I recently contributed to a curriculum development project for a for-profit tech school. Having previously taught a course for the school, I had a reasonable idea about some of the challenges this type of environment contained. In many ways I think of them as the fast-food equivalent of a tech school, focused on training more than education, and really only doing the minimum necessary (despite assertions to the contrary).
One of the key skill deficiencies I noticed while teaching was in the quality of writing skills. Quite simply, these students did not generally write much of anything, and when they did write, it was usually all short-hand, lacking structure and clarity. For someone working in the industry these students hoped to join, I found this issue a bit concerning. It's not that I expect everyone to be able to write the next great American novel, but I do think it's reasonable to expect distinct clarity in professional writing and communication.
To this end, as I worked on the curriculum project I sought to engrain writing as a standard practice and requirement. Specifically, I advocated the inclusion of short essays throughout the course (500 words minimum) on a new topic each week. Unfortunately, the powers that be disagreed. In fact, they went so far as to that "essays" weren't a part of the workplace, and thus were inappropriate for a course designed to model a "real" work environment.
The specific feedback was "[Client] wants these assignments placed within a real professional world. Typically, IS professional are not asked to write essays. Therefore, even if we weave these essay assignments in a scenario, it may not be plausible/acceptable to [Client]." I can't even begin to tell you how much I disagree with that comment. Ok, yes, from a purely literal perspective, I've never been assigned an "essay" as part of my work duties. However, I'm assigned writing tasks ALL THE TIME. Professional emails, blog posts, articles, various reports, and so on, are all part of the routine duties of many infosec professionals. The whole point of the short essays was to get students into the mode of taking a topic (related to the security discussion of the week) and writing, essentially, a position statement on it (like what you'd do in researching a topic and making a recommendation). Unfortunately, the (non-domestic) reviewer didn't agree, and unsurprisingly so - not just because of cultural differences, but also because of the nature of this particular school to undervalue thinking and foundational skills like writing and analysis.
Writing is considered to be one of the fundamental tenets of our current evolved state; it's one of the key anthropological markers that differentiates the degree of progression in a civilization. How, then, could we have reached a point where writing is so undervalued? I am somewhat exaggerating the degree of criticism in the feedback provided, but the point is still valid and important. Being able to effectively communicate ideas in writing is vitally important, not just to infosec professionals, but to humanity as a whole. Programs that undervalue and deemphasize these types of skills are dangerous in that they output students who are simply not adequately prepared for the modern work environment.
Wow. Someone should spin up a security writing course. Is infosecwriting.com taken?
In my past shops I can think of a dozen folks who I'd fund to attend. In addition to writing, I'd include presentation development. I've written hundreds of "essays" in corp IT. Writing skills are also a requisite step in career advancement. How many technologists are frustrated because they're not being promoted fast enough? The key reason in my experience is effective communication skills.
Hi Jared -
There are several companies that provide "soft skills" training for corporations. I don't know that any of it is specific to infosec, per se, but I would assume they provide the right base level of training.
I think you're absolutely right, though, about the link between promotion and effective communication skills. Or, worse, people get promoted to management roles without having effective communication skills causing all sorts of hardship.
Thanks for the comment!
-ben
Seriously, good technical writing skills are very important. And technical writing isn't "writing in a convoluted manner." Technical writing, to me, is explaining technical concepts concisely and and clearly near an 8th-grade reading level. Simply looking at my writings before and after I took Technical Writing in college proves that it was a very important part of my curriculum.
Working in infosec, I was frequently asked to write professionally-crafted texts, some of which might qualify as essays or narratives: How-to documents, management overviews of technical reports, narratives for audits, and weekly project status reports are just a few examples.