Panel: Building Cyber Resilience Through Education

Panel: Building Cyber Resilience Through Education

Speakers: Anca Doce (Senior Cybersecurity Manager, Directoratul Național de Securitate Cibernetică - DNSC); Cristian Patachia - Sultanoiu (Development & Innovation Manager, Orange Romania); Florina Avadanei (Dumitrache) (CEO, CyberEDU.ro); Maksim Iavich (Professor, Head of Cyber Security Direction, Director at Cyber Security Center, Caucasus University); Razvan Rughinis (Professor and Deputy Dean, Universitatea POLITEHNICA din București)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=kvcm7-Ra_FQ

Overview

This panel discussion, "Building Cyber Resilience Through Education," moderated by Anca Doce from Romania's National Cyber Security Directorate (DNSC), brought together leading voices from academia, industry, and government to explore the multifaceted role of education in strengthening national cyber resilience. Against a backdrop of increasingly complex cyber threats, the panelists underscored that resilience extends far beyond technological solutions, fundamentally resting on the knowledge, skills, risk awareness, and active engagement of people across all societal levels. The DNSC, as a strategic pillar, actively supports educational and professional training initiatives, recognizing that a well-informed and skilled populace is the ultimate defense in the digital ecosystem.

The discussion featured a distinguished lineup of experts: Cristian Patachia-Sultanoiu from Orange Romania, representing the telecommunications industry; Professor Razvan Rughinis from Universitatea POLITEHNICA din București, offering an academic perspective; Florina Avadanei (Dumitrache), CEO of CyberEDU.ro and co-founder of DefCamp, highlighting practical education platforms; and Professor Maksim Iavich from Caucasus University, providing insights from Georgia's cybersecurity landscape. Together, they articulated a shared vision for cultivating a robust cybersecurity culture, emphasizing the critical interplay between formal education, hands-on training, private sector investment, and governmental policy in preparing current and future generations to navigate and secure the digital world.

The panel delved into various aspects of educational strategy, from early childhood cyber hygiene to advanced PhD-level research, stressing the need for a unified approach that transcends traditional disciplinary boundaries. It became clear that fostering cyber resilience requires not only equipping individuals with technical prowess but also instilling a pervasive awareness of cyber risks and ethical responsibilities. The collective expertise on display underscored the urgency and complexity of the challenge, while also highlighting the significant progress and innovative solutions being implemented, particularly in Romania and Georgia, through collaborative efforts between public, private, and academic sectors.

Background

▶ Watch: Introduction: Building Cyber Resilience Through Education (0:00)

The premise of this discussion is rooted in the escalating global cyber threat landscape, where digital interconnectedness has become both an enabler of progress and a vector for sophisticated attacks. As Anca Doce aptly stated, in a world of "increasingly complex cyber threats, education is a strategic pillar of national resilience." This recognition has spurred numerous initiatives and discussions in recent years, aiming to build a more cyber-resilient society. The DNSC's perspective highlights that true cyber resilience is not solely a matter of technology but fundamentally about people – their skills, their awareness of risks, and their active participation in securing the digital ecosystem.

Historically, cybersecurity education has often been confined to specialized IT or computer science programs, failing to address the pervasive nature of cyber risks that touch every aspect of modern life. This panel sought to challenge that paradigm, emphasizing the need for a transversal approach to cyber education. The problem statement implicitly acknowledges a gap: while the demand for skilled cybersecurity professionals is soaring, traditional educational pipelines often fall short in both quantity and the practical relevance of their output. Furthermore, general public awareness of basic cyber hygiene and the ethical implications of digital interactions remains insufficient, particularly among younger generations who are digital natives but often lack foundational security knowledge.

Prior work, as referenced by the panelists, includes national programs, international partnerships, and awareness initiatives supported by entities like the DNSC. Industry leaders like Orange Romania have recognized the necessity of investing in continuous training and skill development, extending beyond their internal workforce to support broader ecosystem initiatives. Academic institutions, such as Universitatea POLITEHNICA din București and Caucasus University, have begun to adapt their curricula, introducing specialized master's and PhD programs and integrating hands-on learning. Organizations like CyberEDU.ro emerged precisely to bridge the gap between theoretical academic knowledge and the practical, real-world skills demanded by the industry, offering platforms inspired by live scenarios. The discussion also implicitly builds on the understanding that national cyber resilience is a shared responsibility, requiring coordinated efforts from government, the private sector, and educational bodies to cultivate a workforce and a citizenry prepared for the digital age.

