Master's degree

Master's Degree Programme in Cybersecurity (instruction in Finnish)
Master of Engineering, 60 ECTS

Insinööri (ylempi AMK), Master of Engineering

  • Programme
  • Curricula
  • Implementations
Course Structure Diagram


New kinds of skills and competences are needed in the working life of the future. The objective of the education is to produce modern high-level competences in the area of cybersecurity.?Disruptions in the operations of our internet-based society may be fatal. New skills are needed for preventing, detecting, responding, and in case of failure, mitigating the consequences.

Completing the studies gives a strategic point of view on the importance of cybersecurity in different areas. You also become familiar with cybersecurity frameworks, standards, security management and can classify the vulnerabilities and the principles of protection. You know the cybersecurity business services and know how to carry out a security audit. After the studies, students can apply security solutions for discovering security threats and for protecting against them. You are also able to manage countermeasures against denial-of-service attacks.

Degree programme description

The extent of the studies is 60 ects:

- programme-specific core studies (25 ects)
- supplementary studies (5 ects)
- Master’s thesis (30 ects).

Programme-specific core studies (25 ects) include
- Strategic Cybersecurity 15 ects
- Indroduction to Cybersecurity 5 ects
- Cybersecurity audit and Cyberhygiene 5 ects
- Networks and Cybersecurity 5 ects
- Functional Cybersecurity 10 ects
- Defensive Cybersecurity 5 ects
- Offensive Cybersecurity 5 ects

Completing the studies, provides students with several functional cybersecurity skills, and you are able to:

- analyze the local information systems from the attacker’s point of view.
- examine information systems to find potential attack surfaces.
- to use common tools for gathering information about the target systems.
- implement counter measures against cyberattacks.
- improve the information system security and manage the principles of application security.

You are also able to protect industrial internet systems, manage intrusion detection systems and apply counter-measures in the network infrastructure.

The studies involve a lot of practical laboratory work. All the students carry out several case studies in a virtual laboratory environment. The laboratory work can take place as distant learning. The VirtuaLab can be used from XAMK’s own computers as well as from any device that has a modern HTML5 capable web browser. For example, a student logs into the system from Then he/she can reserve up to ten simultaneous scenarios. Each scenario can contain multiple virtual machines, and all virtual machines come with all the cables required for connecting them. Now the student selects which scenario he/she wants to interact with. After that, he/she is greeted with a network topology image containing all the devices included in the scenario. The student can select any device from the topology image by clicking it, and then he/she is taken to a screen that resembles a remote desktop view of the virtual machine.

The VirtualLab system enables the construction of complex virtualized environments that include multiple virtual machines, each with their own operating system. These machines can be servers, workstations, switches, routers, firewalls, and so on. All of these machines can be interacted with and external software can be installed to them. One can create any type of scenario they want, whether it is a offensive- or defensive cybersecurity laboratory or a practice laboratory for datacenter networking.

Implementation of studies and flexible learning tracks

The studies can be completed while working full time. They are carried out through blended learning methods, including lectures and cooperative learning sessions, online learning, and project-based learning. There are on average three contact teaching days per month. The contact sessions are held in Kotka on Thursdays 16.30 – 20.00.

Studies are in Finnish. Study material is however in English. There might be international visitor lecturers. Master’s thesis is done in Finnish. Master’s thesis and some learning tasks can be designed to develop the students’ employer organizations’ activities, benefiting both the students’ studies and the employer.

New students arriving in XAMK?will have our new policy in action. The new BYOD policy demands students bring their own devices, i.e. laptops, to campus.

RDI and cooperation with world of work

Education in XAMK cybersecurity participates eagerly in RDI activities. The most important result of recent projects has been the unique VirtualLab cloud service for RDI and education purposes. The contribution of students participating the RDI projects has been very important. As a new project called CyberELITE focuses on business opportunities and cybersecurity threats due to the digitalization of manufacturing industry. Starting point for the project is EU-level preparation for Cybersecurity act, which aims to improve and guarantee the cybersecurity and reliability of SME companies. Another starting point are cybersecurity testing needs reported by companies. The strategies of Councils of South-West and South-East Finland emphasize digitalization, renewal of manufacturing industry and cybersecurity as main goals.

The project will develop regional innovation platforms, which consist of IoT cybersecurity laboratory activities, processes, and connections to external actors. The focus for the innovation platform are manufacturing industry and secure IoT devices as a part of service production. The goal is to create ecosystem able to support IoT business development especially for SME sector.

Virtual laboratory hosted on Kotka CyberLab datacenter is used in CyberELITE as important remote laboratory for IoT devices. The project has given working or internship place so far for about ten students of cybersecurity.

Learning environments

XAMK CyberLab learning environment is unique in Finland. On Kotka campus where CyberLab learning environment is located the CyberLab datacenter is the platform for all the services needed to cybersecurity educations. The datacenter works also as an important part of datacenter technology education. The most important service running on the CyberLab datacenter is the VirtualLab. XAMK VirtualLab is a cloud service, which only requires users to have a modern web browser with support for HTML5.

VirtualLab is now widely used in cybersecurity- and information networks education, as well as in RDI activities (Research, Development, Innovation). It replaces almost all laboratory work done with physical devices. For example, before a three-person student group had only a few devices to use, but now one student can have a multiple complete virtual ”worlds” each including nearly 30 virtual devices. These are called ”laboratories” or ”scenarios”. VirtualLab is in heavy use: at the best, the system has had simultaneously over 100 users, over 300 active laboratories, about 3200 active virtual machines and approximately 5000 virtual cables.