CyberSecurity Degree at TalTech: What's The Point?

The Conscious Developer — Fri, 18 Sep 2026 08:10:56 +0000

Let me preface this post with a disclaimer.

I've been a software developer for 20 years and that means two things. For one, I'm heavily biased towards the accumulation of knowledge in a practical manner. Second, I'm an adult and not a kid who can be pushed around because that's everything they know and they need the paper.

This year, I started studying CyberSecurity in Taltech, an Estonian university that ranked a respectable 600th in the QS World University Rankings 2027. I went into it with an open mind and with the hope that it would be, at the very least, as interesting as a Security Developer role I once held at a private company.

In that role, I felt deeply out of my comfort zone. I was hired to make true the dreams of automation the security team had. That said, I was quite successful at it. Turns out that Security Engineers are not really Software Engineers and I thrived at converting dozens of bash scripts into a platform that made sense and could be maintained. SOAR automation could be pretty fun regardless of how underwhelming the coding aspect of some of those said platforms can be. Rapid7, looking at you here.

When I left, I was deeply impressed by that field. My team lead found just the right way of hooking me up by borrowing me the book Countdown to Zero Day. I was enthralled by the idea that software had finally turned into a cinematic story. An excitement that I never experienced before in the trudging world of REST, CRUD and distributed microservices. If you've been in that area long enough, you know: you're mostly a plumber. And when you're not, you are just doing the same thing over and over again: API calls, database lookups, batch queries, retry mechanisms, error budgets, Kubernetes clusterology and the fact you can't decide what is worse: to have a separate DevOps team or to not have it.

Fast forward in time and I have joined Cybersecurity at TalTech. I, for one, I'm deeply passionate about teaching and that was always one of my favorite parts of the job: the idea you can inspire younger generations with the knowledge you accrued over a lifetime. You teach what you can, you allow them to make mistakes, you bring them closer when it's needed and you push them harder when a reckoning is needed. The ebbs and flows of learning.

At TalTech, the experience couldn't be more different. Let's distill this experience per course. Again, keep in mind that a lot of this is not new information to me but I consider that beside the point. I expected to find inspiration and a healthy dose of grounded real-world stories.

Fundamentals of Networking

I never really been a networking person. While I understand what is needed to be a somewhat proficient developer, I can't say I could thoroughly explain what a subnet mask is or how to convert decimal to binary in order to quickly grasp what's happening under the hood of the IPv4 addressing scheme.

Here's the reality of this course. The theory part is taught by a teacher who has relocated to the United States. Let's forget for a moment that a local university is happy to send money to another country instead of supporting the local economy and focus on what matters for the purposes of this post.

Two days before the university is about to begin, all students are informed the class is entirely online. Forget about real-life networking which should be the cornerstone of college life. The reality of the lectures boils down to two things:

While using MS Teams during an entire semester as the teacher robotically reads to students whom are all muted would already be disheartening enough, I quickly realized the class revolves around a single mechanism: the teacher reads pre-made slides from Cisco NetAcademy.

That's it. That's the entire teaching methodology.

On the other hand, there is the practical side which is on-site. I was a little excited about that but turns out the teacher has power dynamic issues as he seemingly enjoyed leaving students standing up in the corner of the classroom for 15 minutes without addressing that they could get a chair in another room while they wait. He would go in their direction several times to get cables and get back to looking at the class without acknowledge the three human beings standing there. When I asked him, can you please talk to those three people standing there?, he stared at me dramatically for three entire seconds as if this was a movie. In reality, I am guessing he's not used to a student speaking up. That's fine, the IT world is not particularly known for social prowess.

The lack of social prowess was also apparent in the fact this was an Assistant Teacher doing a PHD with little interest in instilling passion. He read and spoke everything in a monotonic voice as if he was doing us a favor. Now, you may be thinking: okay, who cares, though?

The kicker, for me, is this: you wanna know what's the last lab of an entire semester? Configuring SSH.

Can you imagine joining a company and spending 6 months to learn IPv4 and IPv6, ping, traceroute and SSH? I understand the academic world is meant to let you digest information and thoroughly learning something but I don't think this is the point here. We should hold students to a higher standard if we want to prepare them for the real-world later. How is it possible that after several hours of classes per week over the course of roughly 5 months, that's all you learn?

In time: when another student asked if the theory lessons would be online only for the whole semester he just answered a bored-out "yes." God forbid having empathy and connecting with students. I know, it's a bummer, folks. But we can make the best of it in this lab. I'll make sure to challenge y'all and we're going to have some fun. Or at least as much as it's possible with networking.

When I asked if I could get a voucher for CCNA 200-301 certification due to my experience and the fact I wanted to challenge myself, I was told I needed to wait a year so that I could also finish "Advanced Networking". An entire year to learn IPv4 ACLs and NAT. Sure, let's do it, but don't have the gall of calling that advanced.