Key Findings

▶ Watch: Georgia's Approach: Academia, Dual Degrees & Research (13:45)

The panel discussion yielded several critical findings regarding the cultivation of cyber resilience through education:

1. Cyber Resilience is a Shared, Multi-Sectoral Responsibility: A recurring theme was the absolute necessity of collaboration between the public sector (government bodies like DNSC), the private sector (companies like Orange, and educational platforms like CyberEDU), and academia (universities in Romania and Georgia). Florina Avadanei succinctly stated, "cyber resilience is a shared responsibility," emphasizing that each sector brings unique value – industry offers expert knowledge and real-world use cases, academia provides structured theoretical frameworks and research, and government sets policy and national strategy. This integrated approach is seen as vital for creating a unified national cyber resilience education strategy.

1. Education Must Be Holistic and Transversal: The panelists agreed that cybersecurity education cannot be confined to IT departments. Razvan Rughinis highlighted that "cyber security is transversal," advocating for integrating cyber skills across all disciplines. Beyond technical prowess, the discussion underscored the need for organizational readiness, risk awareness, and ethical considerations. A student's poignant question about cyber bullying and blackmail among peers highlighted the critical need to educate on the social engineering aspects of cyber security and provide "legal validation" for skills, steering young talent away from malicious activities.

1. Early Intervention and Continuous Learning are Crucial: Cristian Patachia-Sultanoiu emphasized starting "with the kids" – even preschoolers – recognizing that children begin using digital devices at very young ages. This early education should cover basic cyber hygiene and awareness. Furthermore, he stressed the importance of continuous training, retraining, and reskilling resources, acknowledging that the threat landscape constantly evolves.

1. Hands-on, Practical Experience is Paramount: Both Maxim Iavich and Florina Avadanei championed hands-on activities and real-life scenarios. Maxim highlighted the integration of the CyberEDU platform into formal university programs in Georgia, providing labs based on European practices. Florina elaborated on CyberEDU's mission to "bridge the gap between the practice" by bringing scenarios directly inspired by real-life incidents to students, ensuring they are job-ready. Capture The Flag (CTF) events and tabletop exercises were identified as vital for skill development, practice, and fostering a competitive spirit, as exemplified by Orange's "Unbreakable Romania" program.

1. International Exchange and Best Practices Accelerate Progress: Maxim Iavich detailed Georgia's adoption of European practices and dual degree programs with American universities, facilitating the exchange of students and professors. Razvan Rughinis affirmed that Romanian universities also leverage exchange programs and partnerships with US universities, despite funding disparities, to import good practices and attract more students to cybersecurity programs. This global perspective helps countries adapt faster to evolving threats and build more robust educational frameworks.

1. Talent Development and Retention are Strategic Imperatives: Razvan Rughinis explicitly stated that "keeping the talent in Romania" should be a common challenge, viewing other European universities as the primary competition, not domestic ones. The collective efforts of industry, academia, and government are aimed at creating attractive professional opportunities within the country, sending a "powerful message for the high school students" that Romania offers fulfilling career paths in cybersecurity.

Technical Deep Dive

▶ Watch: Private Sector's Concrete Contributions to Education (30:40)

While the panel was a discussion rather than a presentation of novel technical research, it extensively covered the technical aspects of cybersecurity education and the emerging technologies shaping the field. The focus was on how to equip individuals with the skills necessary to navigate and secure a technically complex digital environment.

Professor Razvan Rughinis from Universitatea POLITEHNICA din București detailed the academic sector's role in developing high expertise at bachelor, master, and PhD levels. He highlighted specific master's programs focused on "complex computer network security." His own research and PhD supervision include critical and emerging areas such as automotive security, transport infrastructure security, IoT security, and significantly, "securing machine learning infrastructures," which he identified as an "emerging topic" due to the new attack sources AI opens. This demonstrates an active engagement with the bleeding edge of cybersecurity challenges.

Rughinis also touched upon the importance of foundational programming skills, mentioning recent meetups for the Rust community and an upcoming event for Erlang language. Rust is increasingly recognized for its memory safety guarantees, making it a crucial language for developing secure systems, particularly in areas like operating systems and critical infrastructure where vulnerabilities can have severe consequences. Erlang, a functional programming language, is known for its robustness and fault tolerance, making it relevant for highly available and distributed systems.

Professor Maxim Iavich from Caucasus University discussed Georgia's formal cybersecurity education, which now includes bachelor, master, and PhD levels in cybersecurity. He emphasized the integration of practical, hands-on labs into the curriculum, specifically mentioning the CyberEDU platform. These labs are "concretely based on European practices," ensuring students gain relevant, real-world skills. Maxim also highlighted the importance of PhD programs for fostering research capabilities, which are "very important for the countries to be really cyber resilient" beyond just practical skills. His own work as a post-quantum cryptographer at Michigan University underscores the forward-looking nature of academic research, preparing for future cryptographic challenges posed by quantum computing.

