing, using, adding the history of
	transactions; Ordering the transactions; Integrity of the history; De-
	Section 1. Introduction tecting changes in the history
	Module 1. Blockchain Technologies in Modern Business Environment Module 8. Hashes and cryptography in the BC
	o Introduction to the BC and its ecosystem; History of BC's develop-o
	ment (to understand its roots); Problems solved by the BCT (to know
	their implications and to recognize the potential); The areas of the
	BCT's application (to know their scope and to see the big picture);
	BC in the different fields of law (transactional, corporate, commer-
	cial); BC regulation and regulatory environment
	Module 2. Technologies used by the BCT
	o Fundamentals of cryptography (including independent, repeated,
	combined, sequential and hierarchical hashing and asymmetric cryp-
	tography) and crypto programming; Fundamentals of data and data-
	bases; Private and public networks; Distributed and centralized sys-
	tem architectures; Peer-to-peer systems and their architecture; Ledger
	and authorities
	Section 2. BC foundation
	Module 3. Basics of the BCT
	o Introduction of a BC concept; BCT terminology (including the fol-
	lowing terms: account, actor, agent, altchain, block, chain, consensus,
	cryplet=runtime, distributed ledger, immutability, forking, hybrid BC,
	ledger, main chain, middleware, miner, mining mechanism, node, or-
	dering service, peer, permissioned (dedicated, private) ledger,
	sidechain, shared ledger, smart contracts, transaction, unpermissioned

Acknowledgement. This work was supported by the MEPhI Academic Excellence Project (agreement with the Ministry of Education and Science of the Russian Federation of August 27, 2013, project no. 02.a03.21.0005).