Dedicated Cybersecurity Degrees vs. Concentrations

Search for "cybersecurity degree" and you will find two kinds of programs mixed together. Dedicated degrees name cybersecurity, or a security field such as cyber operations, information assurance or digital forensics, as the degree or major itself. Concentrations are formal security tracks inside a broader degree such as computer science, information technology, business administration or criminal justice. Both can be solid programs. They differ in what your diploma and transcript say, and often in how much of the curriculum is actually security.

What the diploma says

The quickest test is the name of the awarded degree.

• Dedicated: Bachelor of Science in Cybersecurity, Master of Science in Cyber Operations, MS in Digital Forensics. The major is the security field.
• Concentration: Bachelor of Science in Computer Science with a Cyber Operations Track (Towson University), BS in Computer Science with a Concentration in Cybersecurity (UTSA), Master of Business Administration with a Concentration in Cybersecurity (American Public University). The degree is computer science or business. The concentration is the security part.

Some degree names fall in between, and you need the official wording to place them. George Washington University's degree is a "Master of Science in the Field of Cybersecurity in Computer Science." Because its major field is cybersecurity, we count it as dedicated. We always display a concentration under its real degree name, for example "MS in Computer Science — Cybersecurity Concentration," and never relabel it "MS in Cybersecurity."

How much security is in the curriculum?

The name tells you less than the credit count. Compare the security credits with the total:

A 9-hour concentration in an MBA is three courses. An 18- or 21-unit track in a computer science degree sits on top of a deep computing core, and Towson's track includes systems programming, operating systems security, network security, application software security, reverse engineering and malware analysis, and cryptography. Neither is "less" in quality. They are built for different purposes.

Dedicated degrees vary too. ABET's program criteria for computing programs with cybersecurity, cyber operations, information security, computer forensics or similar terms in their titles require at least 45 semester credit hours of computing and cybersecurity coursework and at least 6 semester credit hours of mathematics, including discrete mathematics and statistics. That applies only to ABET-accredited programs, but it shows how much a security title can involve.

Concentrations inside dedicated degrees

A dedicated degree can have its own tracks. The University of North Dakota's MS in Cyber Security offers Ethical Hacking, Computer Forensics and Secure Networks tracks. That is still a dedicated degree with a specialization, not a concentration in the sense used here. When we assign specializations, we rely on the school's named tracks or on several required courses in the area, not on a single elective.

How to read a program page or catalog

Marketing pages sometimes blur the distinction. The catalog (or bulletin) usually does not. Check these things in order:

1. The awarded degree. Find the line that names the degree conferred: "Bachelor of Science," "Master of Business Administration." If the security term appears only as a track, option, emphasis or concentration, it is a concentration.
2. The required course list for the concentration. A formal concentration has its own required courses. Security electives inside a general degree are not a concentration.
3. The credit count. Add up the required security credits and compare them with the degree total.
4. Entry rules. Some concentrations have their own gate. UTSA, for example, lets computer science students declare the cybersecurity concentration only after completing CS 2123 with a grade of C- or better.
5. Where a designation applies. An NCAE-C designation requires the institution to validate a Program of Study, which the CAE in Cybersecurity Community describes as "a series of courses and experiences that a student can reasonably accomplish in the course of attaining a degree or completing a certificate." That program of study can be a track. Towson says its Cyber Operations track within Computer Science has been recognized by NSA as a Center for Academic Excellence in Cyber Operations since 2012.

Why the label can matter outside the classroom

Some funding and hiring rules depend on how a program is structured. The CyberCorps Scholarship for Service, for example, requires students to be pursuing a bachelor's or master's "in a coherent formal program that is focused on cybersecurity" at a participating institution. Whether a particular concentration qualifies is decided by that program and the school, not by the program's marketing name, so ask the school's SFS contact directly if this applies to you.

Why we label them separately

In our directory every program carries one of two labels, based on the institution's own catalog or program page:

• Dedicated: the degree or official major is cybersecurity or a security field.
• Concentration: a named security concentration, track, specialization, emphasis or option with its own required courses inside a broader degree.

We exclude general degrees whose security content is only electives. Keeping the labels separate lets you compare like with like: dedicated programs with each other, and concentrations with each other. Our methodology explains how we verify each label against the school's own pages.

Which should you choose?

• Choose a dedicated degree if you want security to be the main subject of your studies and the name of your degree, and you want the largest share of credits in security.
• Choose a concentration if you want a broad computing, IT or business degree with a security focus, or you want to keep options open across related fields. Check the security credit count and the required courses before you commit.

Either way, put the programs side by side on Compare and read the catalog, not just the headline.