Cristian Patachia-Sultanoiu from Orange Romania elaborated on the private sector's perspective on future technologies. He noted that Orange is not only testing but also planning to implement technologies related to quantum communications and quantum computing in their future network architectures. He also projected a bright future for Romania as a hub for the microchip industry and drone technology, all of which require highly competent cybersecurity resources. This indicates a proactive stance by industry in anticipating and preparing for the cybersecurity implications of advanced technological shifts.

Florina Avadanei, CEO of CyberEDU.ro, described the platform's technical contribution by bridging the gap between theory and practice. CyberEDU provides "hands-on scenarios and labs directly inspired from from real life," designed to immerse students in practical challenges they would face in a real job. The "Unbreakable Romania" program, supported by Orange and CyberEDU, is a national cybersecurity program that uses Capture The Flag (CTF) competitions and dedicated labs to guide students through a learning journey, concluding with a national competition to measure their knowledge and readiness. This practical, challenge-based learning environment is a key technical component of building cyber skills.

The collective insights reveal a technical ecosystem that is rapidly evolving. Educational programs are adapting to include modern programming paradigms (Rust, Erlang), address emerging threats (AI/ML security, IoT, automotive), and prepare for future technological frontiers (quantum computing, microchips, drones). The emphasis on hands-on labs, CTFs, and real-world scenarios ensures that the technical skills imparted are directly applicable and relevant to the demands of the cybersecurity industry.

Demo / Proof of Concept

▶ Watch: Importance of Practical Exercises: CTF & Guiding Young Hackers (36:00)

While this panel discussion did not include a live technical demonstration or a proof of concept in the traditional sense, the participants extensively highlighted and effectively "demonstrated" the value and methodology of practical, hands-on learning environments that serve as crucial proofs of concept for effective cybersecurity education.

The most prominent example discussed was the CyberEDU platform, co-founded by Florina Avadanei. This platform acts as a virtual laboratory where students and professionals can engage with "hands-on scenarios and labs directly inspired from from real life." Maxim Iavich confirmed its integration into formal bachelor and master programs at Caucasus University, underscoring its role in providing practical experience based on "European practices." These labs are, in essence, simulated environments that allow users to practice defensive and offensive cybersecurity techniques, test vulnerabilities, and understand system behaviors without risking real-world infrastructure. They serve as a proof of concept for experiential learning, showing that complex theoretical concepts can be concretely applied and mastered through guided practice.

Furthermore, the "Unbreakable Romania" program, a national initiative organized by Orange and CyberEDU, was presented as a prime example of a practical learning framework. Cristian Patachia-Sultanoiu and Florina Avadanei detailed how this program utilizes Capture The Flag (CTF) competitions and tabletop exercises. CTFs are widely recognized in the cybersecurity community as effective tools for skill development. They challenge participants to solve a variety of security-related puzzles, ranging from reverse engineering and exploit development to web security and forensics. These competitions are not merely games; they are immersive, problem-solving exercises that function as a continuous proof of concept for the participants' evolving skills. The fact that the program engages high school students and professionals, guiding them from foundational theoretical resources through webinars with experts to dedicated labs and culminating in a national competition, demonstrates a structured and impactful approach to practical skill building.

The panel implicitly argued that these practical exercises are vital because, as Florina stated, "you don't learn cyber security through watching a YouTube video... you really need to practice a lot." The existence and success of platforms like CyberEDU and programs like Unbreakable Romania serve as a powerful proof of concept for the efficacy of hands-on, challenge-based learning in developing genuine cyber resilience. They validate the idea that an infrastructure supporting such activities is essential for bridging the gap between theoretical knowledge and the practical demands of a cybersecurity career.

Defensive Implications

▶ Watch: Audience Question: Addressing Social Engineering & Cyber Bullying (52:30)

The insights from this panel discussion offer crucial defensive implications for organizations, educational institutions, and individuals striving to enhance cyber resilience. The overarching message is that a multi-layered, collaborative, and continuously evolving defensive strategy is paramount, with education at its core.

1. Invest in Continuous Education and Training: Organizations must move beyond one-off training sessions and adopt a strategy of continuous training, retraining, and reskilling. As Cristian Patachia-Sultanoiu pointed out, this is a "good word link to resilience." The threat landscape is dynamic, and defensive capabilities must evolve in lockstep. This includes leveraging platforms like CyberEDU for internal corporate training, as Orange Romania does.

1. Foster Public-Private-Academic Partnerships: The DNSC's role as a "hub for the private, academic and public sector" highlights the necessity of these linkages. Defenders should actively seek to collaborate with universities to influence curricula and provide real-world insights, and with government bodies to align with national cybersecurity strategies. This unified approach can lead to shared threat intelligence, coordinated incident response, and a more robust national defense posture.