Just watch Jeremy's IT Lab, practice using Boson and get one or two Cisco certifications. You will learn much more than entire year of college.

There's a downside to that too that I will discuss in the conclusion section.

Introduction to CyberSecurity

This one is particularly interesting as the teacher is also the head of the entire CyberSecurity program. Surely this is going to be an interesting one. I imagined him grounding everything into real-life stories and leaving us harrowed with the flaws of real world implementations.

Instead, we got terrible English language skills, which could be absolutely forgiven if the content wasn't so grudgesome. The slides look like they were made in 1995 using the DOS application Banner Mania. Frankly, I made better things back then as a child. That could also be forgiven but slides also have as many as 4 typos per page. Cyberscurty kind of thing.

For 3 entire classes, the teacher draws only one thing on the whiteboard. Two concentric circles where the inner one says data and the other one has IT on one side, the other has Non-IT and threatening red arrows point inside. The classes are just vocabulary definitions of the words used.

Boy, wait a minute, this is introduction to cybersec, what do you expect?

First, I expect everything to be grounded and inspirational. When the second lessons's slides contained a reference to how data access can be denied using an example of a Land Registry in a bullet point at the bottom, I jumped at it. Hot damn, he's going to talk about the Romania hacking that happened recently.

Nope, again, he just read the bullet point and moved on. At this stage, I'm starting to question myself: What is the point of the teachers if all they do is read poorly prepared slides? Instead, he fills a lot of the time by telling students the translation of the words: In Estonian, oht! (threat). I'm sorry but at best, that's tertiary to what's being taught.

To his credit, he's a genius. The whole Introduction to Cybersecurity course is the least amount of work he could get away with: he gives 3 lectures boringly saying "threat", "denial of service", "availability" and the entire rest of the semester is students giving their own presentations at a chosen topic.

That's it.

Go read Security Engineering - A Guide to Building Dependable Distributed Systems which is available for free on the author's website. You will learn more than an entire year in college, guaranteed.

Fundamentals of Programming

Again, let's picture the world of private companies. Far from saying they are perfect (they are definitely not), but they are a place where learning has to happen fast, at least if you set out to make a grand career.

While asking students that never coded in their lives to start by coding in C is a big ask, it also carries many benefits if done right. A more fundamental understanding of how the machine operates is certainly a great benefit. In the field of CyberSecurity so much is exploited at the lower-level that this makes sense.

While I would personally prefer if College started with something that allows you to see outcomes much faster like Python, C is a very defensible choice though you're at risk alienating a lot of students who see Coding as something tangential to CyberSec.

Here's the last two lessons of an entire semester: recursion and multidimensional arrays.

I'll be rough here again: picture you're hired as a junior. Not even that, picture you're the nephew of the CEO and you actually never coded in your life. 6 months later into your new job, you say: Ah-rah! I can finally edit a function that uses a nested array. If you're the CEO's nephew, you may get away with it and keep your job but rest assured: you will not make a career out of it.

The kickers are now kicking harder. Students are arranged in groups to make projects. That's great, I love it. Despite the stereotype, working at a company as a developer is actually a highly social enterprise. You can't really survive without talking to other departments, having meetings, understanding product requirements and so on.

But remember, the teaching and the inspirational part? Turns out you can't really use the teacher. You are instructed to use AI (ChatGPT Edu) for any doubts you have in your projects. Great, students who never coded in their lives will most likely not understand how to break tasks, how to write tests, what tests matter, how the way they distribute the work will likely reflect on their code's structure (Conway's Law and all that) and so on.

But God forbid the teacher is there to help you grasp it and ensure you got the fundamentals right. AI is now a crutch on both sides of the fence.

Introduction to Informatics and Computers

Honestly, this is one I can't really fault to the degree of the others. While it's meant to be an introduction, the slides do go deeper when speaking about CPU, memory and all that jazz.

While it's still mostly reading slides and the whiteboard goes (again) neglected. If it's not inspirational, this one is at least informational on the inner aspects of a computer.

I would argue the depth of it is a bit misguided but at least it holds the students to a higher regard. Whether they enjoy it or truly feel like they're learning something engaging it's unfortunately not the primary goal.

Social, Professional, and Ethical Aspects of Information Technology

All online again using MS Teams.

Mostly it's just speaking about the history of computers and things that happened since. Raise your hand if you ever needed to know Charles Babbage at work or needed to discuss whether the internet's most prevalent force is military, hippies or hackers.

I do consider this interesting information (though far from vital) but the class has certainly not explored any social, professional or ethical aspects of cybersecurity for real. It describes those things by (again) painfully reading slides and then asks students to use the chat box to discuss.

Of all classes this might be the one who would benefit the most of in-class energy. Instead, it's a 100-webcams-off endeavor like the network theory class.

Again most of the work is by the student themselves as preparing a seminar is actually what constitutes the bulk of the learning. I could give a pass to this class in isolation but analyzed in the context of all classes, it's just another excuse to not actually teach and to not actually inspire. The real information is in the books they recommend to read.