1. Prioritize Hands-on Skill Development: Theoretical knowledge alone is insufficient. Defenders need practical skills honed through Capture The Flag (CTF) events, tabletop exercises, and hands-on labs. Organizations should encourage participation in such events (e.g., Unbreakable Romania, DefCamp CTFs) and integrate practical training into their professional development programs. This builds muscle memory for incident response, vulnerability assessment, and threat mitigation.

1. Implement Comprehensive Awareness Programs: Cyber resilience starts with basic cyber hygiene and risk awareness at all levels, from children to seniors. Organizations should develop tailored awareness campaigns that address common threats like phishing attempts and social engineering tactics. Anca Doce emphasized the DNSC's work in educating essential sectors (energy, health, finance) and addressing topics like cyber bullying and online safety for all generations.

1. Adapt to Emerging Technologies: Defenders must proactively understand and secure new technologies. Razvan Rughinis's focus on "securing machine learning infrastructures" and Cristian Patachia-Sultanoiu's mention of quantum communications and quantum computing underscore the need for anticipatory defensive strategies. Organizations should invest in research and development, pilot new security solutions, and train their teams on the unique challenges posed by AI, IoT, and quantum advancements.

1. Cultivate an Ethical Security Mindset: The discussion about young people seeking "power" through malicious means highlights a critical defensive implication: guiding aspiring talent towards ethical hacking and providing "legal validation" for their skills. Organizations can sponsor or host ethical hacking competitions, mentorship programs, and internships to channel curiosity into productive, defensive contributions, thereby strengthening the talent pipeline for legitimate cybersecurity roles.

1. Influence Educational Curricula at All Levels: To ensure a steady supply of skilled professionals, defenders should engage with educational institutions, from high schools to universities, to advocate for the inclusion of relevant cybersecurity topics. This includes supporting the development of specialized programs, providing guest lecturers from industry, and offering internships to bridge the academic-industry gap. The efforts to introduce cyber security education at high school level in Romania are a direct response to this need.

By embracing these defensive implications, organizations and nations can move beyond reactive security measures towards a proactive, resilient posture, built on a foundation of continuous learning, strategic collaboration, and a deep understanding of the evolving threat landscape.

Key Takeaways

• Cyber resilience is a shared responsibility demanding robust collaboration between government (DNSC), industry (Orange, CyberEDU), and academia (Polytechnica, Caucasus University) to create a unified national strategy.
• Education must be holistic and transversal, extending beyond technical IT programs to instill cyber hygiene, risk awareness, and ethical considerations across all disciplines and age groups, starting from early childhood.
• Practical, hands-on learning is paramount for developing true cyber skills, with platforms like CyberEDU and initiatives like "Unbreakable Romania" (CTFs, labs) bridging the gap between theory and real-world application.
• Continuous learning, retraining, and reskilling are essential for individuals and organizations to adapt to the rapidly evolving cyber threat landscape and emerging technologies like AI, IoT, and quantum computing.
• International exchange programs and adoption of best practices are vital for accelerating the development of national cyber capabilities and attracting and retaining top talent within the country.
• Addressing the "dark side" requires proactive engagement, providing young, curious minds with legal avenues for skill validation and ethical development, thereby channeling their potential into beneficial cybersecurity contributions.

About the Speaker(s)

Anca Doce is a Senior Cybersecurity Manager at the National Cyber Security Directorate (DNSC) in Romania. She moderated this panel, representing the DNSC's commitment to building a more cyber-resilient society through education, professional training, and awareness initiatives, acting as a hub for public, private, and academic sectors.

Cristian Patachia - Sultanoiu is the Development & Innovation Manager at Orange Romania, with over 25 years of experience in the telecom industry. He coordinates projects in future networks, cybersecurity, smart cities, and IoT, and manages Orange's educational programs and startup accelerators. He holds a bachelor's and master's degree in electronics and telecommunication and an executive MBA.

Florina Avadanei (Dumitrache) is the CEO of CyberEDU.ro and a co-founder of DefCamp, bringing over 12 years of experience in cybersecurity and project management. She is a passionate advocate for tech startups and cybersecurity education, also founding Ladies in Cyber Security. At CyberEDU, she focuses on strengthening national and global cybersecurity capabilities through practical education.

Maksim Iavich is a Professor and Head of Cyber Security Direction, and Director at the Cyber Security Center of Caucasus University. He is also the CEO and President of the Scientific Cyber Security Association. A post-quantum cryptographer, he is a computer science and cybersecurity consultant for Georgian and international organizations and a corresponding member of the Georgian National Academy of Science in cybersecurity.

Razvan Rughinis is a Professor and Deputy Dean of the Faculty of Automatic Control and Computers at Universitatea POLITEHNICA din București. His work focuses on technology and cybersecurity education, innovation, and technology transfer. He teaches in master's programs on complex computer network security and supervises PhD students researching topics like automotive security, transport infrastructure, IoT security, and securing machine learning infrastructures.