If you're 19, perhaps the outdated slides strike you as engaging but my bias clouds my judgement. I was 12 when the local newspaper released a booklet covering their entire first 3 classes.

Is web archiving fine as it is or should it receive more attention?
Why were emoticons/smileys considered controversial at first?
Nasty things appeared to the IT world already in the 1970s. Yet we can talk about true cybercrime only decades later. Why?

These questions can be interesting and engaging when the setting allows people to thrive. If you, as a teacher, are just reading a list of bullet points while telling students to "discuss amongst themselves" in a chat box after giving the most shallow introduction possible, what exactly are you accomplishing?

If I'm supposed to do most (frankly, all) of my learning by doing my own seminars, how effective is that pedagogical system? I'm sure there are some benefits to this approach but my point is: why am I in college for, then?

The ethical and social implications of the CyberSecurity field are huge and have a multitude of stories that could be told in harrowing manner to make us reflect and to leave us disturbed. Instead, we learn that in 1995 was the birth of LAMP and Java and that in 2009 the term "Dark Web" appeared.

So many bullet points.

If you ran a script removing every phrase that is preceded by a year and is followed by a line break, the slide count would drop dramatically. Almost everything is some "fact" that is beside the point of the ethical and social implications of our job. Or rather, they would be, if only they were expanded into actual topics.

Conclusion

Is every college like that? I surely hope not. Does every teacher compete to be boring? Certainly not. Did I expect more? Yes. Am I arrogant and overly critical? Also yes.

Many things can be true at the same time.

I do not think that it is a coincidence that if you open any video on YouTube speaking about software design, coding, networking and pretty much any computer-related field, the comments sections are shock full of comments like: you taught me more in 2 hours than my teacher at college did in 6 months. I didn't realize how bad it was but I do now.

While teaching is a (not so) secret passion of mine, I could never get a job in the field because every teaching position requires a degree, if not a masters. Yet, most of the teachers never worked a day in a real-life environment in their lives, which in my opinion defeats the entire purpose of preparing students to the world out there. I fully believe that teachers (and software architects) should aim to be a servant leader.

In my 20 years of career I interviewed many people fresh out of college. After the interview, me and other interviewers would always debate: what exactly did these people spend 3 or 4 years learning? How is it possible that they know nothing about what we actually do?

While you can argue that the next semesters would present more advanced concepts, I'm afraid they would do so in the same slow and shallow fashion. I have no doubts that more advanced classes teach "more advanced things" though looking at the entire curriculum it's clear that if you pick a single book from the recommended literature, you'd be better off.

To be fair, if a degree rocks your boat, go for it. Some fields will benefit from a degree more than not, specially if they require large amounts of mathematical comprehension. I, for one, have never even been asked if I have a degree (I do not) and it made no difference in the course of my development career. As an interviewer, I interviewed dozens of people and never even looked at the Education section of anyone's CV.

A degree will not get you the job. For the most part, it will also not be the tiebreaker between two equal candidates. I am fortunate enough to have a mentor in CyberSec and have made myself the decision to quit college after my first semester as he gave me enough guidance on what a good Security Engineer should know. No-one is going to pay me more for having a degree and it will not give me the information I'm looking for.

Now, there are upsides in the college life. You get the social aspect of (if everything doesn't turn out to be online one day) and you may meet people who will turn out to be deeply influential in your life. Naturally, if you're into academia, that's the place to be.

The other aspect of it is that getting certifications and buying books is an expensive endeavor. Certifications are also not a silver bullet either and they work better as a self-disciplined way of growing but won't necessarily get you a job just because you have one. Practical experience is mostly what matters in IT. These days no-one is hiring juniors due to the AI boom and I worry for the students. In Europe, high education is mostly free and you just can't beat that. Many students look fondly at their time in college as well so I cannot tell you to not join it if that's what you are looking for or if that's what your social circumstances permit.

Self-study also requires a pretty extreme sense of discipline but if you succeed in that, you're set out to have the most valuable skill a person in IT can have: a lifelong sense of continuous learning.

On the flip side, a lot of people benefit from a steady cadence of lectures that go at a slow but consistent pace with small take-home assignments. I can't tell you which one is suitable for you but I can tell you the industry is not forgiving. Five years (if you count Masters) at a college mean very little in the field, generally speaking. You knew nothing before you joined and you're severely outdated the moment you step out of college and try to join a company.

I, for one, have already made my life and my career. I speak from a position of luck and convenience so take all of this with a huge grain of salt, perhaps the biggest grain ever.

If you ask me what my advice would be, it's a very simple one: get a fucking job.

PS: Teachers should also be required to take corporate internships from time to time. They should also be held to the same language standards as students who have to take an expensive certification to prove their English skills.

PPS: I can perfectly explain what a subnet mask is and can quickly convert it to binary now.